Clash Setup Guide: From Subscription Import to Connection Verification

Before You Start: Install the Client and Get a Subscription Link

You need two things before you begin. First, the client itself: head to the download page and pick the installer for your operating system. Windows and macOS users can just double-click to install; if macOS shows a "cannot verify developer" prompt the first time you open it, allow it once under System Settings → Privacy & Security. Android users need to grant VPN permission in the system dialog after installing the APK; iOS users installing Clash Plus from the App Store will see a similar VPN configuration prompt — tap Allow and confirm with your passcode once.

Second, a subscription link: this is a URL starting with https:// that your proxy service provides in its user dashboard, usually labeled "Subscription URL," "Clash Subscription," or "One-Click Import." Copy this link for later. Treat it like a password — anyone who has it can use your traffic allowance, so never post it anywhere public. If you're not sure what "subscription," "node," and "profile" mean, spend two minutes in the "Configuration & Rules" section of the glossary before continuing.

Once you have both, open the client and move to the next step.

Step 1: Import the Subscription

Find the subscription entry in the client's sidebar or bottom navigation (labeled "Subscription," "Profiles," or "Config"). There's usually a text field at the top of this page, next to an "Import," "Download," or plus-sign button. Paste the subscription link you copied earlier into the field — make sure there's no extra whitespace and that the leading https:// is intact — then click Import.

The client will make a request to the subscription URL to fetch the remote configuration. On a normal connection this finishes in seconds, and a new profile card appears showing the profile name, node count or traffic quota, and last-updated time. Seeing this card confirms the subscription content has been saved locally. Most clients require one more click on this card to make it the active profile — a highlighted border or checkmark indicates it's active. This step is easy to miss and is the most common reason no nodes show up later.

While you're here, it's worth turning on "Auto Update" in the card's context menu or edit options, with an interval of 12 or 24 hours. Providers periodically rotate node addresses, and auto-update prevents a stale profile from silently failing to connect. If you want to share one profile across multiple devices, see the blog post on multi-device sync setups — not covered here.

If nothing happens after clicking Import, or you get a failure, a 404, or a certificate error, first open the subscription link directly in a browser to confirm it's reachable, then check whether the client itself has a leftover proxy setting blocking the request. For a fuller troubleshooting path, see the "Subscription update failed" entries in the FAQ.

Step 2: Choose a Proxy Mode

Once the profile is active, go back to the main screen or settings page and find the "Mode" option. Clash-based clients generally offer three modes, which determine how traffic is routed:

• Rule mode: traffic is matched against the rules defined in the configuration file one by one; whatever matches a proxy rule goes through a node, everything else connects directly. Local sites load without detour and international sites route through the proxy, with no interference between the two — this is the default for everyday use.
• Global mode: all traffic, without exception, is routed through the selected node. Even local sites get routed through the proxy, which usually slows things down; use this only to check whether a rule is misconfigured, or when you genuinely need every connection to exit through a node.
• Direct mode: no traffic goes through the proxy at all — equivalent to temporarily disabling routing while keeping the client running, useful as a baseline when troubleshooting.

In practice, just select Rule mode — the rule set bundled with your subscription already covers the vast majority of common sites. You won't see any obvious change in the interface after switching modes, and that's expected: mode only determines the routing logic, and actually getting your traffic into the client still requires the system proxy step that comes next. For details on rule matching order, GEOIP resolution, and how the various proxy protocols differ, see the glossary and the protocol and core technical reference — none of that affects the flow described here.

Step 3: Establish the Connection

Now route your system's traffic into the client. On the main screen or settings page, find the System Proxy toggle and turn it on. This changes the operating system's proxy settings so that browsers and other programs that respect the system proxy hand their requests to Clash. On desktop, flipping the switch takes effect immediately; on Android and iOS, the equivalent is the start button on the home screen — tapping it makes a VPN icon appear in the status bar, which serves the same purpose. Some desktop clients also offer "TUN mode," which can capture traffic from programs that ignore the system proxy (such as certain command-line tools). You won't need this for first-time setup — leave it off, and check the FAQ later if you need it.

Next, choose an exit node. Open the "Proxies" page to see the nodes from your subscription organized into groups. Click the latency test button (the lightning bolt or radar icon) first — the client will test every node, and within a few seconds a number in milliseconds appears next to each: lower is faster, green usually means under 200ms, and nodes showing a timeout or blank are currently unavailable. Click a node with a normal latency value in the main group, and it becomes your current exit node.

If every node times out, don't keep retesting — the issue is much more likely to be with the subscription or your local network than with the nodes themselves. See the blog post on troubleshooting node timeouts or the troubleshooting section of the FAQ. If the nodes look fine, setup is essentially complete — the last step is confirming it actually works.

Step 4: Verify It's Working

Verification happens on two levels. First, check the outcome: open your browser and visit an international site that previously wouldn't load or was very slow. If it loads normally, the chain of "system proxy → client → node" is working. It's worth also visiting a local site to confirm it still loads instantly — in Rule mode, local traffic should connect directly, so if local sites suddenly feel slower too, the mode was probably set to Global by mistake.

Second, check the process: go back to the client and open the "Connections" panel. When everything's working, connection records scroll by in real time, each one showing the target domain, the matched rule, and the node actually used. Find the domain you just visited and confirm its exit node matches the one you selected — that confirms routing is behaving as expected. For more detail, switch to the "Logs" page; log levels and common error meanings are covered in a dedicated blog post, and you don't need to dig into them for first-time setup.

If the site still won't load in your browser, work back through the chain in this fixed order: is the subscription active (step 1) → is node latency normal (step 3) → is mode set to Rule or Global (step 2) → is system proxy turned on (step 3). Checking each in turn narrows down exactly where the problem is. If the browser works fine but a command-line tool isn't going through the proxy, that's a system-proxy-scope issue — see the FAQ and the blog's system proxy troubleshooting post. Deeper diagnostic methods and protocol-level details are all covered in the technical reference.