Clash Quick Start

Step 1: Import a Subscription and Enable the Configuration

Before you begin, get the complete subscription URL from your service provider. The client reads the configuration and applies its rules; installing a client does not provide a working proxy by itself. Subscription URLs often contain access credentials, so treat them like passwords. Don't post them in public forums or share screenshots that reveal the URL. You don't need to submit your subscription to this site.

Copy the Correct Subscription URL

Open your provider's subscription management page and look for an option labeled Clash, Clash Meta, or mihomo. If the page offers multiple formats, choose the one explicitly supported by your client's core. An account, sharing, or purchase page URL from your browser's address bar is not a subscription URL. After copying, check locally that the address is complete, especially the parameters after the question mark.

If your provider only offers a format for another client, changing the URL's name won't make it compatible. Check the provider's format documentation and confirm whether it offers a native Clash configuration. If you need to convert the format, first find out how the conversion service handles subscription credentials. Don't paste a private URL into an unfamiliar website. For format differences, see the Protocol and Core Reference. For your first setup, use a configuration that imports directly.

Save the Source and Wait for the Initial Download

Open the client's Subscriptions or Profiles page and look for Add, New, or Import from URL. Paste the complete address into the remote URL field, give the profile a recognizable local name such as “Daily,” then click Save or Import. Some clients have a Download button next to the field; click it to fetch the configuration. Entering the URL without saving it does not complete the import.

Wait for the client to report a successful update, then check the profile status. If parsing, downloading, or permissions fail, stop here. Check the URL, subscription expiry, and provider announcements, then try again on your current network if needed. Don't switch global modes repeatedly to fix a failed download: the mode controls routing for a loaded configuration; it can't fix an invalid URL or incompatible file.

If you have a local YAML file, use Import File or Local Configuration to select it. Don't enter the file path in the subscription URL field. Local files don't update remotely; to change their contents, import them again or edit them using a method supported by the client. If the file references other rules or proxy providers, those resources may also need to be downloaded. A successful initial import doesn't mean all external resources are ready.

Select the Configuration to Load It into the Core

After saving, click Use or Enable for the profile, or select its card. Confirm that the client marks it as the active configuration, then open the Proxies page and check for the proxy groups defined in the configuration. These are two separate actions: importing saves a source in the client; enabling loads its proxies, rules, and settings into the core. A profile appearing in the list doesn't mean it's active.

For your first setup, keep just one configuration enabled. Don't edit the subscription contents or add multiple sources yet, or it may be hard to tell which rules are in use. If the Proxies page is still empty, return to the configuration page to check for loading errors, then visit the Help Center for steps to fix a failed subscription update or configuration parse. Once you can see the proxy groups, continue.

Step 2: Choose a Rule Mode and Proxy Group

Once the configuration has loaded, open the Proxies page or the mode selector on the main screen. For a first setup, choose Rule. It uses the configuration's rules to decide whether requests connect directly, go through a proxy group, or are rejected. The exact behavior depends on the subscription; configurations labeled Rule don't all behave the same way.

Choose a Mode, Then Choose an Exit

Common modes include Rule, Global, and Direct. Rule matches each request against the configuration; Global typically routes requests through the global proxy group, where you still need to select an exit; Direct bypasses the proxy. Global can help narrow down an issue temporarily, but it doesn't prove the subscription is working. Start with Rule and check the actual routing in the connection logs.

Once you've chosen a mode, expand the proxy group that handles the main traffic. It might be called “Select Node,” “Proxy,” or PROXY; names depend on the configuration author. Choose an available proxy from your subscription, or use an auto-select group if the configuration provides one. Don't look for a specific group name from a guide or re-import the subscription just because the names differ. What matters is which group the rules ultimately reference.

Proxy groups may contain other groups, creating a two-level selection. For example, the main group might use “Auto Select,” which then picks an exit from several proxies. That's normal. After manually selecting an entry, confirm the selection indicator moves. If the selection is DIRECT, relevant requests may bypass the proxy; if it's REJECT, they may be blocked. These are routing actions, not remote servers to test for latency.

Use Tests to Help Choose, Not as the Only Measure

If the client offers connectivity or latency tests, run one to rule out entries that clearly don't respond. A test only checks a specific destination at that moment; it doesn't prove that every site or protocol will work. If no test result is available, there's no need to change DNS right away. Note your current selection, then make a real browser request in the next step.

After a subscription update, proxy names or group structures may change, and a previous manual selection may no longer work. Whenever you make a significant subscription change, check the current group on the Proxies page instead of relying on the client still showing as running. At this point, confirm two things: Rule mode is selected and the main proxy group has an exit. Next, let the system or app send requests to the client.

Step 3: Enable the Proxy and Connect

Once the proxy group is ready, check the client's main screen for core startup errors. Some desktop clients start the core automatically, but leave the system proxy off; others require you to click Start to load the configuration. Confirm the configuration is enabled and the core is running before choosing a connection method for your platform. An open client window doesn't mean requests are going through it.

