Clash Setup Guide

Before You Start: Client and Configuration Source

Open the client and make sure you can access its settings or configuration page. Installing the client only prepares the software; it does not provide a proxy service. You’ll also need a subscription URL from your provider or a configuration file with valid proxy details. The client reads the configuration and forwards connections; the subscription, node access, and service validity depend on its source.

Copy the subscription URL specifically marked as compatible with Clash or mihomo from your provider's website. A regular web page, account page, or payment page cannot be used as a subscription. If multiple formats are available, check which ones your client’s core supports before choosing. Don’t rely on the URL’s file extension alone to determine compatibility.

Before you begin, close other proxy or VPN apps that are routing traffic, but keep your current network connection active. Verify the setup on one device before configuring a router or sharing it across your local network. Subscription URLs often contain access credentials, so don’t share them in public chats, screenshots, or support requests. For basic setup, use the client interface; there’s no need to edit YAML by hand.

Step 1: Import a Subscription and Enable the Configuration

Open the client’s “Configuration” or “Subscription” page and look for “New,” “Import,” or an add button. Choose the remote subscription option and paste the full URL into the URL field. If you can name the configuration, add a label to make it easy to identify; the label won’t change your account or outbound traffic. Check for spaces, line breaks, or extra quotation marks at either end, then click Save or Download.

The client will fetch the subscription and parse its contents. Wait for the import to finish, then check whether a new entry appears and whether the client reports a parsing error. Seeing the entry doesn’t necessarily mean it’s enabled: in Clash Verge Rev, select the configuration or use its menu to enable it. Other clients may treat downloading and setting the active configuration as separate steps. Make sure you can identify which configuration is currently in use.

Next, open the Proxies page. You should see the proxy groups and candidate nodes defined in the configuration. Group names come from the subscription; they might not be called “PROXY” and may instead refer to a use case or region. If you only see a Direct option, return to the configuration list and make sure the imported entry is selected, then check that the subscription includes proxies and proxy groups. You don’t need to enable the system proxy yet; first make sure the configuration is loaded correctly.

If you have a local configuration file, choose “Import File” or drag it into an import area supported by the client. Use a YAML configuration file accepted by the client—not an HTML file saved from a web page and renamed. After importing, enable the file and check its proxy groups. A text file containing only node links is not the same format as a complete configuration; direct import depends on the client. For a quick explanation, see Subscriptions vs. Configuration Files in the Glossary.

If the import fails, first check that the URL is complete, the service is still active, and your regular network can reach the subscription source. If the server returns a login page, error text, or another unexpected format, the client may report a YAML parsing error; that doesn’t necessarily mean the configuration has incorrect indentation. If your provider confirms the format is compatible but import still fails, note the error and ask which core is supported. Never submit a credential-bearing subscription URL to a public conversion site.

After importing, find the entry’s Update action so you know where to refresh it later. Remote subscriptions usually fetch a new configuration from the provider; local files may not support remote updates. Changes made in the client may also be overwritten by the next update. For your first connection, keep the subscription’s original groups and rules. Once everything works, you can consider custom rules or overrides.

Step 2: Choose a Proxy Mode and Node

Open the Proxies page or find the outbound mode selector on the home screen, then set the mode to Rule. This mode uses the configuration’s rules to decide whether each connection goes direct or through a proxy group, making it a good starting point with a subscription’s default settings. Choosing Rule determines how traffic is handled; it doesn’t send system traffic through the client yet. You’ll enable traffic capture in the next step.

Expand the proxy group that handles outbound traffic and choose an available node. Some configurations link the main selection group to another group that selects a node automatically; if so, check that the nested group has valid candidates too. The route may look like “rule match → main selection group → automatic selection group → specific node.” A group name by itself does not mean the connection is working.

If the client offers a connectivity test, run it for the group you plan to use. The result only reflects how the specified test address responds at that moment; it doesn’t predict how every site or app will perform. If one candidate fails, try another. If they all fail, check the subscription service and your current network before changing multiple advanced settings.

Rule, Global, and Direct Modes

Global mode typically sends connections entering the core through the global proxy group. After switching, check which outbound route that group uses. It can help determine whether a problem is related to routing rules, but it does not automatically capture traffic from every device. Direct mode sends connections entering the core directly. Neither mode replaces the system proxy or TUN, and the mode name alone doesn’t show whether a connection has been established.

