BEFORE STARTING

Confirm the Client and Subscription URL Before You Begin

This process works with common Clash GUI clients on Windows, macOS, Android, iOS, and Linux. Before you begin, prepare two things: a client that is installed and opens normally, and a subscription URL generated by your service provider. A subscription URL is not an account created automatically by the client, nor is it included with the installation package. It usually needs to be copied from the control panel of the service you use.

If you have not installed a client yet, visit the client downloads page and choose software for your operating system. Windows and macOS clients commonly offer a “Configuration,” “Subscription,” or “Profiles” entry. On Android and iOS, the same function may appear in a configuration card on the home screen, a resources page, or a remote configuration menu. The labels vary, but the goal is the same: give the client a configuration file that the core can read.

For your first setup, close other proxy clients that modify system network settings. This prevents multiple programs from competing for ports or repeatedly overwriting the system proxy. You can leave your browser open, but after connecting it is best to open a new window or fully refresh the page. If the network requires a campus login, hotel Wi-Fi sign-in, or enterprise guest portal, complete that authentication without Clash enabled before importing the subscription.

The four steps below cover the shortest path to a basic connection. DNS enhancements, Fake-IP, TUN routing, rule-set syntax, and core differences are advanced topics; read the Protocols and Core Manual after the basic connection works. Getting the main flow working first makes it easier to tell whether a later problem comes from the configuration, node, or system network.

IMPORT PROFILE

Import the Subscription Configuration

After opening the client, go to the “Configuration,” “Subscription,” or “Profiles” page. This page stores remote subscriptions and local configurations; it is not where you choose a specific node. Look for “New Subscription,” “Add Configuration,” “Import from URL,” or an add button with a plus sign, then choose URL import. If the client offers both file and URL import, choose URL import so future updates can be fetched from the same address.

Paste the URL and Import It

Copy the complete subscription URL from your service provider’s control panel and paste it into the client’s address field. Do not shorten the URL manually or include explanatory text before or after it. Some clients also ask for a configuration name. Use a recognizable name such as “Daily Subscription” or the service name; this name is stored only on your device and does not change the remote configuration.

After you click “Import,” “Save,” or “Download,” the client requests the remote configuration. Normally, a new configuration card appears within a few seconds and shows its latest update time. Some clients activate the new configuration automatically, while others only add it to the list. Check for a selected marker, green status, or “Use” button beside the card. If it was not activated automatically, click the configuration and make it active.

What a Successful Import Looks Like

A new subscription name appears in the configuration list instead of only a blank entry.
The proxy page shows strategy groups and node options.
The client log does not continuously report configuration parsing or download failures.

Check That the Configuration Works After Import

Switch to the “Proxy” or “Proxies” page. If multiple strategy groups appear and you can choose nodes within them, the configuration has been loaded by the core. If the proxy page is still empty, do not enable the system proxy yet: the client has no forwarding policy to execute. Return to the configuration page, confirm that the current configuration is selected, and then try “Update” or “Download Again.”

A subscription URL may contain access credentials, so protect it like account information. Do not post it on forums, in screenshots, or in public documents. If the client immediately reports an invalid URL format, copy the URL again from the service control panel instead of editing it yourself. For a network error, temporarily use a browser to check whether the service control panel is reachable. If the failure continues, see Troubleshooting for subscription download, certificate, and network timeout checks.

The client now has the rules, strategy groups, and node information. The next step is not to turn on every network switch immediately. First decide how traffic should be routed, then choose an available node for the main strategy groups.

SELECT MODE

Choose a Proxy Mode and Node

Open “Proxy,” “Proxies,” or the proxy mode section on the home page. Most Clash clients offer three basic modes: Rule, Global, and Direct. For first-time setup, choose “Rule,” represented by the configuration key mode: rule. Rule mode evaluates each request against the rules listed in the configuration and decides whether to proxy it, connect directly, or reject it, instead of forcing all traffic through one node.

