Clash Setup Guide

Before You Begin: Client and Subscription

You’ll need an installed client and a working Clash subscription URL or local YAML configuration. The client reads the configuration and routes traffic; installing the app alone does not provide proxy nodes. If you haven’t installed a client yet, visit the client download page, choose the installer for your operating system, and return here after setup. Don’t run multiple proxy clients at once during your first test.

Your service provider or configuration maintainer usually supplies the subscription URL, which may contain account-identifying parameters. Use the copy button on their page, and make sure you capture the full URL without selecting any surrounding instructions. A complete URL may let others access your subscription, so don’t post it in public forums or screenshots. If you only have an account login page and no subscription URL, look for the Clash or compatible configuration section first.

You don’t need to write a configuration by hand, change DNS, enable LAN access, or adjust kernel settings for this guide. Keeping the client’s defaults makes troubleshooting simpler. If you’ve already configured a manual proxy in your system, note its address and port first. On a managed work device, check whether network policies allow changes. You can look up the differences between nodes, policy groups, and the kernel in the glossary whenever needed; there’s no need to read it all before connecting.

01 Import a Subscription and Activate the Configuration

Add a Remote Subscription

Launch the client and open the “Subscription” or “Configuration” page from the sidebar or bottom navigation. Look for “Add,” “Import,” or a plus button. Choose the remote URL option and paste the full subscription address into the URL field. Give it a useful local name, such as “Daily setup”; this label won’t change the subscription itself. Check that there are no spaces or line breaks at either end, then save or import and wait for the client to download and parse it.

After a successful import, you’ll usually see a configuration card or subscription entry. Check for a successful parsing message, then select “Use,” “Enable,” or the equivalent option to make it active. Some clients activate an imported configuration automatically; others only add it to the list. Seeing the subscription in the list doesn’t confirm it’s active—check the selected indicator, configuration name, or active status.

Next, open the “Proxies” or “Policy Groups” page. If the groups and outbound options defined by the subscription are visible, the configuration is ready to use. Group names depend on the configuration: a group might be called “Node Selection” rather than PROXY. Confirm that the list opens normally, but don’t enable the system proxy yet. If you see only DIRECT or groups from an older subscription, return to the configuration page and check which one is active.

Check the Input if Import Fails

If you see a format error, first determine whether the link couldn’t be downloaded or the downloaded content isn’t a configuration. Download failures may be caused by network problems, an expired URL, or subscription permissions. The content may be invalid if you pasted an account page, a share page, or an incompatible subscription format. Use the client’s download or parsing error to identify the cause; don’t save the same URL as multiple subscriptions. If you contact the provider, describe the error without sending the full sensitive URL.

If you have a local YAML file, choose “Import from file” in the add menu and open it in the system file picker. Then set it as the active configuration. Local files generally don’t update automatically like remote subscriptions. To refresh a remote subscription, use the update button on its card. Available options in a group may change after an update, so check that your selected outbound is still there. Once the configuration source is set, you’re ready to choose how traffic is routed.

02 Choose Rule Mode and an Outbound

Start with Rule Mode

Find “Outbound Mode” on the client’s home screen, in the top toolbar, or in settings, then choose “Rule.” The corresponding configuration value is mode: rule. Rule mode processes connections in the order listed in rules and sends each match to its assigned outbound, so it’s normal to see both direct and proxied connections at the same time. Rule mode isn’t a specific node; it determines how traffic is matched. The policy group controls which node is used.

Open the main selection group on the proxy page and select an available node, or choose an automatic selection group supplied by the subscription. If the main group points to another selection group, open that too and continue until you reach the actual outbound. Don’t rely on the group name alone: a group labeled “Proxy” may currently be set to DIRECT. Note the main group and selected option so you can compare them with the outbound chain when checking connection logs.

If the client offers a connection test, run it once for a candidate node and choose an option that responds successfully. The result only shows whether that test destination was reachable at that moment; it doesn’t guarantee access to every site or indicate real download speeds. If an app won’t connect, don’t test every node right away. First check traffic capture and the connection logs below to confirm the request is reaching the client.

Rule Mode, Global Mode, and Direct Mode

Global mode usually sends every connection that reaches the kernel through the outbound currently selected for GLOBAL. It can help you briefly check whether rules are affecting access. If you switch to “Global,” expand GLOBAL and select an outbound; otherwise, traffic may still go direct. Global mode doesn’t capture traffic from the entire device—whether an app reaches the client still depends on the system proxy, TUN, or the app’s own proxy settings. Switch back to rule mode for everyday use.

Direct mode sends connections that reach the kernel straight out to the network, which can help you check whether the destination is reachable over your original connection. Switching modes won’t add nodes or fix an expired subscription. If a page behaves unexpectedly, note the current mode and group selection before changing one setting at a time. For rule types, matching order, and policy group syntax, see the glossary. For this setup, all you need is rule mode and one clearly available outbound.

