Import a Clash Subscription and Make Your First Connection

# prerequisites

Before You Begin

First, choose a client for your operating system and processor architecture from the Download Center, then install and launch it. The client loads configurations, runs the core, and manages the proxy; installing it does not give you a working outbound connection. You’ll also need a Clash configuration file compatible with the client or a subscription URL from your provider. This site does not provide node accounts or subscription services.

For your first setup, pause other proxy clients, browser proxy extensions, and VPNs that may be routing traffic. When several programs change the system proxy, routes, or DNS at once, it becomes difficult to tell what is working. Leave the client’s default ports and DNS settings unchanged for now, and don’t enable startup launch, LAN sharing, or TUN yet. Get one basic connection working first, then add features one at a time.

Check that your system date and time are correct and that ordinary websites load without a proxy. If installation requires elevated permissions or you need platform-specific installation details, start with the preparation section in the full documentation. This page covers the basic first connection; explanations of protocols and network stacks are in the Glossary.

# Step 01 · Profiles

Import a Subscription and Enable the Configuration

Open the client’s “Configuration” or “Subscription” page and look for “New,” “Add,” or “Import from URL.” Choose a remote profile, paste your provider’s Clash subscription URL, give it a recognizable local name, then download or save it. Use the subscription endpoint—not an account login, purchase page, or documentation URL. Check for spaces or line breaks at either end, and make sure you haven’t copied punctuation added by a messaging app.

Wait for the profile to finish downloading. Depending on the client, you may see an updated timestamp, a download confirmation, or a new profile card. Next, select the profile and choose “Enable,” “Set as current,” or the equivalent option on its card so the core loads it. Saving a URL to the list may not switch the active profile. If the Proxies page still shows no groups, check which profile is selected before reinstalling the client.

Once the configuration loads, open the Proxies page. You should see policy groups and their available outbound options. Group names are set by the configuration author; they might be called “Proxy Selection,” “Node Selection,” or something else, so don’t look for one exact name. For now, just confirm that groups are listed without changing node settings. A small number of groups doesn’t necessarily mean the import failed—some configurations load nodes through remote providers, which may need time to update.

If You Have a Local File

If you have a YAML file, choose “Import from file” on the configuration page, open the file in the system file picker, then enable it as you would a remote profile. Don’t import a single-node share link as a complete YAML configuration: a full configuration may also include policy groups, rules, and DNS settings. Support for importing individual links depends on the client. If it cannot recognize the link, ask your provider for a configuration explicitly marked as compatible with Clash or mihomo.

If the import reports a parsing error, check the line or field mentioned and make sure the downloaded content wasn’t replaced by a login page. If the download fails, check your subscription’s expiration date, account status, and whether your current network can reach the subscription URL. The proxy is not connected yet, so don’t assume every download problem is caused by a node. A reachable URL can still return an incompatible format; see the Glossary’s guide to subscription and configuration file types.

You’re ready to move on when the profile is selected, the core is no longer reporting persistent configuration errors, and the Proxies page shows available policy groups. Next, choose a proxy mode. Don’t edit rules generated by your subscription yet, since an update may overwrite your changes.

# Step 02 · Mode: Rule

Choose Rule Mode

Open the client’s proxy mode settings, usually at the top of the Proxies page, in Settings, or in the tray menu. For your first connection, choose “Rule.” In this mode, the core evaluates the configuration’s rules in order to decide whether each connection should go direct, use a policy group, or be rejected. Routing isn’t determined simply by an app’s region, and it doesn’t mean every website will use the same node; the active configuration decides where traffic goes.

After choosing a mode, check which outbound policy group is selected. If a group includes “Direct,” “Auto Select,” and individual nodes, each is a different outbound option. To make your first test easy to repeat, choose a specific node or open the auto-select group to see which node it’s using. Don’t assume that seeing a group name means a remote node is selected: groups can reference other groups, so follow the selection chain to confirm the final outbound route.

One distinction is easy to miss: proxy mode controls how traffic that has already reached the core is handled, while the system proxy and TUN determine whether traffic reaches the core at all. Switching to Global does not automatically route every app. If an app doesn’t use the system proxy, changing modes alone may not make its connections appear.

For your first run, keep the rules supplied with your subscription. Don’t edit rules, proxy-groups, and DNS settings all at once. To understand rule order, fallback rules, and nested policy groups, see the Glossary’s guide to rules and traffic routing. For hands-on configuration changes, use the full documentation. For this step, just confirm Rule mode is selected and identify the outbound used by the main policy group.

# Step 03 · Connection

Choose a Node and Route Traffic

Test Clash Node Latency

On the Proxies page, open the policy group you want to use and select “Test,” “Latency Test,” or its speed-test icon. Wait for the results. A latency test usually checks whether a specified address responds through the proxy at that moment. It does not measure bandwidth: a lower result doesn’t guarantee faster downloads or access to every site. Choose a node that passes the test and is in a location that suits your needs.

