Clash Setup Guide:
Import a Subscription and Connect

Before You Start: Get the Client and Subscription URL Ready

If you haven’t installed a client yet, go to the client download page and choose an installer that matches your device’s platform and processor architecture. Install it, then return here. If your operating system shows a permission prompt on first launch, read the app name and purpose carefully. You don’t need to enable startup on boot, LAN sharing, or TUN yet. First get a basic connection working; adding features later makes it easier to identify which setting changed network behavior.

Next, get a subscription URL from your provider that explicitly supports the Clash configuration format, or prepare a usable local configuration file. The client reads the configuration and forwards connections; installing it does not automatically give you a working proxy node. Subscription URLs often contain personal access credentials. Copy yours from a trusted account page, don’t share it with others, and never post the full URL in public screenshots, online conversion tools, or help forums.

For this setup, try to run only one proxy client. If your computer already has another proxy, VPN, or network routing tool, note its current settings and pause its connection first. Don’t change managed network settings on a work or school device without permission. Make sure your regular connection can reach your provider’s website, then follow the steps below in order. If an error occurs, stop at that step and save the message; this is more useful for troubleshooting than changing several switches at once.

Import a Subscription and Set It as Active

Open the client and go to “Configuration” or “Subscription.” Look for “New,” “Add subscription,” or “Import from URL.” On your provider’s account page, find the subscription labeled as compatible with Clash, Clash Meta, or mihomo, copy the full URL, and paste it into the client’s address field. You can give it an easy-to-recognize local name, such as “Laptop setup,” then click “Import” or “Save and update.”

After pasting, check the beginning and end of the URL. It should include the protocol, with no extra spaces, line breaks, or punctuation added by a chat app. Don’t use your provider’s homepage, account login page, or a single node’s share link as the full subscription. If the provider offers multiple formats, choose one supported by your client. A link opening in a browser doesn’t necessarily mean it returns the configuration the client needs.

Wait for the import to finish. On success, the client usually shows a configuration name, update time, or proxy groups. Then click the configuration card or choose “Enable” or “Set as active” to make it the one in use. Some clients enable imported configurations automatically; others only save them to a list, so check which entry is selected. Next, open the Proxies page and make sure the configuration’s proxy groups appear. If the list is empty, check the active configuration before trying to connect.

If you have a local YAML file, choose “Import from file” and open it in the file picker. File extensions may be hidden by default, so take care not to select a text note with a similar name. A local file differs from an online subscription in how it gets updated: changes made by the provider may not sync to your imported copy. To get the latest version, import it again or use the client’s update feature. For your first setup, avoid editing fields or indentation in the file; first make sure the original loads correctly.

If the import fails, read the specific error first. A network timeout means the request didn’t complete; it doesn’t necessarily mean the configuration syntax is wrong. “Parse error” points to an issue with the returned content or format. If the client offers “Update subscription through proxy,” don’t rely on it blindly when you don’t have a working proxy yet. Try again later or ask your subscription provider to confirm the URL and compatible format. See FAQ for more help, and don’t upload your subscription to an unfamiliar site just to get it imported.

Choose a Rule Mode and Proxy Group

Once the configuration has loaded, open the Proxies page or the client’s mode menu and find “Rule / Global / Direct.” Choose “Rule” to start. In this mode, the core routes connections according to the rules in the active configuration: some requests go direct, others use a proxy group, and some may be explicitly blocked. Rule mode doesn’t guess based on a website’s name; actual behavior depends on the configuration you just enabled.

Next, open the configuration’s main proxy selection group. It may be called “Proxy” or have a different name chosen by the configuration author, so don’t look for an exact label. Choose a node you’re authorized to use, or select an “Auto Select” or “Fallback” group if the configuration provides one. These groups let the configured mechanism choose a node. A proxy group may contain other groups, so if you select one, check that it ultimately points to an available node rather than Direct or Reject.

If the client offers a connection test, run one from the main selection group to help choose a node. The test’s destination and network path may differ from those used by your apps. A successful result only means the node responded under the test conditions; it doesn’t guarantee every site will open. A timeout also needs to be checked against real-world access. For your first setup, choose an available option and continue testing rather than repeatedly testing the entire subscription or comparing numbers endlessly.

“Global” usually sends ordinary connections that reach the core through the global proxy selection; “Direct” usually bypasses proxy nodes. You can use either mode briefly for comparison, but Global doesn’t automatically route every app through the core. The system proxy or TUN still determines which traffic reaches it. And Rule mode doesn’t mean every website uses a proxy: a request matching a Direct rule may be behaving exactly as configured.