03 Enable the System Proxy or VPN

On Desktop, Test with a Browser First

Keep the client running and turn on “System Proxy” from the home screen or settings. Confirm that the switch shows as enabled and the client isn’t reporting a kernel startup error. Then open a new browser tab and visit a known-working page. For your first test, use a browser that follows the system proxy. Games, command-line tools, and apps with their own network settings may ignore it, so don’t use them to judge whether the setup works.

The system proxy usually points to a loopback address such as 127.0.0.1, with a port set by the client’s current listener. Clash commonly uses 7890 as its mixed port, configured with mixed-port, but your subscription or client may use a different value. Check the current interface rather than changing a working configuration just to match a commonly used port. The mixed port accepts both HTTP and SOCKS proxy requests.

If the client reports that the port is already in use, check whether another client or kernel process is running. Close duplicate processes and try starting the current client again. Change the listening port in settings only if necessary, then reapply the system proxy. Update the port in any apps where you’ve set a manual proxy, too. The external controller port isn’t a browser proxy port and can’t be used in place of the mixed port.

Allow the System Connection on Mobile

Android and iOS clients usually have a “Connect” or start button on the home screen. Once you’ve selected a subscription and outbound, tap the button and approve the VPN connection request from the system. When the VPN appears in system settings or the client shows a connected status, switch to your browser and test. This uses the system’s traffic-capture interface; the active configuration still determines the outbound. Tapping Connect doesn’t provide nodes automatically.

If another VPN is already connected, check for conflicts with the client before switching. On Android, also check whether “Only proxy selected apps” or an exclusion list is enabled, and make sure your test browser is included. Don’t change battery settings, app lists, DNS, and rules all at once just to troubleshoot one connection. Keep the client in the foreground and test basic access first; address background restrictions only if you run into them.

Enable TUN Only If Needed

If your browser works but a desktop app that ignores the system proxy still can’t connect, consider using TUN. It captures traffic through a virtual network interface and may require installing a client service, approving a network extension, or granting other permissions. Find the TUN switch in settings, follow the client’s prompts to install or authorize the service, and check for startup errors before testing. Permission steps vary by operating system; see the relevant platform section in the complete guide.

There’s no need to enable multiple traffic-capture methods during your initial setup. To switch from the system proxy to TUN, note the original setting, turn off the system proxy, and test with TUN enabled by itself. Some clients manage these switches together, so follow the interface you see. Don’t add routes or copy unfamiliar DNS settings. Once the connection is stable, move on to the final step and check the traffic path with a real request.

04 Check Connection Logs and Real-World Access

Check the Destination, Rule, and Outbound Chain

Open the client’s “Connections” page or set the log level to show the relevant details, then visit a test page in your browser. Look for the domain or destination address and check the matched rule and outbound chain. Existing long-lived connections may not restart when you switch nodes, so open a new page or establish a new connection for each comparison. If needed, close only the relevant connection to avoid mistaking an old route for the result of your new settings.

Test at least two types of destination: one that should go direct under your current rules, and one that should use your selected policy group. The first should show DIRECT or an equivalent direct route; the second should use the expected policy group and selected outbound. The subscription’s rules determine which destinations fall into each category—the guide can’t decide that for your configuration. A page loading proves it’s reachable, but you need to check the connection logs as well to confirm it’s being routed as expected.

An IP lookup site can provide a useful extra clue, but it can’t show the route for every request. In rule mode, the lookup page is matched against a rule too, so its result only reflects that request. The browser and other apps may also use different traffic-capture methods. For a more reliable check, compare the page’s behavior with the connection logs and current group selection rather than relying only on the system VPN icon or a single connection test.

Troubleshoot in a Consistent Order

If a page won’t load, first check that the current subscription is active and the kernel is running. Then confirm that the main selection group has a working outbound. Next, check whether the test request appears in the connection logs. If there’s no entry, start with the system proxy, the app’s own proxy settings, or the VPN’s capture scope. If there is an entry but the connection fails, check for outbound errors. Investigate DNS only if the error points to name resolution; don’t replace the entire configuration as a first step.

To tell a rule issue from a node issue, temporarily switch to global mode, select an outbound for GLOBAL, and send a new request to the same destination. If global mode works but rule mode doesn’t, check the matched rule and its policy group. If both modes fail, look at the outbound and your underlying network. Restore rule mode after testing. For persistent DNS, TUN routing, or service permission issues, see the relevant steps in the common configuration questions in the complete guide.

Leave a Reproducible Setup

Once pages load and the outbound behaves as expected, note the configuration name, proxy mode, and main group selection. There’s no need to save the full subscription URL in a public note. After updating a subscription or switching nodes, repeat the same two-destination test. If only one site has a problem while others work, keep the working configuration and check that site’s rule and connection error instead of reinstalling the entire client.

Before exiting a desktop client, turn off the system proxy or use the client’s normal exit option and confirm that the system proxy has been restored. Otherwise, the system may keep pointing to a local port that’s no longer listening. On mobile, disconnect the VPN in the client and check the system connection status. Next time, follow this order: activate the configuration, check the outbound, connect, and verify a request. For startup or long-running background settings, see the guide for your platform.