Getting Started with Clash and Connection Setup

Step 1: Import a Subscription and Activate the Configuration

Open the client and go to “Subscriptions,” “Profiles,” or “Configuration Files.” On first launch, this section may contain only an Add button or a sample profile. Choose “New,” “Add,” or “Import,” then select an option such as “Remote Profile” or “Import from URL.” Paste the full URL provided by your subscription service, give the profile a recognizable name, and click “Download” or “Save.” The name is only for identifying the profile on this device; it doesn’t change its contents.

Check the beginning and end of the URL after pasting it. URLs usually start with https://. The query parameters that follow may contain required authorization details, so don’t keep only the domain or include punctuation or line breaks added by a messaging app. If your provider offers multiple formats, choose one explicitly labeled for Clash or compatible with mihomo. A list containing only proxy nodes may not be a complete configuration.

Confirm the Download, Then Set the Profile as Active

After clicking Download, wait for the client to confirm it’s complete. Depending on the interface, you may see an update time, profile name, or import result. Return to the list, select the profile you just added, or open its menu and choose “Use,” “Activate,” or “Set as active.” A profile appearing in the list only means it was saved; look for an active indicator to confirm the core has loaded it.

Next, open “Proxies” and check that policy groups and options are available. Then check “Rules” to see whether the rules have loaded. Some configurations fetch proxies or rules from remote resources, which may take extra time to load the first time. If the pages are still blank, return to Profiles and check the import result instead of repeatedly toggling the system proxy. The connection toggle won’t help until a complete configuration is loaded.

Local Files vs. Subscription Updates

If you have a .yaml or .yml file, choose “Import from file” in the import menu, then open it with the system file picker. Activate the imported profile and check that its policy groups appear. Local files typically don’t update automatically when their author makes changes. Remote subscriptions can be refreshed using “Update” on the profile card. These are different import methods—don’t confuse them.

For your first setup, update the subscription manually once to confirm the URL works before setting an automatic update interval. Don’t keep clicking Refresh after a failure; the service may limit repeated requests. For authorization errors, invalid formats, or download timeouts, check the subscription’s validity, selected format, and current internet connection. Don’t remove URL parameters at random. For detailed troubleshooting, see Troubleshooting. For the difference between subscriptions and configuration files, see the glossary.

Before moving on: The profile is set as active, and the “Proxies” page shows policy groups or available proxies. Once both are confirmed, choose how traffic should be routed.

Step 2: Choose a Proxy Mode and Proxy

Go to the client’s home screen or “Settings,” and find “Proxy Mode.” For your first connection, choose “Rule.” This mode uses the configuration’s rules to decide which connections go direct and which go through a proxy group, making it a good starting point for everyday use. Then open “Proxies” and choose an exit. These two settings control different things—how traffic is matched and where it goes—and aren’t interchangeable.

“Global” sends connections entering the core through the global policy, which usually still requires choosing an exit for the global group. “Direct” sends those connections straight to their destinations. Global mode doesn’t automatically route every app on your device through the client; apps must still send traffic to it through the system proxy, mobile VPN, TUN, or another entry point. Don’t treat selecting “Global” as a substitute for the connection setup in Step 3.

Find the Main Policy Group Used by the Rules

On the Proxies page, look for the group that provides the default proxy route. It may be called “Proxy Selection,” “Proxy,” or something else chosen by the configuration author. A group may contain proxies, automatic selection groups, other policy groups, and DIRECT. Open the main group and choose a proxy you know works. If you select another group, check where that group ultimately routes to avoid ending up on DIRECT.

If you’re not sure which group is the main one, open “Rules” and see which policy name is used by rules for common destinations or by the final MATCH rule. Then return to Proxies and select the group with the same name. Subscription providers don’t follow a standard naming convention, so don’t look for an exact label from a screenshot. For terms like “policy group” or “rule matching,” see the glossary; for now, just choose a group.

Use Tests to Help Choose a Proxy, Not as the Final Verdict

If the client offers a connection or latency test, run it once for the proxies you’re considering. A successful test means the proxy can reach that test destination; it doesn’t guarantee access to every site or service. A timeout could also be caused by the test URL, your network, or configuration resources that haven’t loaded yet. For your first setup, choose a proxy that passes the test, then verify it with real browsing. There’s no need to repeatedly test every proxy.

Existing long-lived connections may not switch to a new proxy immediately after you change the policy. To test the new selection, refresh the page or reopen the app so it creates a new connection; if needed, close only the relevant connection on the Connections page. Leave the subscription’s rules as they are for now—don’t reorder them or add custom overrides. Make those changes after the basic connection works, so you can isolate what’s affecting the result.

Before moving on: Proxy mode is set to Rule, the relevant policy group has an exit selected, and it doesn’t unexpectedly route to DIRECT. Next, send your device’s traffic through the client.

