Clash Setup Guide
Import a subscription → Choose a proxy mode → Connect → Verify access. With a client and valid subscription ready, the setup takes about ten minutes; installation, permissions, and network troubleshooting may take longer.
Before You Start
A Clash client reads configurations and handles connections, but it doesn't create usable proxy nodes when you install it. Before you begin, you'll need a valid configuration from a subscription provider or network administrator, plus a working internet connection. With the proxy off, visit a site you can normally access to confirm that Wi-Fi, Ethernet, or mobile data is working. Importing a configuration won't fix a broken internet connection.
This guide starts with Rule mode, using the system proxy on desktop and the system VPN permission on mobile. Leave TUN, advanced DNS, and rule overrides unchanged for now. Keeping the initial setup simple makes it easier to identify which step failed. For field definitions, see the quick glossary; save more complex configuration for the advanced guide.
Import a Subscription and Enable the Configuration
Open your subscription provider's account page and find the subscription link specifically labeled for Clash or mihomo. Use the page's copy button to copy the full URL. Don't copy the account homepage from your browser's address bar or just a node name. Treat the subscription URL like a password: it often contains access credentials. Don't share it in screenshots, logs, or support requests.
Return to the client and open the Profiles or Subscriptions page. In Clash Verge Rev, you can usually paste the URL into the link field on the Profiles page and choose Import. Other clients may require you to tap Add first, then select Remote Profile or Import from URL. Give the profile a recognizable local name and start the download. When it finishes, you should see a profile card or entry—not a page stuck loading.
Seeing a profile entry doesn't mean the core is using it yet. Select the entry and choose Enable, Set as Current, or the equivalent option in your client. Confirm that the current-profile marker moves to the new entry. Then open the Proxies page and check for proxy groups and their available options. If the import succeeded but the Proxies page is still empty, first make sure the profile is selected, then check the logs for configuration parsing errors.
Subscription URLs and Local Files Are Different
If you have a .yaml or .yml file, choose Import File or Local Profile. Don't paste a file path into the remote subscription field. A local import reads the file's contents and usually needs to be replaced manually later; a remote subscription can be downloaded again from its URL. Either method can provide the current configuration. Choose the one that matches what you have—you don't need to learn conversion tools first.
Some generic subscriptions return encoded node links rather than a complete Clash YAML configuration. If import reports missing configuration fields or downloads a web page, ask the provider to confirm the subscription format and URL. Don't submit a credential-bearing link to an unfamiliar online converter. Learn more about the differences between subscriptions, configuration files, and node links in the quick glossary.
Check the Input First if Import Fails
Copy the original URL again, checking for leading or trailing spaces, line breaks, or missing characters. Then confirm that your subscription account is active and your network can reach the URL. A download failure and a YAML parsing error point to different issues: check the URL and network for the former, and the returned content and core compatibility for the latter. Don't keep clicking Import or change DNS fields at random to force a download. For more help, see Troubleshooting.
After importing, check the profile's update settings and set a schedule recommended by your provider. After an update, confirm that the current profile still works—especially if proxy group or node names have changed. Local changes in the client may be overwritten by the next subscription update. For now, keep the original configuration structure; if you later need persistent changes, see Local Overrides and Subscription Management.
Choose a Rule Mode and Proxy Node
Open the Proxies page and find Mode or Outbound Mode. Set it to Rule. Clients typically offer Rule, Global, and Direct, corresponding to mode: rule, mode: global, and mode: direct in the configuration. Changing the mode determines how the core selects an outbound route; it doesn't connect your apps to the proxy by itself. You'll enable traffic routing in the next step.
Rule mode checks connections against the configuration's rules in order and sends them to the specified node, proxy group, or direct route. It's useful for everyday access to both local services and services that require a proxy. The configuration determines which sites use the proxy; rules vary from one configuration to another. Start with your provider's rules, and don't delete them all just because one site won't load.
Choose an Available Route in a Proxy Group
Expand a manual selection group on the Proxies page. Group names are set by the configuration author; a group might be called “Proxy” or something else, so don't rely on its name alone. Check whether it lists nodes, an automatic selection group, or DIRECT. In a manual selection group, choose a node your provider says is available and confirm the selection marker moves to it. If you selected another proxy group, check that group's active choice too, until you know the final outbound route.
If the client offers Test Latency or Connection Test, run it once for the current group and wait for the results before choosing. Tests usually use an address specified by the configuration or client, so treat them as a reachability guide. A lower response time doesn't mean every site will load faster, and a timeout needs to be considered alongside the test address and actual browsing results. During initial setup, avoid testing every node and switching repeatedly; it makes it harder to tell which choice caused a failure.
For an automatic selection group, the core chooses a route based on the group type and test results. You don't need to click every node just because an automatic group is listed. First check that the main outbound group points to that automatic group. For details on select, url-test, fallback, and other group types, see Proxy Groups in the Advanced Guide. For now, focus on getting one stable connection.
When to Use Global and Direct Modes
Global mode sends connections handled by the core through the global proxy group. It's useful for briefly diagnosing rule issues. Check which route the global group has selected; Global mode won't fix an unavailable node or capture apps that aren't routed through the core. If a site works in Global mode but not Rule mode, note the difference, switch back to Rule when testing is done, and check which rule matched.
Direct mode sends connections handled by the core straight out to the internet, making it useful for a quick comparison with your regular connection. It isn't the same as quitting the client, and it doesn't guarantee that the system proxy has been cleared. To disconnect for everyday use, use the client's disconnect control. For now, keep Rule mode and one known-good route selected, then continue to the connection step. There's no need to edit rules or set every proxy group to the same node.
