Clash Subscription Setup and Connection Guide

01 Import and Enable a Profile

Open the client and go to Profiles first—not straight to the system proxy settings. Look for an option such as Create, Import, or Download from URL, then choose subscription import. Paste the full link into the URL field and check that there are no extra spaces at either end and no explanatory text copied with it. The profile name is just for identification, so use one that makes the source easy to recognize. For your first setup, leave the other import options at their defaults.

After you confirm or start the download, wait for the client to fetch and parse the profile. Normally, a new entry appears on the Profiles page with its name and an update option. Some clients enable imported profiles automatically; others require you to select the entry, click Enable, or choose Use from its menu. Check which profile is marked as active: seeing a profile in the list doesn't mean the core is using it. If reloading fails after activation, resolve the reported field errors before changing any network switches.

For a local .yaml or .yml file, choose Import from File and select it, then enable it as you would a downloaded profile. Don't just change a file's extension to YAML or save a web page as a profile. The file needs a structure the client can parse; its name alone doesn't make it valid. Locally imported profiles usually don't update automatically when your subscription changes, so how you maintain them depends on the file contents and client features.

Next, open the Proxies page. You should see the proxy groups defined in the profile, with available nodes or policies in each group. Group names come from the profile and may not be Proxy or Node Selection. If the page only shows DIRECT, return to Profiles and check that the right profile is active, then review the import. Some subscriptions provide only a node list and require a client template; use a supported import method rather than deleting profile fields at random.

If import fails, first determine whether the download or parsing failed. For a download failure, check whether the subscription has expired, the URL is complete, and your network can reach the subscription service. For a parsing failure, confirm that your provider supplied a Clash- or mihomo-compatible format. If opening the URL shows a login page or an error message, it won't work as a profile—even if the address ends with what looks like a config file. Avoid repeated imports that create duplicate entries; keep one profile you've confirmed works.

02 Choose a Rule Mode and Proxy Group

With the profile enabled, find the traffic mode setting. It may be at the top of the Proxies page, on the dashboard, or in the menu bar icon's menu. For a first setup, choose Rule. This mode uses the profile's rules to decide whether each request connects directly or through a proxy, giving you a reliable baseline for testing. Keep the provider's original rules for now; don't also change rule sets, DNS, and overrides before your first connection.

Global sends requests that enter the client through the global policy; it doesn't route every app on your device through the client. Direct connects requests entering the client straight to their destination. Neither mode enables a traffic entry point. Whether your browser follows the system proxy and whether another app needs TUN are questions for the next step. Don't treat the outbound mode and system proxy switch as the same setting.

In Rule mode, open the Proxies page and expand the main group referenced by your rules. A manual group usually lets you pick a node, and may also let you choose another policy group. An auto-select group runs tests and switches according to its configuration. If your provider names the main proxy group, follow their instructions. Otherwise, check the profile or rules page to identify the group you need; don't assume the first group controls all requests.

You can run the client's latency test to see which options can reach the test endpoint. If a node times out, try another reachable one. A lower latency only means that this request to the test endpoint was faster; it doesn't guarantee faster video, downloads, or access to every site. Check performance in the app you actually use. There's no need to keep switching nodes to chase a lower number during initial setup.

Check that the main proxy group hasn't been set to DIRECT or REJECT. DIRECT means a direct connection; REJECT blocks the request. Neither is a regular proxy node just because it appears in the options. Split-routing profiles may include separate groups for streaming, developer services, or other uses. You don't need to change every group at once: first identify the policy for the site you're testing, then adjust that group. Keep Rule mode and one known working outbound selected, then continue to the connection step.

03 Enable the System Proxy and Connect

You now have an enabled profile and a selected proxy route. Return to the dashboard or Settings, find System Proxy, and turn it on. On macOS, the client may ask to install a helper or grant permission to change network settings. Follow the system prompts and the client's instructions. If required authorization isn't complete, switching on the client control may not change the system settings. If the client reports an error, check it before assuming you're connected.

Once the system proxy is on, keep the client running and open a new browser tab to visit a site. The system proxy mainly affects apps that follow system settings, and existing connections may not reconnect immediately. Reload an already-open page, or restart the browser if needed. If you use a browser proxy extension, temporarily disable its separate proxy settings or set it to follow the system proxy so it doesn't send requests elsewhere.

To check the port, find Mixed Port in the client settings. It's the local listening port that can serve both HTTP and SOCKS proxy traffic; use the value shown by your client rather than changing it to match another guide. On macOS, check the related settings under System Settings → Network → current network service → Details → Proxies. The labels may vary slightly by macOS version. If you configure a local proxy manually, its address and port must match what the client is actually listening on—don't copy a port number from the web.

