How to Use Clash

Step 1: Import a Subscription and Enable the Configuration

Open the client and go to “Subscriptions,” “Profiles,” or a similar configuration management page. Find Add, Import, or the plus button. For a subscription URL, choose the link import option and paste the full URL into the URL field. Give it a recognizable name if you like; the name doesn't change the subscription contents. Make sure there are no extra spaces, line breaks, or punctuation copied from a messaging app at either end of the URL, then save or download it.

A subscription URL is not the same as your provider's homepage or account sign-in page. A valid URL returns configuration data that the client can recognize; pasting a regular webpage URL may return HTML or cause a parsing error. Copy the Clash- or mihomo-compatible subscription link provided by your service. The URL may contain account credentials, so don't post it publicly or share screenshots that show the full link when asking for help.

Wait for the subscription download to finish. Some clients activate the new configuration automatically; others require you to select its entry, check a box, or click Use. Look for an indicator showing which configuration is active, then open the Proxies page. Seeing the proxy groups and options provided by the configuration means the import and loading process has progressed. A subscription name appearing in the list alone does not mean that configuration is active.

Use a Local YAML File

If you have a configuration file, choose “Import from file” in the import menu, select the local .yaml or .yml file, and set it as the active configuration. Don't paste YAML content into the subscription URL field. Importing a local file usually saves only its current contents; unless you configure an update source separately, don't expect it to update automatically with your provider's subscription.

For your first import, avoid editing node passwords, protocol fields, or rules. Try connecting with the original configuration first to keep troubleshooting focused. If the client reports an unsupported field, check whether the subscription format matches the core's requirements instead of simply deleting the reported line. Some node protocols or fields require mihomo support and may not work with older clients. See the client selection guide before deciding whether to switch clients.

If the Download Fails, Check the Source First

For timeouts, authorization errors, or parsing errors, first make sure your device has a working internet connection, then copy the subscription URL again. For authorization errors, check with your provider that the link is still valid. For parsing errors, make sure you selected the correct subscription format. Leave the automatic update interval at its default for now; don't refresh repeatedly in quick succession. For more troubleshooting, see how to fix subscription update failures.

At this point, you should know which configuration is active and be able to find its proxy groups on the Proxies page. Next, decide how requests should be routed, then enable a system network entry point. That gives you a clear route to check during your first connection test.

Step 2: Choose Rule Mode and a Proxy Group

Return to the home screen, Proxies page, or mode settings and find the Rule, Global, and Direct options. For your first setup, choose Rule mode. This corresponds to mode: rule in the configuration: requests that reach the core are matched against rules in order, then sent through the specified node, proxy group, or direct connection. Rule mode does not automatically identify the purpose of every website; behavior depends on the rules in the active configuration.

Global mode sends requests that reach the core to the global proxy group. You usually need to choose an outbound in that group as well. Direct mode connects requests that reach the core straight to their destinations. These modes only determine how the core handles requests it receives; they don't route traffic from every app into the core. So selecting Global does not mean that a game, command-line tool, or other app is using the proxy.

Expand Proxy Groups and Choose an Outbound

With rule mode selected, open the Proxies page and expand the main selection group provided by the configuration. Group names are set by the subscription author, so they may be in Chinese or English and may not be called “PROXY.” Find a group that allows manual selection and choose an available node. The corresponding configuration type is usually type: select. If the group contains other proxy groups, expand the next level and make sure the final outbound is the one you expect.

If the target group is set to DIRECT, requests that use it will connect directly. Choosing a reject outbound may cause requests to fail. Don't just check for a selection marker beside a node; make sure the rules actually reference that group. For automatic selection groups such as url-test, the client typically chooses a node using the configured test logic. You don't need to treat them like manual selection lists.

If the client has a latency test button, run it once to check whether the node can complete the specified test request. The result reflects only that test address and the network conditions at the time; it doesn't guarantee that every website is reachable or indicate your actual download speed. Avoid cycling through several nodes and guessing which one worked. Keep one selection, connect in the next step, then verify with a real webpage request and the connection logs.

Some clients remember the last proxy group selection. After switching subscriptions, check the current selection again; groups with the same name may contain different nodes. To understand how groups reference one another, see the proxy group fields reference. For your first setup, just make sure the target group has a clearly selected, working outbound.

Step 3: Enable the System Proxy or VPN Connection

The configuration is loaded, and the mode and proxy group are set. Now route app requests to the client. A “Running” status usually means the core has started, but it doesn't necessarily mean your browser is using it. Desktop system proxies, mobile VPNs, and TUN are different traffic entry points. Don't confuse them with rule mode or turn them all on at once for your first connection.

Desktop: Start with the System Proxy

Find “System Proxy” on the home screen, in settings, or in the tray menu of your Windows or macOS client, and turn it on. This usually points the system's HTTP/HTTPS proxy to a local listening address and port. For your first test, use a browser that follows the system proxy settings and keep the client running. macOS may ask for permission to change network settings. Read the system prompt and authorize it only if it comes from the client you just installed.