Connect and Enable the System Proxy
Return to the client's home or Settings page. First, confirm that the core is running and no configuration loading error is shown. A desktop GUI client may start the core automatically, or it may require you to click Start; check the current status and logs. Close any other proxy or VPN clients for now to prevent multiple apps from changing system proxy or routing settings. Testing with just one client makes troubleshooting much easier.
Desktop: Enable the System Proxy First
Find System Proxy in Settings or a home-screen shortcut and turn it on. Browsers and apps that follow the system proxy setting will then connect through the local port provided by the client. In Settings, check the mixed port. A common value is 7890, corresponding to the mixed-port field, but use the value shown in your client—don't change it just to match a tutorial. Some clients manage ports separately, so the value in your original subscription may not be the one currently in use.
For your first connection, leave Allow LAN disabled: testing in a browser on the same device doesn't require exposing the proxy to other devices. Leave TUN disabled too. First verify access through the system proxy, then check whether any apps ignore that setting. The system proxy affects only software that follows it; it doesn't route all network traffic.
On Windows, check the system proxy under Settings → Network & Internet → Proxy. On macOS, go to System Settings → Network → your current network connection → Details → Proxies. Labels may differ slightly between OS versions. Let the client manage and clear these settings; there's no need to enter a separate proxy address manually. Linux desktop environments and apps vary in their support for system proxy settings. If your browser isn't using the proxy, check its own settings first rather than changing several options at once.
Mobile: Approve the VPN Connection
Android and iOS clients typically have a Connect, Start, or power-shaped button. Make sure the current profile is selected, tap the button, and follow the system prompt to allow a VPN connection or add a VPN configuration. This permission lets the client route device traffic; it doesn't mean the subscription nodes are working. Once the connection status shows as active, continue to the next step and test actual access.
If the mobile client says another VPN connection is active, disconnect the other app and try again. Android battery management can affect background operation; check the app's battery and background permissions only if the connection works but repeatedly drops when the screen locks. On iOS, check the VPN status in Settings and make sure another app's profile isn't selected. If initial authorization fails, don't repeatedly delete the subscription—subscription setup and system permission are separate steps.
Configure Launch at Startup After the Connection Works
Look for Launch at Startup under Settings → General or a similar section. Distinguish between launching the client and connecting automatically after launch: the first may only open the interface, while the second also involves starting the core and restoring the system proxy. Options vary by client. Enable what you need, then restart the system to test it; an enabled toggle alone doesn't prove the proxy is working automatically.
When testing, check that the current profile is still selected, the main proxy group still uses the expected route, and the system proxy has been restored correctly. Mobile auto-connect depends on system permissions and client capabilities, so desktop startup instructions may not apply. If you lose internet access after startup, turn off auto-connect and return to the manual connection steps. Once the basic configuration works, see the relevant tips in Usage Tips.
Verify Access and the Outbound Route
After connecting, reopen your browser or open a new window. First visit a site you can normally access directly to make sure basic access still works. Then visit a site that's expected to use the proxy and check that it loads fully. Don't rely only on the client's connection icon or a page you opened earlier. Cached content and existing connections can hide configuration changes, so make a new network request.
While testing, open the client's Connections page and search for the destination domain. Check which rule matched and whether the route was direct, used a node, or passed through a proxy group. A webpage may request multiple domains, and those requests may use different routes. Connection entries may disappear after a request completes; watch the page while refreshing rather than assuming the proxy failed because the entry isn't kept.
Use Logs to Troubleshoot, Not Just the Toggle
If the client lets you filter log levels, start with info, corresponding to log-level: info, then reproduce the failed request once. Look for configuration loading errors, connection timeouts, and DNS resolution failures. A single warning doesn't necessarily affect all access; match its timestamp and destination domain to the action that failed. If you need help, share only the relevant log lines and hide subscription URLs, credentials, and other sensitive information.
An external IP lookup can provide another clue, but it shows the route for that request only. In Rule mode, the lookup site itself may be configured for a direct connection, so one IP result can't represent every app. For a more reliable first test, confirm that the target site loads, the client records the connection, and the outbound route is as expected. DNS leak checks and complex network stack tests can wait; they're not required for your first connection.
If It Fails, Troubleshoot in This Order
If even sites that normally connect directly won't load, disconnect the proxy and test your internet connection. Once it's working, recheck the current profile, Rule mode, and selected node, then reconnect. If the client's connection test succeeds but the browser has no corresponding connection entries, check the system proxy or the browser's own settings first. If an entry appears but the request times out, try a known-good route and check the logs for the cause.
If only one service is inaccessible, briefly compare it in Global mode, making sure the global proxy group has a working node selected. If it works in Global but not Rule mode, note the matched rule, switch back to Rule mode, and investigate the configuration. If both modes fail, don't assume the rules are at fault. For more troubleshooting steps, see Troubleshoot Clash Connection Issues. For DNS, rule sets, or TUN, continue to the advanced guide.
Keep the Working Settings and Check Before Disconnecting
Once access works, keep the current profile, Rule mode, and working route. There's no need to keep changing ports and DNS in search of improvements. Note which client and connection method you used, along with any settings you changed; this makes it easier to compare after a profile update or network change. If a subscription update changes node names, check the main proxy group's selection so it doesn't point to a node that no longer exists.
When you're done, turn off the system proxy or click the client's Disconnect button before quitting normally. If you force-quit a desktop client, the system may keep proxy settings pointing to a local port, leaving your browser offline. Reopen the client to clear the system proxy, or turn off the relevant setting in your system's proxy preferences. On mobile, confirm that the VPN is disconnected. You've now imported a profile, chosen a route, connected, and verified access. From here, explore advanced setup as needed.