Step 3: Enable the Device’s Traffic Entry Point

After importing the configuration and choosing a proxy, check the home screen to see whether the core is running. If there’s a “Start,” “Connect,” or power button, tap it and wait for the status to show that it’s running. Some desktop clients start the core automatically, but that doesn’t mean the system proxy is enabled. The core handles connections sent to it; the system or app still needs to know how to route those connections there.

Computer: Start with the System Proxy

In your Windows or macOS client, find and enable “System Proxy.” This setting usually points the operating system’s proxy address to a local listening port. Keep the client’s default port for your first setup; don’t change it just to match a screenshot. If the interface shows the mixed port 7890, that’s a common default, not a universal value. Use the port configured in your client.

After enabling it, reopen your browser and make a request. Most desktop apps that follow the system proxy will use it, but some games, command-line tools, and apps with their own network settings won’t. Proxy settings on Linux desktops can also depend on the desktop environment and app. If the browser works but another app doesn’t, check that app’s proxy settings before assuming the subscription is broken.

When setting things up for the first time, quit other clients that are managing the system proxy or routing network traffic. Two apps may keep overwriting the same setting. Remote-work VPNs and enterprise networking tools may have specific requirements; if you can’t safely turn them off, follow your organization’s policies. Don’t configure two proxy clients to use each other as upstreams, or you could create a connection loop that leaves pages loading indefinitely or fills the log with repeated errors.

Phone: Allow the System Network Permission

Android clients usually ask to establish a VPN connection when you tap Start. Check the app name in the permission prompt to make sure it’s the client you just installed, then allow the connection. This VPN interface routes device traffic through the client; it doesn’t mean the subscription is working. Once permission is granted, return to the app and check the connection status. Consider battery optimization and background-running settings only after your first successful connection; there’s no need to change every system setting upfront.

On iOS, tapping Connect may prompt you to allow a VPN configuration to be added. Complete the authorization using your device’s authentication method. Return to the client, confirm the profile and selected policy are still correct, then test a connection. If another VPN is already active, check for conflicts; most typical setups aren’t designed to run two different network-routing tools at the same time.

Before moving on: The core is running, the system proxy is enabled on your computer, or your phone has granted network access and shows a connection. Now verify with a real request instead of relying on the toggle’s appearance.

Step 4: Verify Rules and Real Connections

Open a website you can normally access directly to confirm your basic internet connection still works. Then visit a site that should use a proxy under the current configuration. Choose destinations you’re familiar with and can access right now; one site being down or temporarily unavailable doesn’t mean the whole configuration has failed. If your browser is showing an old page, reload it or open a new tab to make sure you’re testing a new request.

Check These Three Details on the Connections Page

Keep the client’s “Connections” page open while you visit a test destination. Find the matching domain or destination address, then check the matched rule, policy group, and proxy route. A request that should use a proxy should show the selected policy and actual proxy in its route. For a request that should go direct, DIRECT may be the expected result. With rule mode, it’s normal to see both direct and proxied traffic; not every connection should use a proxy.

If the log shows an address but no domain, don’t assume DNS is broken. What’s displayed depends on how the app makes its request and what information the client provides. Check the visible rule and route first, then investigate further based on the symptoms. An external IP lookup can help confirm the route for that particular request, but it can’t prove that every app is routed through the client or that all rules are working correctly.

If you can’t see the test destination in the log, check whether the connection list has a search term or filter applied. Some clients show only active connections, so a short request may disappear quickly. Make the request again and watch the list, or check the logs. Keep the log level at info for now. Don’t enable extensive debug output just to verify your first connection, and never publicly share full logs containing destinations or personal configuration details.

If It Doesn’t Work, Check One Part at a Time

If the request doesn’t appear in the client, check the system proxy or phone connection status, and whether the app uses that entry point. If the request appears but matches DIRECT, revisit Step 2 and check the mode, rules, and policy group. If the route looks right but the connection times out, try another proxy and check the subscription status and basic internet connection. This order helps distinguish between traffic not being captured, different rule matching, and an unavailable proxy.

Change one setting at a time, then repeat the same test request and check whether the connection log changes. Don’t replace the subscription, change DNS, switch to Global mode, and enable TUN all at once; even if access returns, you won’t know what fixed it. If the basic checks don’t solve the problem, follow the symptom-based steps in Troubleshooting. This page doesn’t cover advanced topics such as routing, certificates, or DNS mapping.

When destinations that should go direct and those that should use a proxy both behave as expected, your first setup is complete. After that, you usually just need to start the client, confirm the active profile, and update the subscription when needed. Updating may replace the remote configuration, and edits made directly to a downloaded file may be overwritten. To keep custom rules, learn how your client handles overrides, then check the relevant fields in the glossary.