CONFIGURATION INPUT
Import a Subscription and Activate the Profile
First, confirm that the client is installed and launches normally. After starting, desktop clients usually minimize to the system tray or menu bar; closing the main window does not necessarily exit the app. On mobile, remain on the client’s main screen. If the first launch prompts you to download the core, install service mode, or grant network access, complete those prerequisites according to the client’s instructions. Subscription parsing and proxy connections can run only after the core starts successfully.
Find the Subscription Input
Open the page named “Profiles,” “Subscriptions,” or “Configuration.” Your service provider will usually give you a subscription URL beginning with https://. Copy the entire URL, without leading or trailing spaces or punctuation added by a chat app. A subscription URL is a configuration credential: paste it only into a trusted client, and never publish it on a public page, in a screenshot, or in a support forum.
Paste the subscription URL into the input field, then click “Import,” “Download,” “Add,” or “Update.” The client will fetch the remote profile and parse its proxy nodes, proxy groups, and rules. Desktop clients usually add a new profile card; mobile clients may show the subscription name and update time directly. If your provider supplied a local YAML file, use “Import from File” or “Open Configuration.” Afterward, select the file in the profile list.
Confirm That the Import Is Complete
Do not rely only on a brief “Import successful” message. Open the proxy or node page and confirm that you can see at least one proxy group and selectable nodes. Then return to the profile page and verify that the new profile is selected, enabled, or marked Active. Some clients can store multiple profiles, but the core loads only one at a time. If the new profile was downloaded but not activated, the proxy page may still show old nodes and later tests may not match expectations.
If the list is empty, parsing fails, or the imported profile contains rules but no nodes, update the subscription once and review the error message. Common causes include an incomplete URL, an expired subscription, a response that is not in Clash configuration format, a cached response, or a network that cannot reach the subscription URL. Do not keep switching proxy modes when the core has no usable proxy objects. Check subscription and profile issues in Troubleshooting; for multiple-subscription merges, local overrides, and YAML structure, see Advanced Configuration.
TRAFFIC POLICY
Choose Rule Mode and Confirm the Proxy Group
Once the profile loads, decide which routing logic should handle connections. Most clients offer Rule, Global, and Direct modes. The mode controls how traffic is routed; it does not start the system proxy or choose a node for you. Rule mode is recommended for the first connection because most subscription profiles already include direct, proxy, and block rules that handle traffic by domain or network range.
Rule, Global, and Direct Modes
Rule mode evaluates the configured rules from top to bottom. Connections matching a direct rule access the destination directly; those matching a proxy rule are passed to the specified proxy group; unmatched connections are handled by the final fallback rule. This mode suits everyday use and makes it easy to see which rule matched each request in the connection log. Global mode sends all connections handled by Clash to the global proxy group. It is useful for temporarily checking whether rules are keeping a target website out of the proxy, but long-term use may proxy services that should connect directly.
Direct mode sends managed traffic straight to its destination without using a proxy node. It is useful for quickly comparing the local network or pausing proxying while keeping the client running. If your goal is to establish a proxy connection, do not use Direct mode as the final setting. Some clients also offer modes such as Script or Fallback; these depend on the specific profile and do not need to be changed during initial setup.
Choose an Actual Node in the Proxy Group
Open “Proxies” or the proxy group page and find the group handling most proxy traffic. Group names come from the subscription profile and may be “Node Selection,” “Proxy,” or something else. Select the group to view nodes, latency-based groups, failover groups, or other nested policies. For the first setup, choose a specific node so you know which exit is being used. If you choose an automatic group, confirm that it has completed testing and selected a working member.
Region, multiplier, and route labels in node names are labels supplied by the profile provider, not measurements of current connection quality. A more reliable approach is to run a latency test in the client and check for a normal result. Latency testing only shows that the test address was reachable at that moment; it does not guarantee access to every website. Use it here to rule out obviously timed-out nodes. If every node times out, check the local network and subscription status instead of blindly selecting nodes by name.
Keep Rules and Policies Aligned
Some profiles contain several service-specific proxy groups, such as manual selection, automatic selection, media services, and fallback proxy groups. Rules target a proxy group by name, and the group then points to a node. When adjusting a profile, find the group shown in the connection log and change that group’s selection; changing a group that the active rule does not reference will not change the actual exit. For more complex group types, health-check settings, and rule ordering, see the Advanced Configuration Guide. This guide only requires the primary proxy group to point to a working node.
PROXY ACTIVATION
Start the Core and Take Over System Traffic
Once the node and mode are ready, two conditions must be met: the Clash core must be running, and device traffic must actually be directed to the core’s listening entry point. Selecting a node alone does not change the operating system’s network settings. Conversely, if the system proxy points to a local port while the core is stopped, the browser may be unable to open pages because it cannot connect to the local proxy port.
