Clash Setup Guide

Step 01 / Prepare Your Configuration

Import a Subscription and Select the Configuration

After opening the client, go to the “Profiles” or “Subscriptions” page before turning on the proxy. The client reads the configuration and handles connections; installing it doesn’t give you a working connection by itself. Get the subscription URL from your configuration provider and make sure it explicitly supports Clash or mihomo format. A regular webpage URL, account sign-in page, or subscription for another client won’t work as a configuration.

Paste the URL and Download the Configuration

In a desktop client, look for “New,” “Import,” or a plus button, then choose the remote URL option. Paste the full subscription link into the URL field, give the profile a recognizable local name, and click “Import,” “Download,” or “Save.” On mobile, open the profiles list and use the plus button to add a remote configuration. If the client supports QR scanning, scan a compatible subscription QR code from your provider, then check that the download completed successfully.

Check for stray spaces, line breaks, or punctuation copied from a chat message before and after pasting. Subscription URLs may contain credentials, so keep them private. Don’t post them in public comments or include the full URL in a support screenshot. You don’t need to send your subscription URL to this site; the client you use downloads and parses it from the configuration source.

After clicking Import, wait for the profile to appear. Some clients show an update time or success message; others return directly to the profiles list. If you see “Parse failed,” “Invalid format,” or a download error, stop here and check that the URL is complete and the subscription is valid, then make sure your network can reach the source. Repeatedly starting the connection won’t fix a parsing error; the next steps require a configuration that loads correctly.

Set It as Active and Check the Proxy Page

Once the configuration downloads, click its enable indicator, radio button, or “Use” menu to make it active. Some clients select it automatically during import, but check its status anyway. Then open the “Proxies” page and confirm that the policy groups defined in the configuration appear. Group names depend on the configuration, so they won’t necessarily match screenshots in other guides. Don’t rename groups just to make them look the same.

If you have a local configuration file, choose “Import from file” and select the YAML file. It may not have a remote update URL, so updates might require importing the file again. Remote subscriptions usually have an “Update” button to fetch changes from the provider. Complete one manual import and select the profile before setting an automatic update interval; this keeps first-time troubleshooting simpler.

You’re done with this step when the active configuration is selected, its policy groups appear on the Proxy page, and there are no errors preventing it from loading. There’s no need to change DNS, ports, or rule files yet. Next, choose a proxy mode and any required group options to keep the first connection test straightforward.

Step 02 / Route Your Traffic

Choose Rule Mode and a Policy Group

Go to the home screen or Proxy page and find “Mode,” “Proxy Mode,” or the controls for Rule, Global, and Direct. Choose “Rule” for your first setup. Rule mode routes connections according to the rules in the active configuration, so different sites and apps may use different policies. It doesn’t send every connection through the same proxy. Some connections showing as direct doesn’t necessarily mean anything is wrong.

Start with Rule Mode; Don’t Change the Rules Yet

“Global” typically sends connections that reach the core through the global policy, while “Direct” connects them to their destinations without a proxy. Keep in mind that the mode only affects traffic that reaches the client’s core. Global mode won’t make every app use the system proxy, and it can’t replace the system VPN permission required on mobile. Until you’ve verified the traffic entry point, don’t treat Global mode as a fix for every connection issue.

With Rule mode selected, expand the policy group used for regular proxy connections. If it’s a manual selection group, choose one of its available options. If it uses automatic selection or failover, you can usually leave its existing behavior unchanged. Some groups refer to other groups, creating several levels of choices. Follow the references through to the final option so you don’t assume that selecting an outer group has already chosen the actual proxy.

Your client may have a connection test button to help spot options that are clearly unreachable, but its result only reflects the test destination and network conditions at that moment. A successful test doesn’t guarantee that every site will work; a failed test could be caused by the test address or a temporary network issue. For a first-time setup, what matters more is testing a real connection and checking its corresponding log entry.

Keep the Default Routing; Change Fewer Settings at Once

Avoid changing rule order, DNS mode, and automatic policy settings all at once. If the connection starts working afterward, you won’t know which change made the difference. If a group’s purpose isn’t clear, leave its existing selection in place. If you do need to change one, note the current option and change only that group. Configuration updates can change the available options, so check that your previous selection is still there after updating.

You’re done with this step when “Rule” is selected and the commonly used proxy group has a clear choice. Leave the client open and start the connection. To learn more about rule matching order, protocol types, and core compatibility, see the Protocol and Core Reference later; you don’t need to study every detail before your first connection.

Step 03 / Route Traffic into the Client

Start the Connection and Enable System Routing

Your configuration and mode are ready. Now route app traffic through the client. Close any other proxy or VPN clients that are currently handling network traffic, and use only this setup for the test. Multiple clients can modify the system proxy, virtual network adapters, or routes at the same time. The interface may show that the client is running even when your traffic is taking a different path. Don’t delete existing network settings; just stop the other clients normally.

