Clash Setup Guide: From Importing a Subscription to Verifying It Works

What you need before you begin

Before diving in, make sure the following two things are ready — it saves you from having to backtrack partway through:

• A Clash client is already installed. Installers and recommendations for Windows, macOS, Android, iOS, and Linux are all on the download page. For your first time, just pick the recommended client shown as the first card for your platform — installing it works like any other app. If you're unsure which client suits you best, see Client Comparison.
• You have a subscription link ready. The subscription link comes from your proxy service provider, usually found in your account dashboard on their website — it looks like a long URL starting with https://. Make sure you copy the "Clash subscription" or "universal subscription" link, not the share link for a single node. The difference, along with how subscription conversion works, is covered in the relevant entries on the FAQ page.

The client itself is just a "shell": it reads configs, manages nodes, and applies routing rules, but it doesn't come with any nodes built in. The subscription link is what feeds your provider's nodes and rules into that shell — which is why importing the subscription is the very first step.

Step 1: Import the subscription link into the client

Open the client and find the config entry in the sidebar or bottom tab bar. In Clash Plus and FlClash it's called "Config," in Clash Verge Rev it's "Subscription," and in the English interface it's usually "Profiles." Once you're in, you'll see an input box near the top of the page with a "Download," "Import," or plus button next to it — that's the entry point for your subscription.

Paste and download the subscription

Paste your subscription link into the input box in full. Three things to watch for: the link must be copied completely from https:// to the very end with nothing cut off; make sure no extra spaces or line breaks slip in (this often happens with links forwarded through chat apps); and only paste one link at a time. Once you've confirmed it's correct, click "Download" or "Import" — the client will request the nodes and routing rules from your provider's server. This usually finishes within a few seconds on a normal connection.

Confirm the import succeeded

A successful import shows up as a new profile card in the list, typically showing the subscription name, last update time, and sometimes traffic usage and expiry date. Click the card to select it (it should highlight or show a checkmark) — the client only actually loads a profile once it's selected, and importing without selecting is the most common beginner mistake. After selecting it, switch to the proxy page — you should see a long list of node names, confirming the subscription content is now active.

If the import fails

If clicking download produces no response for a while, or you get a parsing error or format error, try again exactly as before first. If it still fails, the usual causes are an incomplete link copy, an expired subscription, or a subscription format that isn't Clash-compatible. For a step-by-step troubleshooting approach and how subscription conversion works, see the installation and setup section of the FAQ page — we won't go into detail here. It's also worth checking that automatic subscription updates are enabled (usually in the profile card's menu or in Settings), so nodes stay in sync when your provider changes them, instead of finding out weeks later that everything's stopped working.

What else lives inside a config file, and how to manage multiple subscriptions together, are more advanced topics — once your setup is working, check the relevant chapters in the Advanced Handbook.

Step 2: Choose the right proxy mode

Once the subscription is imported, don't rush to turn the proxy on yet — take a minute to understand "mode," since it determines the path every single network request takes. The mode switch is usually near the top of the proxy page or somewhere prominent on the main screen; Clash Verge Rev puts it in a row of buttons above the "Proxies" page, while Clash Plus lets you switch it right from the home screen. Every Clash-based client offers the same three modes:

• Rule mode: Traffic is matched against the routing rules in your profile one by one — sites and apps in mainland China connect directly, while sites outside China that match a rule go through a proxy node. This is the recommended mode for everyday use, offering the best balance of speed and data usage.
• Global mode: No matching logic at all — every single connection goes through the proxy node. Sites in mainland China become noticeably slower and subscription data usage rises quickly, so this is usually only used temporarily to check whether a specific site is reachable through a node at all.
• Direct mode: No traffic goes through the proxy at all — effectively pausing routing without shutting down the client, occasionally useful for comparison testing.

Action: switch to Rule mode

Click the mode selector and switch the current mode to "Rule." The change takes effect immediately, with no need to restart the client. While you're there, take a look at the proxy page: in Rule mode you'll see several "policy groups" — for example, one for choosing nodes and another for streaming services. These are routing setups your subscription provider has already configured, and new users don't need to adjust them individually.

