Before You Begin: Get the Client and Subscription Ready
Clash-compatible clients read your configuration, match rules, and route requests. Installing a client does not provide a proxy service or automatically give you a working route. Before you begin, get a subscription link from a trusted provider or a YAML configuration file compatible with your client’s core. If you only have an account, a sign-in URL, or a QR code for a single node, check the provider’s instructions to find the right export format.
Before downloading, check your operating system and processor architecture. On Windows, follow the installer. On macOS, open the disk image and drag the app to Applications. On Android, download the APK and grant the browser or file manager permission to install it when prompted; you can revoke that permission afterward. On iOS, follow the link from the download page to the relevant app store. On Linux, choose a package format supported by your distribution. If the system reports that the app is incompatible, return to the download page and choose another build. Don’t repeatedly try to install it by disabling system security features.
When you first open the client, keep your current network connection working and avoid running another proxy or VPN at the same time. If the system asks to install a helper service, review what permissions it needs. If you don’t need TUN yet, there’s no need to enable every advanced feature just to follow this guide. Once the basic settings save successfully and the Configuration page opens, you’re ready to import a subscription. For installation or permissions issues, see the Help Center’s setup and configuration guide.
Step 1: Import a Subscription and Select the Configuration
Open the client’s Configuration, Subscription, or Profiles page and look for an option such as Add, Import from URL, or Import Subscription. Paste the full subscription link into the URL field—not the node search box. Give the configuration a recognizable name, such as “Daily,” then select Import or Download. The name is only for your own reference; it doesn’t change the provider’s nodes or rules.
Before pasting, check that the link has no leading or trailing spaces, line breaks, or punctuation added by a messaging app. Subscription links may contain access credentials, so don’t post the full link publicly or leave query parameters visible in screenshots. If the provider offers formats for multiple clients, choose the Clash- or mihomo-compatible format recommended for your client. Don’t paste a format intended for another tool just because its name looks similar.
After importing, the configuration usually appears as an item in a list. Select it or click the adjacent Use or Enable button to make it active. A downloaded file alone doesn’t mean the configuration is in effect. Next, open Proxies and confirm that its proxy groups are listed, then check Rules for rule entries. Subscription contents vary, so names and counts don’t need to match someone else’s screenshots.
If you have a local file, choose Import File on the same Configuration page, select the YAML file, and make it the active configuration. Changing a file’s extension to YAML does not convert its format. Save message attachments somewhere the device can access. On mobile, you can also share a file to the client from the system share menu; afterward, return to the configuration list and confirm it’s active.
If the download fails, leave the system proxy off, check that regular websites load, and confirm the subscription link is still valid. For a parse error, note the field name or line number in the message, then return to the provider’s page and choose a compatible format. Don’t delete DNS, rule, or proxy group fields at random during your first import; that can turn a format issue into a configuration problem. For help with format conversion or failed updates, see configuration troubleshooting.
Once the configuration is active and its proxy groups are visible, continue to the next step. To update the subscription later, use the Update option in that item’s menu; you don’t need to create a new configuration each time. Changes made directly to a file generated from a remote subscription may be overwritten during an update. For your first setup, keep the original contents and make separate changes only after the connection works.
Step 2: Choose a Rule Mode and Proxy Route
Open the client’s Proxies or Mode section and find the Rule / Global / Direct selector. For your first setup, choose Rule. The client will then process requests according to the current configuration: some connect directly, while others go through a designated proxy group. Rule mode does not send all traffic through a proxy or guarantee that a particular site will use a specific route; the result depends on the subscription’s rules.
Select an Available Route in the Proxy Group
After selecting Rule mode, check the proxy groups. For a manual group, select a node or subgroup as the current route. An automatic group chooses a member according to the configuration’s health-check settings. First make sure the list isn’t empty, then confirm the selected route suits your needs. If a request you expect to proxy uses a group set to DIRECT, it will connect directly; that doesn’t mean the system proxy switch has failed.
If the client has a connection test or node speed test, run it to rule out obviously unavailable options. The test may use a different address from the service you want to reach, and passing it doesn’t mean every site will work. For your first setup, choose one route that lets you access the site you need; there’s no need to compare every option. If you see nested groups or automatic selection rules, keep the subscription’s default structure for now.
When to Use Global and Direct Modes
Global mode usually sends requests that enter the client to a global proxy group, which then selects a route. It’s useful for a quick comparison with Rule mode, but it won’t automatically capture traffic from apps that don’t use the client. It also doesn’t mean every program on your system is being proxied. After switching to Global, check that its group uses the route you expect—changing the mode alone isn’t enough.
Direct mode usually connects requests that enter the client straight to their destination. It can help with comparison tests, but it can’t confirm that a proxy route is working. For this guide, stay in Rule mode. Don’t change the mode, node, and DNS settings at the same time. Change one setting at a time so you can tell what caused any change in the results. For more on the differences between modes, see usage tips and proxy modes.
Step 3: Start the Core and Enable the Connection
Your configuration is active, and the mode and route are set. Check the client’s home or status page to make sure the core is running. Some desktop clients start it automatically; others require you to click Start or Connect. If startup fails, note the error instead of repeatedly toggling the switch. Even if the system proxy points to a local address, no requests can be handled while the core is stopped.