Linux desktop environments vary in their support for system proxies. If the client has enabled the system proxy but the browser produces no connection logs, check the desktop network settings or the browser's own proxy settings. For manual setup, the local address is usually 127.0.0.1; use the listening port shown in the client, not an example port as a fixed value for every installation. With mixed-port, the same port can accept HTTP and SOCKS requests, but the app still needs to use the right proxy type.

You don't need to enable “Allow LAN” for your first test. Using a local proxy in a browser on the same device is different from letting other devices use your computer as a proxy. You also don't need to enable TUN to test a browser; TUN involves a virtual network interface, routing, and DNS, so configure it separately after confirming a basic connection. For the relevant fields and permissions, see the network entry points section of the configuration reference.

Mobile: Allow the System VPN Configuration

In the Android or iOS client, tap Start, Connect, or the main toggle. On the first connection, the system may ask to add a VPN configuration or approve a connection request. Confirm the app name, allow the request, complete any required device authentication, then return to the client and check the connection status. A VPN icon in the system status bar means the network entry point is active. Whether traffic exits through a proxy node still depends on the mode, rules, and proxy group you selected in step 2.

Disconnect other VPNs or proxy apps during the test to avoid routing conflicts. On Android, if you've set up per-app proxying or a bypass list, make sure the test browser isn't excluded. If the connection drops only after the phone locks, check the client's background activity and system battery restrictions. You don't need to change every background setting before your first connection.

If the toggle switches off immediately, open Logs and check for errors near startup. Port conflicts, configuration parsing errors, and incomplete system authorization require different fixes. Note the error text and where it appeared; don't publish the entire configuration. Once the client stays running and the entry point remains enabled, move on to the final step. A status icon alone isn't enough to confirm the setup.

Step 4: Verify the Expected Outbound Route

Open a browser and make a new request to a webpage you know supports HTTPS. Don't rely on a page that was already open: it may be cached, and existing connections may continue using the old route. Open a new tab and reload the destination, then switch back to the client's Connections page and search for the request by domain or process.

Check Connection Logs First, Then Your Public IP

If the client shows the matched rule and outbound route, check three things: whether the domain matches the site you just visited, which rule matched, and which node or direct route was ultimately used. In rule mode, some websites may correctly match DIRECT; a direct connection log does not automatically mean something failed. Choose a destination that should use the proxy, check that it enters the expected proxy group, and follow the group chain to the final outbound.

To compare public IP addresses, use a trusted IP lookup page on the same network before and after connecting. Close and reopen the browser request to avoid reusing an existing connection. A changed address is one piece of evidence, not proof on its own. If the lookup site is configured to connect directly, an unchanged address doesn't show that all proxy traffic is failing. Consider the IP result alongside the client's connection logs rather than relying only on the location shown by the webpage.

Logs and connection pages may include domains you've visited. When troubleshooting, keep only the entries related to your test request. Before sharing anything, remove subscription URLs, account details, and unrelated browsing records. Once you've verified the connection, you can turn off detailed logging if you enabled it temporarily, so the client doesn't keep more data than troubleshooting requires.

If It Doesn't Work, Check Each Entry Point in Order

1. No proxy groups on the Proxies page: Go back to the subscription import step and confirm the download finished and the configuration is active. Don't change system network settings yet.
2. No matching connection when browsing: Check whether the system proxy or mobile VPN is enabled, whether the browser bypasses the system proxy, and whether per-app rules exclude it. Connection entries may disappear quickly, so send the request again and watch for it.
3. A connection appears, but it goes direct: Check the current mode, matched rule, and proxy group selection. If you temporarily switch to Global mode for comparison, select the global group and restore rule mode after testing.
4. Proxy connection appears, but the request fails: Keep the same destination, retry with a different known-good node, and check the relevant logs. A successful node test doesn't guarantee that the destination website will load.

Change one setting at a time and make a new request after each change to identify the cause. If your browser works but another app doesn't, the initial setup is complete; next, check whether that app supports system proxy settings, has its own proxy configuration, or needs a different traffic entry point. DNS, Fake-IP, TUN, and rule overrides are beyond this initial setup guide. For the relevant syntax, see the config.yaml configuration reference.

Stop the Connection and Prepare for Next Time

Before quitting the desktop client, turn off the system proxy, then exit the app. Otherwise, the system may continue sending requests to a local port that is no longer listening, leaving your browser without an internet connection. On mobile, use the client's Stop or Disconnect button. If you enabled Always-on VPN or Block connections without VPN in system settings, make sure those options are appropriate for your current setup.

After starting the client next time, check that the active configuration and proxy group selection are still correct before enabling the network entry point. Subscription updates may change nodes and rules. If something stops working after an update, check the relevant proxy group instead of replacing the entire file. Your setup is complete when you can verify a real request's matched rule and final outbound on the Connections page.