If you're curious how rules are written, what types of policy groups exist, or how to customize routing, that goes beyond a first-time setup — the policy groups and rule sets chapters in the Advanced Handbook cover it in depth. For now, just remember: stay on Rule mode day to day, and only consider Global if something's not working.

Step 3: Pick a node and turn on the system proxy

Now for the part that actually "connects" you — two actions: pick a node, flip a switch.

Pick a node first

Open the proxy page and find the policy group responsible for node selection (usually named something like "Proxy Selector" or "Proxy," listed near the top). Open it to see every node in your subscription, each with a latency number or test button next to it. Run a latency test on the whole group first (usually a lightning bolt or radar icon next to the group's title), wait a few seconds for all nodes to finish testing, then pick one with latency somewhere between a few dozen and two hundred milliseconds. Skip any node showing "timeout" — it's currently unavailable. Most desktop clients default to an "Auto" group, which is also fine to leave as-is, since it automatically picks whichever node currently has the lowest latency.

Then turn on the system proxy

Go back to the main screen or Settings and turn on the "System Proxy" toggle. Here's what happens behind the scenes: the client opens a local proxy port on your machine (default 7890), and turning on the system proxy tells the operating system to "route all network requests through this port," so your browser and most apps automatically start going through the client and get routed according to the rules. On Windows and macOS, one toggle does the job. On Android, the equivalent is the launch button on the home screen — the first time you tap it, the system will prompt for VPN connection permission, and tapping "Allow" is exactly what's expected (this is the standard way Android implements local traffic routing). On iOS, Clash Plus similarly asks to add a VPN configuration on first launch, and once confirmed, the main screen shows a connected state.

Two convenient settings worth knowing about: first, "launch at startup + auto-enable system proxy" lets the client start with your system so you don't have to open it manually every time — setup varies slightly by client, see the relevant entry on the FAQ page. Second, some command-line tools and terminal programs don't respect the system proxy and need TUN mode to intercept their traffic instead — this is more advanced, and covered in the TUN chapter of the Advanced Handbook. Skip both of these for now and get the basic flow working first.

Step 4: Confirm the proxy is actually working

Turning the toggle on doesn't automatically mean everything's fine — spend two or three minutes running a full check so you can immediately tell the difference between "actually working" and "looks on but isn't connected."

Method 1: Visit the target site

Open your browser and visit a site outside China that you couldn't reach before. If it loads normally, that confirms all three pieces — node working, rule matched, system proxy active — are functioning together. It's also worth opening a familiar site in mainland China to confirm speed hasn't dropped — in Rule mode, mainland traffic should connect directly, and if it's noticeably slower too, you've likely switched to Global mode by mistake; just go back to Step 2 and switch back to Rule.

Method 2: Check the Connections or log page

Switch to the client's "Connections" page. When everything's working, you'll see new connection entries scrolling in in real time, each labeled with the destination domain, the matched rule, and the node actually used — a domain outside China followed by a proxy node name, and a mainland domain followed by DIRECT, is clear visual proof that routing is working correctly. If no new entries appear while you're browsing, traffic isn't reaching the client at all — usually because the system proxy failed to enable or another proxy tool has taken over. See the troubleshooting section of the FAQ page for next steps. For what each field in the log means and how to read error messages, see Understanding Connection Logs.

What to do if verification fails

If a site won't load, work through this order: ① go back to the proxy page and run the latency test again — if the current node shows a timeout, switch to one with normal latency; ② confirm the mode is Rule or Global, not Direct; ③ confirm the system proxy toggle is still on (some security software turns it off automatically); ④ try Global mode once as a test — if it works, the issue is with a rule; if it still doesn't, the issue is with the node. More detailed troubleshooting checklists are available in Slow Speed Checklist and on the FAQ page. If you're seeing HTTPS certificate warnings, see Certificate Error Explained.

At this point, your first-time setup is complete. Day-to-day use only requires two actions going forward: switch nodes on the proxy page if one gets slow, and let the subscription auto-sync when your provider announces updates. The client can stay running in the background, and Rule mode has virtually no impact on browsing sites in mainland China.