Desktop: Enable the System Proxy
On Windows, macOS, and Linux, the system proxy switch is usually in Settings. Once the core is running, turn it on. The client will try to point the system’s HTTP or HTTPS proxy to its local listening address. For your first test, leave TUN off and verify in a browser. That way, changes to the system proxy, virtual network adapter, and DNS won’t make it harder to identify a problem.
Many clients show a mixed port, such as 7890, but use the value shown in your current Settings page. The system proxy port must match the client’s listening port. This is a local connection address, not the remote node’s port; don’t enter a server port from your subscription as the system proxy port. If another app is using the same port, resolve the conflict and update the relevant settings. See the troubleshooting guide’s port section for details.
On macOS, if the system asks to change network settings or install a helper service, make sure the request comes from the client you just installed, then grant permission as instructed. Linux desktop environments handle system proxies differently, and some apps have their own network settings. Turning the switch on only means the client has tried to update the system configuration; it doesn’t guarantee that every app will follow it. If a browser extension also manages your proxy, pause its proxy feature to prevent the two settings from overriding each other.
Mobile: Approve the System Connection Request
On Android and iOS, the client usually creates a system VPN connection when you tap Start or Connect on its home screen. The first time, the system displays a permission prompt. Check the app name and request, approve it, then return to the client to check its status. The VPN connection carries proxy traffic; it doesn’t provide a remote service. Access still depends on your imported configuration and selected route.
If another VPN or proxy app is connected, disconnect it from within that app before starting this client. Mobile operating systems generally limit how VPN connections can be used at the same time, and switching between apps may replace the active connection. On Android, if battery restrictions keep the client from running in the background, keep it in the foreground while you test, then adjust battery settings if needed. On iOS, keep the connection active in the app for now and don’t add extra settings such as On Demand.
TUN mode is for situations where you need to route traffic from more apps. It can affect permissions, routing, and DNS, so it isn’t required for a basic browser test. Continue to the next step using your current setup. If an app doesn’t follow the system proxy, check the troubleshooting guide for that specific symptom rather than turning on every option at once.
Step 4: Verify Traffic and Restore Your Network Settings
Leave the client running and open an HTTPS page in your browser to test the connection. Choose a page that clearly shows the result, then reload it. At the same time, open the client’s Connections or Logs page and look for a new entry for the domain you just visited. Seeing a previously cached page doesn’t confirm that this request went through the client; if needed, test a page you haven’t visited before.
Match the Request to Its Rule and Route
In the connection details, check the destination domain, matched rule, and final proxy group or route. In Rule mode, some addresses showing DIRECT is normal; what matters is whether the result matches your configuration. A page loading doesn’t prove it used a proxy, and an address shown by an IP lookup page doesn’t tell you that every app uses the same route. Match the specific request to the client’s log to get a more reliable answer.
If your browser says it can’t connect to the proxy server, first check that the core is still running, then verify the local system proxy address and port. If the browser’s requests don’t appear in the client at all, check whether an extension is handling them or the browser has its own proxy settings. If a request appears but times out, the issue is more likely with the selected route, destination, or network path. Continue with node timeout troubleshooting instead of reinstalling the client repeatedly.
Test terminal and browser traffic separately. Many command-line tools don’t use the desktop system proxy; they rely on environment variables or app-specific options. So a browser working while terminal traffic connects directly isn’t a contradiction. For your first setup, a browser test is enough. If you need a proxy in the terminal, set it up separately after checking how your tool supports proxies. Terminal environment variables may remain after you close the client, so remove them separately when you’re done. For DNS issues, see the DNS troubleshooting section; don’t disable certificate verification to get around HTTPS errors.
Enable Launch at Startup After Verification
Once the connection works, you can enable Launch at Startup or Launch at Login in the client’s Settings. This usually controls when the app runs; it may not enable the system proxy or automatically connect on mobile. Review each startup option and enable only what you need. After setting this up on desktop, check at your next login that the client starts, the right configuration is selected, and the proxy switch is in the expected state.
Mobile background operation and On Demand connections aren’t the same as launching a desktop app at startup. Don’t leave every permission enabled just to prevent an occasional disconnection; identify the issue first, then adjust the relevant system setting. If your device is managed by your employer or school, follow its network policies and don’t try to override managed settings.
Disconnect Before Quitting
When you’re done on desktop, turn off System Proxy in the client before quitting. On mobile, tap Disconnect before leaving the app. This prevents the system from sending requests to a local port that’s no longer listening. After quitting, open a page you can normally access directly and confirm your regular network still works. If your network stops working after the client closes unexpectedly, check your system network settings for a proxy still pointing to a local address. Note its original value before reverting the change.
Your basic setup is now complete: the configuration is active, the mode and route are set, the connection is enabled, and you can find real requests in the client. If you run into trouble later, note your platform, client name, current mode, relevant errors, and any recent setting changes, then consult the Clash troubleshooting guide for the symptoms you see. Hide subscription links and personal information in screenshots; include only the error details needed for troubleshooting.