Before You Start: Get the Client and Configuration
The client reads your configuration and routes network requests. Installing it doesn't mean you have a working connection yet. Before you begin, you'll need a Clash-compatible client for your device and a subscription URL or local configuration file that you're authorized to use. This site provides downloads and setup guides, but does not provide proxy nodes or subscriptions.
Think of a subscription as an address that provides configuration updates. The client fetches nodes, proxy groups, rules, and other settings from that address. A node is a server you can connect through; a proxy group is a list of outbound options; and rules decide which option handles each request. That's all you need to know for now—you don't need to understand every field before connecting for the first time.
If another proxy or VPN app is running on your computer or phone, disconnect it first so two tools don't change your network settings at the same time. Then use a regular browser to open a site you can normally access directly and confirm the device is online. If you have an older configuration, keep a backup and save the new one under a different name so you can roll back if needed.
This guide starts with a basic browser connection; you don't need to enable TUN right away. TUN routes network traffic through a virtual network interface and may require extra permissions or changes to routing and DNS settings. Keep things simple for your first setup, then decide whether to use TUN after a regular connection works.
01 Import a Subscription and Enable the Configuration
Open the client and find the Config, Subscription, or Profiles page. Choose “New,” “Add,” or “Import from URL,” then paste the full subscription URL into the address field. If there's a name field, use a label you can recognize, such as “Daily setup.” The name only helps identify the entry; it doesn't change how nodes connect.
After pasting, check the beginning and end of the URL for spaces or line breaks, especially punctuation added by a messaging app. Subscription URLs often contain personal access credentials, so treat them like passwords: don't post them publicly or include the full URL in a screenshot. If the provider offers multiple formats, choose one marked as compatible with Clash or your current core. A regular webpage URL is not a subscription URL.
Select Save, Import, or Download and wait for the client to fetch the configuration. Once successful, the configuration should appear in the list under the name you entered, often with an update time or an action menu. Next, select it or choose “Enable” or “Use this configuration.” Importing a configuration and using it are two separate steps. If you only add it to the list without switching to it, the Proxies page may still show the previous configuration.
After enabling the configuration, open the Proxies page and check for proxy groups and nodes. Group names are chosen by the configuration author and may be in any language; don't look for a button specifically named “PROXY.” You can move on once the client shows the configuration as active and its proxy groups are visible.
Importing an Existing YAML File
YAML is a text format that uses indentation to represent structure, and Clash commonly uses it for configurations. If you already have a .yaml or .yml file, choose “Import from file” or “Import local configuration” on the Config page, select the file, and enable it. Don't just change a file's extension to YAML—the contents must also use a format supported by your client.
Local files usually don't update automatically from a subscription provider unless the client has a sync or override feature. Keep the original file when importing it, and don't rush to change ports, DNS, or rules. For details on the file structure, see the YAML manual. This guide only covers checking whether the file can be loaded and enabled.
What to Check if the Import Fails
If the download fails, check that your internet connection works, the URL hasn't expired, and the provider doesn't require you to sign in or generate a new URL. A format or parsing error means the client may have fetched the content, but it isn't a recognized configuration or contains fields your current core doesn't support. Don't keep toggling the system proxy; fix the configuration first, then test the connection. For more details, see FAQ: Installation, Configuration, and Troubleshooting.
At this point, you should have an enabled configuration. Next, choose how to route traffic and which outbound option to use for requests that need a proxy.
02 Choose Rule Mode and an Outbound Node
Find “Mode” on the Overview page, at the top of the Proxies page, or in Settings. For your first setup, choose “Rule” or Rule. Rule mode checks requests against the configuration's rules in order and sends them to the specified node, proxy group, or direct connection. “Direct” means the device connects to the destination over its current network without a proxy server.
Two other common options are “Global” and “Direct.” Global mode typically routes requests handled by the client through the global policy; it doesn't mean every app will automatically use the client. Direct mode typically connects handled requests without a proxy; it doesn't turn off the system proxy. To keep things clear, leave Rule mode selected for now instead of switching back and forth between the three options.
Next, open the proxy list and find the group your configuration uses for proxied traffic. Tap the group name or expand its arrow, then select a node in the group. The selection is complete when the node is checked, highlighted, or shown as the current option. Running a latency test doesn't necessarily change the active outbound node, and seeing a response time doesn't mean a node has been selected.
Some proxy groups point to another group rather than directly to a server. For example, “Web Access” might use “Manual Select,” which then lists the actual nodes. Follow the current selection one level further and check which node it ultimately uses. If the final selection is DIRECT, traffic connects directly; if it's REJECT, matching requests are blocked. These are configuration actions, not node error messages.
Groups set to “Automatic” or “Failover” choose an outbound option according to the configuration's checks, and may not let you pin a specific node manually. You can keep the configuration's automatic groups as they are and use the connection log later to see which node was used. Don't set every group to the same node just to make the page look consistent; some groups are intended for direct connections, local networks, or specific services.
To choose a node, run a latency test within the relevant group. The result only shows how that node responds to the test destination; it doesn't guarantee access to every site. If every node times out, check that the subscription is valid and the nodes are still available before changing DNS. Once you select a responsive outbound option, keep the mode and node unchanged and move on to routing traffic through the client.
03 Enable the Proxy and Route Requests
The configuration and outbound node are ready; now apps need to send their requests to the client. Check the Overview page for the running status. If you see “Start core,” “Start,” or a power button, use it to start the client first. The core handles rules and connections; an open window doesn't always mean the core is running. If you see a configuration load error or port conflict, resolve it before enabling any more network switches.