Desktop: Check the Core, Then Enable the System Proxy

Check the status on the desktop client’s home or settings page. Some clients start the core as soon as they open; others require you to click “Start” or a connection button. Once the core is running, enable “System Proxy.” This lets browsers and apps that use the system proxy connect through the local proxy. Keep the default port for now; there’s no need to copy a port number from someone else. If the logs say the port is already in use, check whether another client process is still running.

Windows and macOS may ask you to approve network access, install a service, or grant permissions. Make sure the request comes from the client you just installed, then follow its instructions. Support for system proxies varies across Linux desktop environments, and some apps have their own proxy settings. For your first test, use a browser that follows the system proxy. If it has a proxy-switching extension, disable the extension’s override to avoid conflicting settings.

You don’t need to enable TUN as soon as the system proxy is on. First check that your browser works; this helps narrow down issues with the configuration, policy, or basic traffic entry point. Some clients have an “Allow LAN” setting for other devices connecting through this computer’s proxy. You usually don’t need it for a first test on a single device, and it’s not the same as allowing access to devices on your local network.

Mobile: Approve the System VPN Request

Tap Start or Connect on the home screen of your Android or iOS client. The first time you start it, the system usually asks to allow a VPN connection or add a VPN configuration. Approve the request, return to the client, and wait for its status to change to Running. The system VPN interface lets the client handle device traffic; it doesn’t mean the subscription is working. You’ll still need to test a real connection in the next step.

Mobile operating systems typically don’t let multiple apps that use the same VPN interface handle traffic at the same time. If the client stops immediately after starting, check whether another VPN, firewall, or network filtering app is using the interface. If Android disconnects only when the screen locks or the app goes into the background, check background activity and battery restrictions in system settings. Don’t disable every battery-saving setting just because the first attempt failed. On iOS, first check whether the system VPN status matches the client.

You’re done with this step when the core is running, the system proxy is enabled on desktop, or the system VPN is connected on mobile. That status alone isn’t enough to confirm everything works. Make a new request next and check that the traffic is handled as expected.

Step 04 / Test a Real Connection

Verify Access and Check Rule Logs

Open a new browser tab and visit a site you know is working. Use a browser without its own proxy settings if possible, and make a fresh request after starting the client instead of relying on a page that was already open. An old page may come from cache, and existing long-lived connections may keep using the previous route. Seeing page content alone doesn’t prove the new settings are working.

Match Browser Activity to the Client Logs

While the page loads, open the client’s “Connections” or “Logs” page and look for the domain you just visited. Some clients show the matched rule, policy group, and connection chain directly; others require you to expand an individual connection. Short-lived connections may disappear quickly, so watch as the page loads or check the client’s saved logs. Log detail varies by client; the default level is enough for a first check, so there’s no need to leave verbose debugging enabled.

Compare each log entry with the expected behavior of your configuration. Destinations that should use a proxy should appear under the corresponding policy group; destinations that match a direct rule should show as direct. In Rule mode, success doesn’t mean every connection uses a proxy; it means the traffic follows the rules. If a site loads but there’s no matching entry, first check whether the client shows completed connections, then check whether the browser is using another proxy.

If you want to check your public IP, use a trusted IP lookup site, but don’t treat the location shown on one page as the only evidence. Lookup services may use different IP geolocation databases, and browsers may prefer IPv6. For a first-time setup, a successful visit and logs that match the expected policy tell you more than a single location label. Once the browser test passes, test any other apps you need separately.

If It Fails, Check the Same Things in Order

If a site won’t load, first check the Profiles page to confirm the right configuration is still active and its latest download succeeded. Then make sure the proxy mode is Rule and the policy group points to a valid option. Next, check that another app hasn’t changed the system proxy or mobile VPN status. Finally, use the connection logs to narrow down the issue: no new connections usually points to the traffic entry point; timeouts suggest an unreachable option or network issue; DNS resolution errors should be investigated under the DNS section of Frequently Asked Questions.

Change one setting at a time and make a fresh request after each change. For example, try a different option in the policy group and check whether the same site loads. If nothing changes, note the result before moving on. Don’t immediately change the port, DNS, and TUN settings together. If only one site or app has a problem while others work, troubleshoot that destination instead of reinstalling the entire client. For more on protocol compatibility and configuration formats, see the Protocol Handbook; for specific issues, see Frequently Asked Questions.

Once everything works, keep the current configuration and mode, then set subscription updates and launch-at-startup as needed. Updating a subscription changes its configuration; it doesn’t upgrade the client. Upgrading the client doesn’t extend your subscription either. For everyday use, check the active configuration, connection status, and any error messages. You don’t need to re-import the URL every time you start the client. If the connection changes after switching networks or updating the configuration, repeat the access and log checks in this section.