After clicking a node, check that the selection indicator moves to it. If the policy group uses automatic testing, the client may choose an outbound automatically and may not let you pin a node. To choose one manually, use a group that supports manual selection. If you switch between groups without checking which one the main policy group references, the selected node on screen may not be the one your connection ultimately uses.

If every node times out, update the subscription once and check that your account and data allowance are active, then test another node. The test address itself may be unreachable, causing timeouts across the board, so don’t treat one test result as conclusive. You can still finish setting up traffic routing and cross-check using a real destination and the connection panel. If actual requests all fail too, work through the configuration FAQ step by step.

Enable the Clash System Proxy

In the desktop client’s settings, find “System Proxy,” enable it, and confirm that the core is running. The system proxy directs apps that respect the operating system’s proxy settings to the client’s listening port. Use the port shown in your client; you don’t need to change it to match a number in this guide. After enabling it, close existing browser tabs and open a new page to establish a fresh connection. Old connections may keep using their previous route, so an already-open page isn’t a reliable test.

On Android and iOS, you typically won’t find a desktop-style system proxy switch. Instead, tap Start or Connect in the client and approve the system VPN permission prompt. This allows the client to create a local traffic-routing tunnel; it doesn’t mean the subscription nodes are working. Once the system VPN indicator appears, continue to the verification step. If another VPN is running, stop it before connecting this client.

When Do You Need TUN?

If your browser uses the proxy but an app never appears in the connection panel, it may not follow the system proxy. That’s when to consider TUN, which routes traffic through a virtual network interface and routing rules, and may require a service component or administrator permissions. For your first setup, don’t turn on both the system proxy and TUN and hope for the best. Confirm that the system proxy works first, then test TUN separately using the client’s instructions so you can tell what changed.

TUN’s DNS and routing settings add variables, and a single toggle can’t guarantee compatibility with every setup. If you need TUN, follow the full configuration guide for your platform. For terminology, see DNS and the network stack. For now, continue once the apps you need have a clear route into the core; you don’t need to enable every feature.

# Step 04 · Verify

Verify the Proxy and Rules

Keep the client running, open its Connections page, then load a target website in a new browser tab. Start with a service you need to access and that your current rules are expected to proxy. Return to the connection panel, search for the domain, and check the matched rule, policy group, and outbound route. Field names vary by client, but the key questions are: did the request reach the core, which policy did it match, and did it use the expected node?

If the record shows the selected policy group and a remote node, that connection used the proxy. Then open a destination expected to connect directly under your current configuration and check whether it shows DIRECT. Both types of requests must match the configuration for routing to be working as expected. Seeing “Running” in the client only confirms that the process or core started—it doesn’t prove that browser traffic is being routed or that every rule behaves as intended.

If the connection panel shows only active connections, short-lived requests may disappear quickly. Reload the page and watch the panel, or use connection history or logs if your client provides them. A webpage may contact several domains, and its main content, images, login, and video resources can match different rules. Don’t infer the route for an entire site from one secondary request. Check the main domain first, then inspect connection records for failed resources.

Use What You See to Find the Problem

No relevant requests in the panel: First check that the core is running and the system proxy is enabled. Check whether a browser extension is setting its own proxy, and make sure you’re looking at the current client rather than another instance running in the background. Get the request to appear in the panel before troubleshooting nodes; changing nodes repeatedly won’t help if traffic hasn’t reached the core.

Requests appear, but use the wrong outbound: Check the matched rule and the policy group’s current selection. Make sure you’re not in Direct mode or using Direct as the main policy group’s outbound. For a brief comparison, switch to Global, explicitly select the same available node, and establish a new connection. If Global works but Rule doesn’t, check the rules and group references. Switch back to Rule afterward; don’t mistake the comparison settings for your final configuration.

The outbound is correct, but the page won’t load: Try another available node for the same destination and check whether just one service is failing or all destinations are. Node connectivity, restrictions on the destination service, account status, and DNS can all affect the result. Don’t disable certificate verification or change multiple network settings at once. Checking your outbound IP can provide a clue, but it only reflects that lookup request—not the route used by other apps or domains.

Save a Working Setup You Can Reproduce

Once verification is complete, note the configuration name, proxy mode, main policy group selection, and traffic-routing method. You can take a settings screenshot as long as it doesn’t show the subscription URL. If you want subscriptions to update automatically, set an appropriate update interval for the profile. After an update, check the main policy group again in case the groups changed or the selection reset; a successful download alone doesn’t confirm the outbound route.

Before quitting the desktop client, turn off the system proxy or confirm that the client restores the system settings on exit. Otherwise, the system may keep sending requests to a local port that is no longer listening, making ordinary websites unreachable. On mobile, use the client’s Stop button and confirm that the system VPN has disconnected. Your first connection is complete. Configure startup, background operation, or TUN later if needed; there’s no need to set everything up during the same troubleshooting session.