Enable the System Proxy on Desktop
Windows and macOS clients usually offer a “System Proxy” switch in Settings, on the home page, or in the tray menu. Confirm that the core is running, then enable the system proxy. The client points the operating system’s HTTP and HTTPS proxy settings to a local listening address, which common browsers read automatically. Keep the client running after enabling the switch: quitting stops the local listener, while the system proxy setting may not be restored until the client exits cleanly.
If the client offers “Launch at Startup” and “Launch Silently,” configure them after the first successful verification. During initial setup, keep the defaults so error messages and connection logs remain easy to observe. Some Windows clients also offer service mode for restricted permissions or TUN support; if the regular system proxy is enough for browser access, there is no need to change service mode, the network stack, and DNS settings at the same time.
Confirm VPN Permission on Mobile
On Android and iOS, Clash clients typically take over traffic through the system VPN interface. After you tap the connection button, the system displays a prompt to authorize the VPN connection or add a VPN configuration. Approve it; the status bar usually shows a VPN indicator, and the client changes from disconnected to running. If no authorization prompt appears, check whether another VPN app is occupying the connection; normally only one system VPN tunnel can be active at a time.
Android battery optimization may restrict the client in the background. During the first test, keep the app in the foreground and do not immediately clear background tasks. Once the connection is stable, decide whether to allow background activity in the device settings. On iOS, changing networks, putting the device to sleep, or editing the profile may briefly rebuild the connection; wait for the client to return to a running state before verifying access.
When to Use TUN Mode
The system proxy mainly handles applications that follow the operating system’s proxy settings. Some command-line tools, games, standalone network components, and apps with their own proxy settings may bypass it. When supported, TUN mode can use a virtual network interface to handle a broader range of TCP, UDP, and DNS traffic. However, TUN involves administrator permissions, routing tables, DNS interception, and network-stack choices, so do not enable it during initial setup before verifying the system proxy.
The recommended order is to verify the browser path with the system proxy first. If the browser works but a specific app still connects directly, determine whether it ignores the system proxy, then follow the TUN section in Advanced Configuration. This separates an unavailable node from an application that never entered the proxy path, avoiding changes to several switches at once.
TRAFFIC VALIDATION
Verify That the Proxy Is Working
An enabled connection switch does not guarantee that the target traffic is going through the proxy. Confirm the result at three levels: whether the target page loads, whether the client logs the corresponding connection, and whether the log shows the expected rule and proxy group. Only when all three agree can you confirm that the path from the application to the core and then to the proxy node is established.
Start with a Minimal Access Test
Keep the client running and open a new browser window to visit the target website. A new window reduces interference from existing connections, cached pages, and background tabs. If the page loads normally, refresh another frequently used site to confirm that both direct and proxied destinations work. If only some pages fail, do not assume the entire client is broken; inspect the domain, rule, and error type in the connection log.
To check whether the exit address changed, use a trusted IP lookup page to view the current public IP. In Rule mode, different domains may connect directly or through the proxy according to the profile, so one lookup reflects only that request’s route. To test the proxy node’s exit explicitly, temporarily switch to Global mode, reopen the lookup page, record the result, and then switch back to Rule mode. Do not leave Global mode enabled when it is no longer needed.
Review the Connection Log and Matched Policy
Return to the client’s “连接,” “Connections,” or log page, then refresh the website you just visited. Normally, the list shows the destination domain, port, network type, matched rule, and final policy chain. If the domain appears and the chain ends with the node you selected, browser traffic has entered Clash. If the record shows DIRECT, that connection followed the current rules directly; this is not necessarily an error, so interpret it alongside the destination and profile rules.
If the browser keeps loading pages but no new records appear on the connection page, the problem is usually at the traffic entry point: the system proxy is disabled, the browser uses its own proxy settings, the mobile VPN is disconnected, or the app bypasses the system proxy. If records appear but repeatedly show timeout, connection refused, or DNS failures, traffic has reached the client and the issue is more likely with the node, destination network, DNS, or remote path.
Troubleshoot Failed Results in Order
When a request times out, retest the current node in the client, then switch to a clearly working node and test again. If every node fails, update the subscription once and confirm that the local network can reach its URL. If the node works but domain resolution fails, inspect the client’s DNS settings and check for conflicts with other DNS tools. If only one or two websites fail, see which rule matched the domain and determine whether the cause is routing or a restriction imposed by the destination service.
If access works in Global mode but fails in Rule mode, focus on the matched rule and proxy group. If both modes fail while Direct mode works, focus on the node and proxy path. If the basic network is still broken after closing Clash, first restore the operating system proxy settings, DNS, and other VPN states. The complete troubleshooting tree is available in Troubleshooting, covering node timeouts, expired subscriptions, and leftover system proxy settings.