Leave Allow LAN Connections off for now. You're only setting up apps on this device, and that option isn't required for internet access. It's for letting other devices use this machine as a proxy, which also involves the listening address, firewall, and access controls. Avoid running multiple proxy clients during testing: they may overwrite each other's system proxy settings, compete for the same port, or route traffic through multiple entry points.

If your browser works but a particular app still bypasses the proxy, consider TUN mode. It uses a virtual network interface to capture traffic that matches its routing rules and usually requires additional permissions or a service component. Note the current system proxy state, follow the client's instructions to install or authorize TUN, then test it separately. During initial troubleshooting, don't change the system proxy, DNS, and TUN settings at the same time. If the client requires a particular combination, follow its documentation and record each change.

On Android and iOS, after importing a profile and choosing a route, return to the home screen and tap Connect or the start button. Allow the system to create a VPN configuration the first time. The VPN indicator means the network service is enabled; it doesn't by itself confirm that the remote node works. On Android, other apps that use the VPN service may conflict with your client, so turn off similar services first. Windows and Linux desktop users can start with the system proxy. For permissions and virtual network interface differences, see the complete installation and setup guide for all platforms; there's no need to configure every advanced option before your first connection.

04 Verify the Rules and Test Access

Check your connection at three levels: whether the app sent a new request, whether the request reached the client, and whether the client used the expected outbound route. First visit a site that normally works directly, then one that should use a proxy according to your profile. Both should load. Don't assume the setup is correct just because a page appears—it may be cached or reachable without a proxy.

Open the client's Connections page, then refresh the target site and look for a connection to its domain. Select or expand the connection to inspect the matched rule and outbound route. In Rule mode, some requests going through DIRECT is normal. The key is whether traffic that should use a proxy enters the expected group and reaches the selected node. A page usually requests several domains, so check the request you're testing rather than an arbitrary row in the list.

If the client shows an IP address instead of a domain, don't immediately change Fake-IP or sniffing settings. Whether a domain appears depends on the DNS path, app behavior, and client capabilities. Check the outbound route and actual access first. Only investigate DNS or profile settings if rule matching is genuinely wrong; see the DNS and configuration troubleshooting section in the complete setup guide. This avoids disrupting a working network path just to fix a display difference.

Now try the app you actually need and perform a real task, such as loading a project page, playing a clip, or refreshing in-app data. If the browser works but the app doesn't, first check the app's own proxy settings, whether it needs restarting, and whether it follows the system proxy. Windows Store apps may also be affected by loopback restrictions; use the UWP loopback exemption guide to address that separately instead of replacing the entire profile.

What to Check When Sites Won't Load

If no sites load, first make sure the client is still running, the current profile is enabled, and the main proxy group has a working outbound selected. Then check that the system proxy and Mixed Port agree. If the Connections page shows no new requests, investigate the traffic entry point before changing nodes. If requests appear but keep failing, check the logs for timeouts, refused connections, or profile errors, then try another node in the same group.

If regular sites load but some destinations don't, check which rules they match. If traffic is going direct by mistake, adjust the relevant policy group or review the profile instead of using Global as a permanent fix. You can briefly switch to Global and test the same node for comparison: if it works in Global but not Rule mode, investigate the routing rules; if both modes fail, also check the node, destination service, and network conditions. Switch back to Rule mode after testing.

To review logs, reproduce the issue first, then read the entries around that time. Don't confuse old errors with the current failure, and don't leave the log level set to its most verbose setting longer than necessary. Before asking for help, remove subscription URLs, node credentials, and personal browsing records; share only the error type and relevant settings. Change one setting at a time and repeat the same request so you can tell what made a difference.

Keep a Working Setup and Update It

Your initial setup is complete when the target request reaches the client, matches the expected rule, and works in the app. Note the profile name, outbound mode, and traffic entry point; there's no need to enable every advanced feature. When your node list changes, update the existing subscription on the Profiles page. Afterward, confirm the same profile is still active and check whether your manually selected node is still available.

If your connection still has problems after disconnecting, first make sure the system proxy is off, then quit the client and try again. If you use TUN, also confirm that its virtual interface service has stopped. If the issue only occurs with TUN enabled, investigate that mode's permissions, routes, and DNS path. For routine use, follow the four steps in this guide. For installation across platforms, rule changes, or advanced network settings, see the relevant section of the complete installation and setup guide for all platforms.