Clash Setup Guide: From Importing a Subscription to Verifying It Works

The first thing is the client. Clash is a client ecosystem built around a shared configuration format — different platforms have different graphical clients, but the configuration logic is the same. If you haven't installed one yet, head to the download page and pick the recommended client for your platform; system prompts, permission requests, and common errors during installation are each covered in their own chapter of the installation guide — jump straight to the relevant section if you get stuck.

The second thing is the subscription link. It's a URL starting with https://, provided by your service provider in the user panel; the client uses it to fetch nodes and routing rules. Two things to watch when copying it: make sure you copy the "Clash subscription" or "universal subscription" link, not a single node's share code; and make sure the link is complete — missing even one character at the end will cause it to fail parsing. It's best to use the "Copy Subscription Link" button in the panel rather than selecting the text manually.

While we're at it, here are three terms you'll see again and again: a node is a server that can relay your traffic; a policy group groups a set of nodes by purpose and defines how one is chosen within the group; and rules decide which traffic goes through the proxy and which connects directly. Full definitions of these concepts are in the glossary — look up any unfamiliar term there without breaking your flow through the tutorial.

Open the client and find the "Profiles" page in the side or bottom navigation (called "Subscriptions" in Clash Verge Rev, or just "Profiles" in some clients). This page manages complete configuration files, not individual nodes — once imported, a subscription becomes a single profile entry in the list, containing all its nodes, policy groups, and rules.

On the profiles page, tap "New / Import / +" and choose "Import from URL" (or there may already be a field for pasting a link), paste the subscription link you copied earlier, and confirm the import. The client immediately requests the link to download the configuration, which usually finishes within seconds on a normal connection; afterward a new profile entry appears in the list, typically showing the subscription name and update time, and sometimes remaining traffic and expiry date.

There's only one way to confirm a successful import: switch to the "Proxies" page and check for a node list. Tap the newly imported profile to activate it (usually a single tap; the active entry is highlighted or marked as selected), then switch to the proxies page — if you see several policy groups each holding a list of node names, this step is done. Mobile clients (such as Clash Meta for Android) follow the same flow: import and activate on the profiles page first, then check the proxy groups on the home screen.

If the import fails, or the node list is empty afterward, run three quick checks: whether the link is complete and not truncated, whether what you copied is actually a Clash-format subscription, and whether the subscription's traffic quota or validity period has run out. A full checklist for each case is in the troubleshooting section of Help & FAQ — no need to keep retrying blindly at this step.

With the subscription in place, go back to the client's main screen (or settings page) and find the "Outbound Mode" option, which usually has three values: Rule, Global, and Direct. Rule mode automatically decides whether each connection goes through the proxy or direct, based on the rules in the config file — sites accessible without a proxy connect directly, and everything else routes through a node; this is the right choice for almost every situation. Global mode forces all traffic through the proxy, and should only be used temporarily for troubleshooting or special cases; Direct mode effectively turns proxying off. Set the mode to "Rule" and you're halfway through this step.

The other half is picking a node. Switch to the "Proxies" page and you'll see one or more policy groups. A manual selector group requires you to pick a specific node — whichever one you click becomes the group's exit; an auto-test group (often named with Auto or URL-Test) automatically picks the lowest-latency node, so leave it on default — manual intervention isn't needed and usually isn't possible either. For first-time setup, find the main selector group named something like "Proxy Selector / Proxy / Manual Switch" and pick a node with a reasonable location and a normal-looking name. The behavioral differences between url-test, fallback, and load-balance group types are more advanced topics — the glossary has concise definitions, and detailed parameters and configuration syntax are in the configuration chapter of the installation guide.

There's no "Save" button needed after choosing — policy group selection takes effect immediately, and the client remembers your choice; nodes with the same name stay selected even after the subscription updates. If the proxies page has many groups and their relationships aren't obvious, focus only on the main selector group for now and leave the rest (such as streaming or ad-blocking groups) on default — you can fine-tune them later once you're using the client regularly.

The first two steps only get the client "ready" — traffic isn't actually passing through it yet. Getting the system to actually hand traffic to the client works differently on desktop versus mobile.

Windows / macOS / Linux desktop:find the "System Proxy" toggle on the client's main screen or settings page and turn it on. The client points the operating system's proxy settings at its own local listening port (7890 by default), so browsers and any app that respects the system proxy setting immediately start routing traffic through the client. Once the toggle is on, some clients change the color of the tray icon or add a marker as a status hint. Note that system proxy only works for apps that "cooperate" — command-line tools, some games, and some desktop software ignore system proxy settings and won't be routed automatically.

Android / iOS mobile:there's no system proxy toggle; instead there's a VPN tunnel. Tap the start button on the client's home screen — the first time you do this, the system shows an "XX would like to set up a VPN connection" prompt, so choose Allow. A key or VPN icon appearing in the status bar means the tunnel is up, and from then on all app traffic on the device is routed through the client according to the rules. Clash Plus on iOS works the same way: flip the toggle on the home screen and authorize the VPN configuration once.

About TUN mode:on desktop, if you need to capture traffic from apps that don't respect the system proxy (command-line tools, games, etc.), you can enable TUN mode — it creates a virtual network adapter that intercepts all traffic at the network layer, similar in effect to the VPN tunnel on mobile. TUN requires administrator privileges, and on Windows also involves installing a service; for first-time setup steps and platform-specific notes, see the "System Proxy / TUN" section of the relevant platform chapter in the installation guide. For your first setup, system proxy alone is enough to cover everyday browsing.

Once the connection is on, three checks confirm it's actually working, from broad to specific.

First, try visiting a site directly.Open your browser and visit a site that wasn't reachable before. If it loads normally, the whole chain — system proxy (or VPN tunnel), client, and selected node — is working. It's best to test in a private/incognito window to avoid browser cache creating a false impression that a site "loads fine."

Second, check the connection log.Go back to the client and open the "Connections" page. The visit you just made should have left a record there: each connection shows the target domain, the matched rule, and the policy group and node it used. If the connection to that site shows it went through the node you selected in step two, routing is working correctly; if it shows DIRECT, that domain was matched by a rule for direct connection, which is normal routing behavior, not a failure. Clients without a connections page can use "Logs" instead, which show rule-matching output line by line.

Third, run a latency test.On the proxies page, find the lightning bolt or speed-test icon next to a policy group's title and tap it — the client will run a latency test against every node in the group. A green or yellow millisecond value next to a node's name means it's reachable; a node showing "Timeout" is currently unreachable, so switch to one with a normal value instead. Latency only reflects the response speed of the test connection, not download bandwidth, but nodes with lower latency generally feel more stable in use.

Once all three checks pass, setup is complete and the client can run in the background from now on. If pages won't load, the connections page shows nothing, or every node times out, the issue is most likely somewhere in the subscription, port, or system settings — the troubleshooting section of Help & FAQ organizes frequent cases by "symptom → cause → fix," which gets you there faster than reinstalling at random.