Step 1: Import a subscription
Open your Clash client and go to the “Configuration” or “Subscription” page. Look for “Add,” “Import,” or a plus button, then choose the option to add a remote configuration by URL. Some desktop clients show a subscription field at the top of the configuration page; mobile clients may first ask for a name and URL. The name is just a label, such as “Daily setup.” The URL determines what gets downloaded.
Copy the full subscription link from your provider and paste it into the URL field. Make sure it doesn’t include extra spaces, line breaks, or punctuation added by a chat app. Query parameters are part of the URL, so don’t remove them. If your provider offers several formats, choose one explicitly marked as compatible with Clash or mihomo. A regular webpage URL or a link made for another client may not work with your Clash client.
Click “Import,” “Save,” or “Download,” then wait for the configuration to download and parse. A successful import usually creates a configuration entry showing its name, update time, or source. An entry alone doesn’t mean it’s enabled: click it and choose “Use,” “Set as current,” or the equivalent option. Make sure it’s marked as the current configuration. Some Clash clients enable a configuration automatically after import, but check its status anyway.
Confirm the Configuration Is Loaded
Next, open the “Proxy” page and check for the policy groups defined in the configuration. Group names depend on the configuration author; you might see “Proxy Selection,” “Auto Select,” or a custom name. There’s no standard set of names across all clients. If the page is blank, return to the configuration page and confirm that the right configuration is selected, then check the logs for parsing errors. Verify these three things in order: the configuration was imported, it’s enabled, and its policy groups are visible.
If the subscription download fails, first determine whether the client couldn’t retrieve it or couldn’t parse its contents. Retrieval failures are often caused by an expired link, network issues, or account status. A parsing failure means the content was retrieved, but its format, fields, or core compatibility caused a problem. Repeatedly importing won’t fix an incompatible format. Copy a compatible link from your provider again and check the error message. Don’t disable certificate verification just to get the import to work.
If you only have a local file, use “Import from file” and select the YAML configuration from your provider. After importing, set it as the current configuration. A local file doesn’t automatically support remote subscription updates; to update it later, replace the file or refresh it using the provider settings in the configuration. You don’t need to add several configurations on your first setup. Get one through the verification steps first so you can tell which one is active.
Step 2: Choose a proxy mode
Open “Proxy,” “Mode,” or the mode selector on the home screen. For your first setup, choose “Rule.” Rule mode uses the current configuration to decide where each connection goes: some connect directly, some go through a proxy policy group, and others may be blocked by a rule. It doesn’t send every website through a proxy; actual behavior depends on the imported configuration. Start with the rules provided by your configuration provider to separate everyday traffic from traffic that needs a proxy.
After choosing Rule mode, open the policy group used for proxy traffic. If it contains a manual selection list, choose an available node. If it offers “Auto Select” or a failover group, you can choose that group according to the configuration instructions. A node’s name doesn’t prove that it’s working. If your Clash client offers a connection test, you can run it, but treat the result as a guide. In Step 4, verify access to the actual website you want to use.
Set the Mode and Policy Group Separately
The mode determines how connections are routed; the policy group determines which outbound is used. They’re separate settings. Even when the interface shows Rule mode, the proxy policy group may still be set to DIRECT, which sends connections assigned to that group directly. Check the selected policy, not just the mode name. If a policy group contains another group, expand it and confirm whether the final selection is a node, an automatic group, or Direct.
| Mode | How it routes connections | Recommended for first-time users |
|---|---|---|
| Rule | Matches connections against the rules in the current configuration. | Start here, and check the corresponding policy group. |
| Global | Usually routes all connections through the global policy group. | Use temporarily for comparison; you still need to select an outbound in the global group. |
| Direct | Usually connects directly to the destination without a proxy outbound. | Use to compare direct access; not for verifying a proxy connection. |
Global mode can be useful temporarily when troubleshooting rule issues, but it doesn’t automatically capture traffic from every device or app. A mode only handles connections that reach the core. Apps that don’t use the system proxy may still bypass Clash. After switching to Global, check that the global policy group points to an actual proxy outbound. Changing modes alone doesn’t prove the proxy is working.
Once you’ve made your selections, leave the configuration unchanged for now. Don’t edit rules, change DNS, or switch multiple nodes at once; keeping a clear baseline makes troubleshooting easier. For definitions of DIRECT, policy groups, and rule matching, see the glossary. For custom rule order, automatic selection policies, or rule sets, go to Advanced Configuration. You don’t need to set these up before your first connection.
Step 3: Connect
Check the Clash client’s home screen or status area to make sure the core can start. If there’s a separate “Start” button, start the core first. If it runs automatically with the app, continue to the system routing settings below. An open window doesn’t mean the proxy service is running. If the logs show a configuration error or a port conflict, fix it before enabling the system proxy.
Enable the System Proxy on Desktop
In your Clash client on Windows, macOS, or Linux, find and enable the “System Proxy” switch. This typically points your system proxy setting to a local listening port, so browsers and apps that honor the system proxy send their connections to Clash. Don’t copy a port number from an online guide; use the port configured in your client. After enabling it for the first time, return to the home screen and make sure the system proxy is still on.