Desktop: Enable the System Proxy First
In the Windows, macOS, or Linux desktop client, find and enable “System Proxy.” This points the system's proxy settings to the local address provided by the client. Many browsers and apps that follow system proxy settings will use it, but some games, command-line programs, and apps with their own network stack won't. For your first test, use a regular browser rather than relying on an app that may ignore the system proxy.
After enabling it, the switch should remain on or the system tray menu should show the active status. If the system asks to authorize a network settings change, allow it after confirming the request came from your client. You don't need to enter a port manually. If a browser extension or system setting was configured with another proxy, disable it so it doesn't override the current settings. Conflicting settings can bypass the expected route and leave no connection records.
Mobile: Connect and Approve the System Prompt
In the Android or iOS client, return to the home screen and tap “Connect,” “Start,” or the power button. The first time you connect, the OS may ask to approve a VPN connection, add a VPN configuration, or authenticate. This system VPN tunnel is how the client routes traffic; it doesn't mean the OS provides the subscription. Confirm the app name, follow the prompt, then return to the client and check that the connection stays active.
If the connection drops right away, check the client's error message and see whether another VPN is connected or the OS is restricting the app. Don't run two tools at once and make them compete for the same connection. Android battery saver and background restrictions can interrupt a persistent connection, but keep the client in the foreground for the first test. Once the basic setup works, you can adjust background settings.
Don't Enable TUN at the Same Time Yet
For this test, stick to one clear way of routing traffic. On desktop, start with the system proxy; consider TUN only if you need to route apps that ignore system proxy settings. Some clients let you enable both, but you don't need that for a first setup. TUN involves permissions, a virtual network interface, and routing. For details, see the YAML manual and FAQ; there's no need to change those settings here.
When you're done, the client should be running, with the system proxy enabled on desktop or the connection established on mobile. Don't assume that “Connected” means everything is working. Next, make a real request to check that traffic reaches the client and that the rules send it to the expected outbound option.
04 Use the Connection Log to Verify It Works
Open your browser and revisit a familiar site that your configuration is expected to proxy. To avoid interference from old connections or cached content, close the page and open it in a new tab; if needed, quit and restart the browser. Don't rely on refreshing a cached page: seeing the page doesn't necessarily mean a new network request was made.
Return to the client and open “Connections,” “Connection,” or the live log page. Keep it visible, then load the site in your browser again. You should see a new request for the destination domain or address. Some clients also show the rule type, matched proxy group, and final node. Records may disappear soon after a request ends, so watch while the page loads or use the client's option to pause the list.
Check three things: did the request reach the client, which rule matched, and which outbound option handled it? A record confirms that this request reached the client. A proxy group name shows that the rule routed it to that group. Check the final node or direct result to see how it was actually handled. Webpages often request several domains, so the main page, images, and sign-in API may follow different rules.
Then visit a site the configuration is expected to connect to directly and check whether the log shows DIRECT. The goal of Rule mode isn't to show every request as proxied; it's to route each request according to its rules. If the configuration routes a destination through a proxy, you can't assume it should connect directly just because of the site's location. Trust the configuration and the matched rule in the log.
You can also check your outbound IP as a secondary test, but don't rely on it alone. The lookup site might connect directly or use a different proxy group, and the browser may use IPv4, IPv6, or an existing connection. A more reliable first check is that the test page loads, the corresponding request appears in the connection log, and the final route matches the configuration. A successful latency test or an active system icon isn't a substitute.
If It Doesn't Work, Trace the Same Request Path
If the browser can't load the site and the client shows no matching request, go back to Step 3 and check the routing switch. On desktop, make sure another tool hasn't reset the system proxy and the browser isn't using a separate proxy. On mobile, confirm the system connection is still active. Switching nodes repeatedly won't help if the request never reached the client.
If the request appears in the log but times out, confirm the final node is the one you selected in Step 2, then try another available node in the same group. If only one site fails while others work, check that site's rule and policy before reinstalling the client. If the log explicitly reports a DNS resolution failure, troubleshoot DNS. DNS translates domain names into network addresses; don't replace all DNS settings without a specific reason.
If only one app fails while your browser works, check whether that app follows system proxy settings. A desktop app may need its own proxy configuration or may work better with TUN. Windows Store apps may also be affected by local loopback restrictions. See the Troubleshooting FAQ or the guide to loopback exemptions for Windows Store apps. Change one setting at a time and retest the same destination so you can tell what fixed the issue.
Disconnect and Everyday Use
Once everything works, remember the configuration name, rule mode, and selected proxy group. You don't need to import the configuration again every day. When the subscription needs updating, use the “Update” option on the Config page to fetch the latest content from the same URL. Updates can change group names or nodes. If the connection breaks afterward, check that the configuration is still enabled and the previously selected outbound option still exists.
To stop the proxy, turn off the system proxy on desktop before stopping the core or quitting the client. On mobile, tap the in-app disconnect button and confirm the system connection has ended. Turn off TUN as well if you enabled it. Closing a window may only minimize the client to the system tray, so check the actual switches and system status before you quit.
If your browser can't connect after you quit, check whether the system proxy still points to the local client you just stopped, and restore the network settings that worked before. On a work- or school-managed device, don't override settings configured by your administrator. When asking for help, include the client name, OS, the step where the failure occurred, and the error message without subscription credentials. That's more useful than simply saying “it won't connect.”