Use Rule Mode for the Initial Connection

Click “Rule” or “Rule mode” to open the strategy group list. Common groups may be labeled “Node Selection,” “Proxy,” “Proxy,” or another name defined by the subscription provider. Open the main manual selection group and choose a node. If the client offers latency testing, use the result as a reachability reference, but remember that it reflects only that probe and does not represent the loading speed of every site. There is no need to keep testing until a particular number appears.

After selecting a node, confirm that the current option shown beneath the strategy group name has changed. Some configurations also include “Auto Select,” “Failover,” or “Load Balance” groups. Beginners can start with one clearly identified node to make troubleshooting easier. Once the basic connection is stable, switch to an automatic option provided by the configuration if needed.

Proxy Mode	How It Works	Recommendation
Rule	Selects a strategy according to the domain, IP, and final matching rules	Use as the default mode for initial setup and everyday use
Global	Sends most requests through the selected proxy strategy	Use briefly only to isolate rule-matching problems
Direct	Sends requests without a proxy node	Temporarily bypass the proxy path or use it for comparison checks

When to Use Global and Direct Mode

If a destination cannot be reached in Rule mode but works in Global mode, the node is usually available, while the current rules are not sending the request to the correct strategy. Do not stay in Global mode permanently to hide the issue. Note the destination domain and inspect the match result in the rule settings later. Full coverage of custom rules, rule priority, and the MATCH fallback is available in the Protocols and Core Manual.

Direct mode bypasses proxy strategies and is useful for determining whether a problem comes from the proxy path. It does not exit the client or delete the subscription. Switch back to Rule mode after testing. Otherwise, even with the system proxy enabled, traffic may continue to follow the Direct policy, creating the misleading impression that the client is connected but access results have not changed.

CONNECT

Enable the System Proxy and Establish the Connection

After completing the configuration and choosing a node, return to “General,” “Settings,” “General,” or the client home page and find the “System Proxy” switch. Desktop Clash clients usually write a local listening address and port to the operating system’s proxy settings, allowing browsers and apps that follow the system proxy to send requests to the Clash core. After enabling it, leave other advanced options unchanged for now.

System Proxy on Windows and macOS

On Windows or macOS, the client status should change from off to on after you enable the system proxy. Some systems may request administrator permission; approve it as prompted. If you inspect the proxy settings in the system network panel, you will usually see a local loopback address and the port used by the client. Do not edit these values manually unless you know why. After the client closes or changes ports, old values entered by hand may remain in the system.

If the client says the system proxy is enabled but the browser shows no change, close the browser completely and reopen it. Some running apps cache network settings and do not read the new system proxy immediately. Also check that the browser has not configured a separate proxy. Application-level settings may take priority over system settings and bypass Clash.

Connection Confirmation on Android and iOS

Mobile clients usually handle traffic through the system VPN interface. After you tap the connect button, Android or iOS displays a system authorization dialog showing that the client wants to add a VPN configuration. Approve it, and a VPN indicator should appear in the system status area while the client home page shows the connection status. This authorization only allows the client to create a network tunnel; requests are still handled according to the imported Clash configuration and current proxy mode.

If the mobile connection drops immediately, return to the configuration page and confirm that the subscription loaded successfully. Then check the log for port, DNS, or configuration syntax messages. Android battery optimization may restrict the client in the background after the screen locks. In the system app settings, choose an appropriate background policy for the client. Menu names vary by device; see Troubleshooting for the relevant checks.

When Do You Need TUN Mode?

The system proxy is a good starting point for testing browsers and desktop apps that follow proxy settings. Some apps do not read the system proxy, or need UDP handling, virtual network interface routing, or broader system traffic coverage. Consider TUN mode only in those cases. TUN involves system permissions, routing tables, and DNS handling, so do not toggle it repeatedly alongside the system proxy without a clear purpose.

This guide uses the system proxy as the primary first-connection path: enable the system proxy on Windows and macOS, and approve the system VPN request on Android and iOS. Linux desktop environments can follow the same approach if they support a system proxy. On servers and routers, the mihomo core is usually started through configuration files and a service manager, an advanced scenario covered in the Protocols and Core Manual.