If you see a permission prompt, confirm it comes from the Clash client you’re using, then grant permission as requested by your operating system. Linux desktop environments and apps vary in their system proxy support, and command-line tools may not use the desktop proxy settings. For this guide, start by verifying the connection in a browser rather than judging by whether a terminal app can connect. On macOS, follow your client’s installation instructions if it asks you to approve a helper component or system setting. You don’t need to enable other network extensions by default just to use the system proxy.
Allow the VPN Configuration on Mobile
On Android and iOS, tap “Connect,” “Start,” or the power-shaped button. The first time, your system may ask to add a VPN configuration or allow a VPN connection. Check the app name and prompt, grant permission, then return to Clash and check the connection status. This VPN is the operating system’s interface for routing traffic; it doesn’t mean the connection uses a proxy protocol called VPN. The active configuration and policy group still determine the outbound.
If you cancel the permission request, return to Clash and tap Connect again. If another VPN is running on your device, the system may disconnect it or ask you to stop the other app first. Android background restrictions may stop the connection when you leave the app; complete the initial test in the foreground, then allow any necessary background activity in system settings. On iOS, wait for the permission flow to finish before tapping Connect again.
Don’t Add TUN to Your First Connection
If your desktop client shows both “System Proxy” and “TUN mode,” use the system proxy for this browser test. TUN can capture connections from more apps that don’t honor system proxy settings, but it involves a virtual network interface, permissions, and routing. It isn’t a general fix for a basic connection problem. If you need to route games, command-line tools, or specific apps, complete Step 4 first, then enable TUN separately and check the settings in the TUN guide under Advanced Configuration.
Keep the Clash client running after you connect. Some desktop clients minimize to the system tray when you close the window; others exit, so check how yours behaves. When you no longer need the proxy, turn off the system proxy or disconnect on mobile before quitting Clash. If the core stops while the system proxy still points to a local port, your browser may lose internet access. Check for a leftover system proxy setting rather than changing DNS for the entire device or resetting all network settings.
Step 4: Verify the Connection
Keep the current configuration, mode, and outbound unchanged. Open a new browser tab and visit a website that normally works for you to confirm basic internet access. Then visit a website that should use the proxy under your current configuration. Choose a familiar destination you’re allowed to access; don’t use untrusted test links. Reload pages that were already open, or close and reopen the tab if needed, so a cached page doesn’t make the connection appear successful.
At the same time, open the “Connections” page in your Clash client and look for the domain or destination you just visited. Connections can end quickly, so if you can’t find one, reload the page or temporarily check the logs. Look at the destination, matched rule, policy group, and final outbound. For this proxy test, the connection should be assigned to a proxy group and use the node you selected. If it shows DIRECT, that connection was routed directly.
Compare Access Results with Connection Logs
A webpage loading shows that the destination is reachable; the connection log shows which route it took. Check both. A VPN icon, system proxy switch, or running core alone doesn’t prove that a website used the proxy. An exit IP lookup only shows the route for that particular request—it doesn’t prove that every app and domain uses the same outbound. In Rule mode, it’s normal for some connections to go direct while others use a proxy.
If the page loads but the log shows a direct connection, first check whether that destination is supposed to connect directly. To compare the proxy route, temporarily switch to Global mode, select a proxy outbound in the global policy group, and revisit the same destination. Check the connection log, then switch back to Rule mode. Don’t delete all your rules just to change how one page routes, and don’t change the mode, DNS, and TUN all at once without a clear reason.
Troubleshoot Connection Issues in Order
If no connections appear, first check that the system proxy or mobile connection is still on. Then check whether your browser has custom proxy settings or a proxy extension. Some apps don’t honor the system proxy and may bypass this routing method; try another browser before assuming the subscription is invalid. If connections appear but keep failing, check that the configuration is enabled and the policy group has a working outbound. Then try changing just one node for comparison.
Enabling TUN usually won’t fix an expired subscription, unavailable service, or unreachable node. If only certain domains fail with the same node, use the logs to distinguish a rule match issue from DNS resolution or a remote connection error. If you see an HTTPS certificate warning, don’t continue to sensitive pages or treat ignoring the warning as a routine fix. Check your system time and the destination address, then follow the symptom-based steps in Troubleshooting.
After verification, note the configuration name, proxy mode, and policy group selection so you can restore them later. To update a remote subscription, use the configuration’s “Update” or refresh option on the configuration page. After it updates, confirm it’s still the current configuration. Follow your provider’s and client’s guidance on automatic update intervals; there’s no need to update too frequently. Manual edits to a remote configuration may be overwritten the next time it updates. For changes you need to keep, use a supported override method.
From here, add features as needed: see Troubleshooting for setup issues and the glossary for unfamiliar terms. For startup behavior, rule set management, DNS and Fake-IP, TUN, or an external controller, go to Advanced Configuration. After your basic connection is verified, add one feature at a time and repeat the website and connection-log checks in this section to see what changed.