After choosing Rule mode and the main proxy group, check whether the configuration has other groups organized by purpose. For basic setup, just make sure the group used by your target site has a reasonable selection; there’s no need to edit every category. Save detailed work on rule order, default routes, and custom rules until after you have a working connection. See the FAQ for basic concepts or the troubleshooting guide for systematic diagnostics. Don’t delete a whole set of rules just because one site won’t load.

Enable the System Proxy or Connect on Mobile

Go back to the home screen, settings, or tray menu and make sure the core is running. On desktop, turn on “System Proxy” if the client has that switch. Some clients use a menu item such as “Set as system proxy” for the same function. This usually points the operating system’s proxy settings to a local listening port, so browsers and apps that use the system proxy send requests to the client. Simply leaving the client window open doesn’t do this.

Find “Mixed Port” or mixed-port in settings. A common example is 7890, but use the value shown by your client; there’s no need to change it to match the example. A mixed port accepts HTTP and SOCKS5 proxy connections. If the client uses separate ports, use each one according to its displayed type. If you see “Port in use,” check whether another client is running rather than changing the system proxy address without updating the port the core listens on.

Android and iOS clients usually follow a different path. Once the configuration and proxy group are ready, tap “Connect” or the start button on the home screen. The first time, the system may ask to add a VPN configuration or allow a VPN connection. Check the app name, approve the request, then return to the client to check its status. A system VPN indicator means network routing is active; it doesn’t prove the remote node is working, so continue with the access checks below. If another VPN is connected, resolve the conflict as prompted by the system.

For the first desktop connection, leave TUN off. Once browser access works, if a target app really doesn’t use the system proxy, follow the client’s instructions to install or start any required service and try enabling TUN. TUN handles traffic differently from the system proxy and may involve routing, DNS, and administrator permissions. Don’t treat it as a universal fix; changing multiple network entry points at once makes it hard to tell what actually resolved the issue.

“Allow LAN” and accessing the internet from your own computer are separate things. If you’re only using this laptop, leave it off; you don’t need to open additional inbound firewall rules. If you later want to share the proxy with other devices on the same trusted network, learn about listening addresses, firewall settings, and device configuration separately. You also don’t need to enable startup on boot for the initial setup. Once everything works, enable it if you prefer, then confirm the client starts and loads the configuration after you sign in.

Check Site Access and Rule Matches

After connecting, open a new browser tab and visit a site that normally works to make sure basic network access is intact. Then try a site that requires a proxy on your current network and is available to you. Make a new request rather than relying on an already-open page: it may be cached, or an existing connection may still use the previous route. A page loading is a good first sign, but check the client’s connection records too.

Open the client’s “Connections” or “Logs” page and keep it visible, then return to the browser and refresh the target page. Look for the new domain, matched rule, proxy group, or connection chain. Clients show different fields; the key is to confirm the request reached the active client and followed the expected route. If it matches DIRECT, first check whether the rule is supposed to connect directly. If it reaches a proxy group but fails, check which node that group selected before assuming the system proxy is broken.

If the browser fails and you’re not sure which layer is causing the problem, try an explicit proxy test from a desktop terminal. The command below sends a request directly to the local HTTP proxy. Use it only if the current mixed port is 7890; otherwise, replace it with the value shown by your client. In Windows PowerShell, use curl.exe explicitly to avoid parameter differences caused by aliases in older environments.

curl --proxy http://127.0.0.1:7890 --head --max-time 15 https://example.com

Receiving HTTP response headers means the server responded to this explicit proxy request. The status code doesn’t have to be 200; redirects and access restrictions can also return a response. This test covers only the current destination and node, not every site. If you see a connection error for 127.0.0.1, first check whether the core is running and the listening port is correct. If the request reached the core before timing out, use the logs to investigate the node, DNS, or remote service.

If the explicit proxy test works but the browser still fails, check whether the browser uses the system proxy, has a proxy extension with its own settings, or whether another app changed the system proxy switch. If the browser works but a particular app doesn’t, first check whether that app supports the system proxy, then consider TUN. If sites behave differently, review the rules and selected node. Don’t judge all traffic by the result of a single IP lookup site; with rule-based routing, different destinations may take different paths.

Finally, practice disconnecting. On desktop, turn off the system proxy and any TUN you enabled, then use the client’s “Exit” command instead of just closing its window. On mobile, tap Disconnect and check that the system’s connection indicator disappears. Make sure regular network access still works, then reopen the client and restore the state you just verified. After switching Wi-Fi, waking the laptop from sleep, or connecting to a new hotspot, repeat the checks: regular site → target site → connection record.

If any of the four steps still fails, save the error message for that step and check the FAQ for a quick explanation. For persistent connection failures, subscription errors, DNS issues, or client crashes, follow the symptom-based steps in the troubleshooting guide. When asking for help, include the client name, platform, failed step, and relevant logs. Before sharing, hide your subscription URL, credentials, and other personal information.