Clash Setup Guide:
Add a Subscription and Test Your Connection

Add a Subscription and Activate the Configuration

Open the client and look for “Subscriptions,” “Config,” or “Profiles” in the sidebar or bottom navigation. Choose “New,” “Add Subscription,” or the plus button. If prompted to choose an import method, use “Import from URL” or “Remote Config” for a remote address, or “Local File” for a file already on your device. Either way, you need a configuration the client can parse; you can’t just enter any URL.

Copy the Configuration URL and Download It

Go to your provider’s subscription management page. Select a format explicitly labeled Clash, Clash Meta, or mihomo, then use the page’s copy button to get the URL. Paste it into the subscription URL field in the client and give the configuration a recognizable name, such as “Daily config.” Don’t copy the account management page URL from your browser’s address bar or post a screenshot containing the subscription URL in a public forum. Subscription links often include access parameters tied to your account.

Make sure there are no extra spaces or line breaks around the URL, then tap “Import,” “Save,” or “Download.” Wait for the client to show the result. A successful import usually adds a configuration card with its name, update time, or an update option. Some clients activate the configuration as soon as it’s imported; others only save it to the list, so you’ll need to select it or choose “Set as current.” Check which configuration is marked as active—don’t assume it’s ready just because its name appears in the list.

For a local file, select the provider’s .yaml or .yml file in the file picker. Importing a file usually saves its current contents; it doesn’t mean the client will fetch updates remotely later. Don’t just change a file’s extension to YAML: renaming malformed text, a web page, or a single sharing link won’t turn it into a complete configuration.

Check That the Proxy Page Has Loaded the Configuration

After activating the configuration, open the Proxy page and check that proxy groups and available exits appear. Group names are set by the subscription author: you might see Proxy, Node Selection, Auto Select, or names based on intended use. They don’t have to match this guide. If the page is still blank, return to the configuration page to confirm that the right configuration is active, then check the import message or logs for parsing errors. A successful download does not necessarily mean the configuration loaded successfully.

If the download fails, use your current network to open your provider’s account page, confirm the subscription is active, and copy the URL again. If the client says the format isn’t supported, check whether you have a complete YAML configuration, a Base64 node list, or a single protocol sharing link; clients vary in what they can import. Don’t paste a private subscription into an unfamiliar online converter. See Clash Subscription Formats Explained for details. Once the Proxy page shows the groups, continue to the next step.

Choose a Rule Mode and Proxy Exit

Once the configuration is active, find the mode selector under “Overview,” “Proxy,” or “Settings.” Common options are “Rule,” “Global,” and “Direct.” They may appear in English as Rule, Global, and Direct. For your first setup, choose Rule. The core then checks connections against the configuration’s rules in order and applies the corresponding direct, proxy, or reject policy. Rule mode doesn’t infer how a site should be handled from its name; actual routing depends on the active configuration.

Choose a Mode, Then Check the Proxy Groups

Choosing a mode and choosing a node are separate steps. After switching to Rule mode, open the Proxy page and find the proxy group referenced by the rules. Expand it and select an exit available with your account. If the group includes a subgroup such as “Auto Select,” choosing it hands exit selection to that group’s health-check logic; it doesn’t mean the first item in the list is fixed.

Manual groups typically retain your last choice, while automatic groups may switch exits based on the checks in the configuration. If the client has a “Test” or “Check” button, use it to rule out options that are clearly unreachable. A successful test only means that test request received a response; it doesn’t guarantee access to every site. For your first setup, choose one clear exit and avoid changing several groups at once, so you can tell which setting affected the connection.

If the configuration has separate groups for streaming, developer services, or other uses, leave their defaults in place for now and check whether they reference the main proxy group. If a group is set to DIRECT, connections matching its rules may still go direct even if you’ve selected an exit in the main proxy group. REJECT blocks a connection; it isn’t a proxy node you can use to connect. If you’re unsure what a group does, check your provider’s configuration guide rather than changing groups at random.

What Global and Direct Modes Do

Global mode generally sends connections that enter the core through the global policy, which can help with short troubleshooting comparisons. It won’t capture traffic that never reaches the client. Direct mode generally sends connections entering the core straight to their destinations without using a regular proxy exit. Don’t switch repeatedly between these modes before you’ve verified the configuration. Keep Rule mode, note your selected group and exit, and move on to getting apps to route traffic through the client.

There’s no need to rewrite rules, merge subscriptions, or change DNS when you’re getting started. For rule order and how proxy groups reference one another, see the rules section of the Advanced Configuration Guide. First verify the subscription’s existing settings to narrow down any issues to the configuration, traffic routing method, or selected exit.

Enable the System Proxy or Connect on Mobile

Once you’ve chosen a mode and exit, return to the client’s Overview page. Make sure the configuration has no errors and the core is running. If the client has a separate start button, start the core first. Simply opening the app doesn’t mean it’s handling network requests. Desktop and mobile clients use different traffic-routing options, so follow the instructions for your device below rather than looking for a setting that isn’t available on your platform.