Desktop: Start with the System Proxy

Open Settings or Home in the client and turn on System Proxy. This setting points the system's proxy configuration to the client's local listening port, allowing browsers and other apps that follow system proxy settings to send requests through the client. For your first setup, keep the default listen address and port. Don't copy commonly used port numbers from a guide into every field; other processes may already be using them, so use the values shown by your client.

If a permission prompt appears, first confirm it came from the client you just launched, then follow the system's instructions. If the system proxy switch turns itself off right after you enable it, check whether another proxy tool, browser extension, or system policy is changing the settings. Pause other tools of the same kind, then turn the system proxy back on in this client to prevent multiple programs from overwriting the same setting.

System Proxy doesn't route every app automatically. Some games, terminal apps, and apps with their own network stack may ignore it, so use a browser that follows system settings for this initial test. Don't add environment variables, enable TUN, and change DNS while the browser connection is still unverified. Changing all of these at once makes troubleshooting harder and can obscure whether the basic setup works.

Mobile: Approve the System Connection

Mobile clients usually create a local VPN tunnel when you tap Connect or Start. The system may ask to add a VPN configuration or approve a VPN connection. Confirm the app name and grant permission, then return to the client to check its connection status. A VPN icon in the status bar only means the tunnel is up; it doesn't guarantee the selected remote proxy works. Verify it with a real request in the final step.

If another VPN, work profile network, or traffic-filtering tool is running, it may interfere with the connection. Disconnect other tools of the same kind, then restart this client. Keep it in the foreground while testing the first connection. Once everything works, adjust background or battery settings if needed; there's no need to change every system permission at the start.

Wait Until Basic Checks Pass Before Trying TUN

Consider TUN mode only after confirming that an app doesn't follow the system proxy and that both the client and system support TUN. It may require service mode, administrator access, or additional system permissions, and it affects routing and DNS behavior. You don't need to enable TUN alongside the system proxy for your first connection. Start with one clear request path. For details, see the Protocol and Core Reference; for startup errors, visit the Help Center.

To stop using the proxy, turn off System Proxy on desktop before quitting the client. On mobile, tap Disconnect and wait for the connection to end. Some clients clean up the system proxy on exit, but an unexpected shutdown may leave it enabled. If your browser can't connect after you quit, check whether the system proxy still points to a local port with no client listening before deleting the subscription or reinstalling the software.

Step 4: Verify Access and Routing

Keep the client running, open a new browser tab, and visit a site you normally use that should be reachable. Don't just refresh an already loaded page: cached content can look normal without generating a new request. If the browser has its own proxy extension, check that it follows system settings so the test doesn't use a different connection.

Compare the Page Result with the Connection Log

While the page loads, open the client's Connections or Logs page. Check whether the new request appears, then review the target domain, matched rule, and final proxy chain. Clients show different fields: some display the rule type, while others show the group and exit. As long as you can identify the request you just made, trace it through “app → client → rule → exit.”

If the page loads and the connection log shows the expected proxy group, the basic route for this request is working. If the log shows DIRECT, first check whether that matches the rules for the domain; direct connections aren't always a problem. Rule mode is designed to route different requests in different ways. To understand why a domain was handled this way, see the rule-matching notes in the reference guide instead of immediately switching all traffic to Global.

If no new log entry appears, check the system proxy switch, mobile connection status, and browser proxy settings. If needed, enable informational logs and make the request again; an error-only view may omit normal connections. If a log entry appears but shows a timeout or handshake failure, leave other settings unchanged and try another available proxy in the current group. This helps distinguish an exit issue from a local connection problem.

Troubleshoot in Order and Keep Working Settings

If a domain lookup fails, first check whether the issue affects just one site, then check whether subscription resources updated successfully. For configuration loading errors, go back to Step 1 rather than changing browser settings. If only one app can't connect, check whether it follows the system proxy. Fixing the layer indicated by the symptom is easier to reason about than changing the port, mode, and DNS at the same time.

Terminal commands and browsers are separate test cases. Even if the browser works, terminal tools may need proxy environment variables or a proxy address configured in the tool. Use the actual listen address and port shown by the client. For details on terminals, UWP loopback, failed subscription updates, and Fake-IP, look up the relevant topic in the Help Center. For this first setup, a working browser connection is enough.

Record Your Setup for Next Time

Once the connection works, note the active configuration name, operating mode, selected proxy group, and connection method. Don't include the full subscription URL. These four details are more useful than a screenshot that only says “Connected” when switching clients or troubleshooting later. If you share a screenshot for help, hide subscription credentials, account details, and any domains you don't want to disclose.

At your next startup, check that the right configuration is selected, then check the core and the system proxy or mobile connection status. If you turned off the system proxy manually, simply opening the client may not restore it; automatic connection depends on the client's settings. Once the basic setup is stable, enable startup on boot or scheduled subscription updates as needed, and check your proxy group after subscription updates.