Quick Checks After Connecting

The Clash client remains running instead of closing immediately after the connection is enabled.
The desktop system proxy remains enabled, or the mobile device shows an active VPN connection.
The current configuration and Rule mode were not switched to other options during authorization.

Requests can now enter the Clash core, but an illuminated switch alone does not prove that the target traffic is using the selected strategy. The final step is to check both the browser result and the client connection log for an observable end-to-end verification.

VERIFY

Verify That the Proxy Is Working

Reopen the browser and first visit a site that normally loads reliably to confirm that the basic network has not been interrupted by a configuration error. Then visit a familiar service that shows network exit information and compare the exit address or region before and after connecting. Do not rely on a single message on the webpage. Also open Clash’s “Connections,” “Connections,” or log page and check whether the browser request entered the client.

Confirm the Request Path in the Connection Log

The connection panel usually shows the destination domain, connection type, matched rule, and strategy chain. Refresh the browser page. If the matching domain appears and the strategy chain points to the node or strategy group you selected, the system proxy, rule matching, and node forwarding are working together. If the request is visible but the page still fails to load, the problem is more likely node reachability, the destination service, or DNS resolution than the system proxy switch.

If no browser request appears in the connection panel at all, first check that the system proxy or mobile VPN is still enabled. Then confirm that the browser is not using a separate proxy, network extension setting, or stale cached process. On desktop, quit and restart the browser. On mobile, remove the target app from the background and reopen it. Refresh once more after these checks; there is no need to repeatedly delete and re-import the subscription.

Use Mode Switching for a Narrow Comparison Test

If a destination cannot be reached in Rule mode, briefly switch to Global mode and load the same page again. If Global mode works, the system connection and node are basically available, so focus on rule matching. If Global mode also fails, try another node. Change only one condition at a time so you can identify what fixed the problem. Restore Rule mode after testing instead of leaving a temporary diagnostic state as the long-term configuration.

If no nodes can connect, return to the subscription page and click Update to check whether the service provider has published a new configuration. After updating, select the active configuration and node again, because some clients reset strategy group choices when refreshing a subscription. If the update fails, check the device time, basic network connection, and whether the subscription URL is still valid. Log messages such as timeout, connection refused, or DNS errors provide useful clues; see Troubleshooting for their meaning and the recommended order of checks.

The Correct Order for Future Subscription Updates

You do not need to add the subscription again for everyday use. Open the configuration page, find the current subscription, and click Update. Wait for the remote content to finish downloading. Then confirm that the configuration remains selected and check the usual strategy group’s node on the proxy page. An update may add, remove, or rename nodes. If the previously selected option no longer exists, the client may fall back to the default strategy.

After changing networks, such as switching from home Wi-Fi to a mobile hotspot, wait for the network to stabilize if the connection does not recover immediately. Then turn the system proxy or mobile connection off and on again. Do not change the subscription, DNS, TUN, and rules at the same time, as that makes diagnosis harder. Check each item in this order—basic network, active configuration, proxy mode, node, system connection, and logs—to find the break more quickly.

Handle Advanced Configuration After the Basic Connection Works

Once the four-step process is stable, adjust TUN, LAN access, DNS enhancement modes, or custom rules according to your needs. To understand the design differences among Shadowsocks, VMess, Trojan, VLESS, Hysteria2, and TUIC, as well as the relationship between the original Clash, Meta, and mihomo cores, continue with the Protocols and Core Manual. These settings do not change the basic sequence in this guide, but they do affect how traffic is resolved, matched, and forwarded.

When subscriptions fail to update, old system proxy settings remain, ports are occupied, the client crashes on launch, or connection logs show errors, visit Troubleshooting and follow the category for your issue. Keeping the error type, time of occurrence, and action taken in the client log is much more useful for diagnosis than recording only “unable to connect.”

SETUP COMPLETE

The Four-Step Basic Process Is Complete

When changing clients or reinstalling later, follow the same order: import and activate the configuration, choose Rule mode and a node, establish the system connection, and finally verify the result through the connection log.

View Troubleshooting Read the Protocols Manual

Clash Subscription Import and Connection Guide