Desktop: Enable the System Proxy

In your desktop client, find and enable “System Proxy.” If the operating system asks for permission to change network settings, confirm the request came from the client you just started, then approve it as prompted. Browsers and apps that follow the system proxy settings will send requests to the client’s local proxy port. In most cases, you don’t need to enter the address again in your browser. If you use a separate proxy extension, disable its routing rules first so they don’t override the system settings.

Keep the client’s default listening port for now; don’t change it just to match a screenshot you found online. The common mixed port 7890 is an example, not a fixed value required by every installation. If you see address already in use, another process is using the relevant listening address or port. Resolve the conflict before testing the connection. See How to Fix a Clash 7890 Port Conflict for troubleshooting steps, and don’t keep toggling the system proxy while the error persists.

The system proxy only affects apps that honor the setting. Some games, command-line programs, and apps with their own networking may bypass it. So if a browser works but another app doesn’t, that alone doesn’t mean your subscription is invalid. Start by testing in a regular browser. If you need to route traffic from more apps, learn about TUN permissions, routing, and DNS first. Don’t enable both the system proxy and TUN while troubleshooting for the first time; that makes it harder to tell which routing method is in use.

Mobile: Allow the System VPN Permission

In the mobile client, tap “Connect” or the start button. The first time you connect, the system will usually ask for VPN permission so the client can handle connections through the system’s network interface. Confirm the app name and allow access, then return to the client and wait for its status to update. This VPN permission lets the client route traffic on your device; it doesn’t replace the subscription or exit you just selected.

If another VPN app is connected on your device, disconnect it before starting the Clash client. On Android, check the client’s status and the system VPN indicator; on iOS, check the client’s status and VPN settings. System layouts and indicator locations vary by version, so don’t rely only on whether a particular icon appears in the status bar. If you denied the permission, tap Connect again to go through the system prompt.

For your first Android test, keep the client in the foreground; there’s no need to change every background setting yet. If it disconnects when the screen locks or reconnects only when you reopen the app, check battery optimization, background activity permissions, and battery saver settings. See Android VPN Permissions and Background Operation for instructions. Once the client shows that the connection is established, keep the current configuration and exit selected and continue to the last step.

Check Connection Logs to Verify the Rules

Open a browser and visit a site that should use the proxy according to the active configuration. Use a new tab and reload the page if needed, so you’re not just seeing cached content. Then switch to the client’s Connections page and find the entry for the domain you visited. Some connections are very brief, so you may need to watch the page while it loads. If the client doesn’t show enough detail, check the connection and rule information in its logs temporarily.

Check the Domain, Rule, and Final Exit

Once you find the entry, check the destination domain, matched rule, and policy chain first. The domain should relate to the site you just visited, the rule should point to the expected proxy group, and the end of the policy chain should show the exit that group is actually using. A web page usually requests several domains. Its main document, images, scripts, and login services may match different rules, so don’t assume the whole page bypassed the proxy just because one entry says DIRECT.

Now visit a site that should connect directly according to the configuration and check whether its entry matches DIRECT. Both types of request should behave as expected for the rules to be working broadly as configured. A lit-up Connect button only shows that the service or traffic-routing interface has started; a site loading successfully doesn’t prove the request went through a proxy. The key is to compare what you see in the browser with the client’s connection records.

To check your proxy exit, you can use a network information site you trust, but also confirm that its request matched a proxy rule. If the site matched a direct-connection rule, seeing your direct connection’s exit is expected. There’s no need to keep checking for a single “overall exit” for the whole device: in Rule mode, different destinations can use different routes. That’s traffic splitting, not an unstable client.

If Verification Fails, Check the Connection in Order

If the destination won’t load, return to the configuration page and confirm that the configuration you just imported is active. Next, check that the core is running and that there are no parsing errors. Then check the connection records. If no entry appears when you make a request, first check the system proxy, mobile VPN permission, browser proxy extensions, and per-app exclusions. Changing proxy exits won’t usually help if the traffic hasn’t reached the core.

If a connection appears but its final policy is DIRECT, check that Rule mode is active and review the relevant group selections. If the connection was sent to a proxy exit but still fails, try another exit available with your account and check your subscription’s validity and network restrictions. Check DNS-related messages only if you see a resolution error for a specific domain. Change one setting at a time, retry the same destination, and check the connection record to avoid changes that cancel each other out.

Find common error fixes and instructions for restoring system proxy settings in the Help Center. For TUN, Fake-IP, domain sniffing, and local overrides, see the relevant topic in the Advanced Configuration Guide. When reporting an issue, include your device OS, client name, traffic-routing method, and error text—but redact your subscription URL, node passwords, and other account details first.

After the First Setup

Your first setup is complete once both proxied and direct requests behave as expected. Keep track of the active configuration, mode, and proxy group selection. For future sessions, start the client first, then enable the system proxy or connect on mobile. If behavior changes after a subscription update, check the active configuration and group selections again; don’t assume custom changes will always be preserved. Use the client’s supported override mechanism for changes you need to keep.

When you’re done, turn off the system proxy on desktop before quitting the client, so apps don’t keep sending requests to a local port that’s no longer running. On mobile, disconnect from within the client. If you later enable launch at startup or TUN, add one feature at a time to this verified setup and repeat the connection checks in this guide. That gives you a clear working baseline without having to reinstall everything when an issue comes up.