Keep Rule mode for your initial setup. If a group in the subscription is set to DIRECT, connections matched to that group may still go out directly. If the result doesn’t match your expectations, check the actual outbound route rather than just the mode shown at the top. For rule order and policy groups, see the quick glossary; for protocol trade-offs, see the protocol reference.

After choosing a node, don’t enable multiple traffic-capture methods at once. Keep Rule mode and one clearly selected outbound candidate, then continue. If something goes wrong, this makes it easier to tell whether the configuration failed to load, the node is unavailable, or the app’s traffic never reached the client.

Step 3: Route Traffic Through the Client

Desktop: Start with the System Proxy

In Clash Verge Rev, open Settings and find “System Proxy.” Turn it on, then make sure the client core is still running and there are no port conflict or startup error messages. The system proxy typically points your system’s HTTP and HTTPS traffic to a local listening port, so the client must stay running. Don’t change ports just to match another guide; use the value already configured in your client.

Once it’s on, open a page in a browser that follows system proxy settings. If a browser extension controls the proxy separately, disable it temporarily or switch back to system settings. If you manually entered a proxy address in the browser or app, make sure it isn’t overriding the system settings. Some apps use their own network stack and ignore the system proxy, so a working browser and a non-working app don’t necessarily mean the client is broken.

How the system proxy works on macOS and Linux varies by client and desktop environment. If browser requests don’t appear in the client’s connections after you turn it on, check whether the system network settings were applied successfully. Don’t assume the Windows steps also apply to other platforms. Linux command-line tools may not read desktop proxy settings, so start by testing with a browser that explicitly supports the system proxy.

Mobile: Approve the System VPN Request

Android clients usually have a Start or Connect button on the home screen. After enabling a configuration and choosing a proxy group, tap Connect and approve the VPN connection request from the system. Then check that the client shows a running status. The system uses a VPN interface to route traffic; that doesn’t mean the subscription has to use a traditional VPN protocol. The configuration determines the actual outbound route.

On iOS, when using Clash Plus, tap Connect after loading a configuration, allow the VPN configuration when prompted, and complete any confirmation steps required by your device. If another VPN connection is already active, disconnect it before starting this configuration. Per-app exclusions and background limits can affect which traffic is captured. For your first connection, leave the defaults in place and verify the results in the connection logs.

TUN: Enable It Only If You Need It

Consider TUN mode only if an app ignores the system proxy or you need to capture a wider range of traffic. Desktop clients may require a service installation, administrator privileges, or confirmation for virtual network adapter changes. Save your current configuration before enabling TUN, read the client’s prompts, and make sure the core starts successfully. TUN affects routing and DNS, so it isn’t a universal fix for connection problems.

For your first test, enable only the system proxy. Once the basic route works, try TUN if needed. Don’t change TUN, DNS, rules, and nodes all at once before you’ve confirmed a connection; otherwise, it’s hard to tell which change made a difference. If enabling TUN disrupts your network, turn off the new traffic-capture method and return to the last verified setup. For background, see DNS and Network Stack Terms.

Step 4: Verify the Connection and Rule Matches

Once traffic capture is enabled, open a new browser tab and visit a page you expect to access through the proxy. Make a fresh request instead of relying on a page that was already loaded; cached content and existing long-lived connections can hide changes. Then open the client’s Connections page, find the domain you just visited, and check that it appears in the log.

In the connection details, check the destination, matched rule, and actual outbound route. Fields vary between clients: some show the full proxy chain, while others display only the final policy or node. A connection expected to use a proxy should lead to the selected proxy group and its outbound node; one expected to go direct should show a direct route. Loading the page is only the first check—the route must also match your configuration’s intent.

Next, visit a destination that your current configuration explicitly routes directly, then check its rule and outbound result. Don’t assume a site will match a particular rule based only on its region; subscriptions may use custom domain lists, rule sets, or a final fallback rule. For your first check, verify one connection expected to use a proxy and one expected to go direct. There’s no need to test every app right away.

To check your apparent public IP address, you can use a trusted IP lookup service as an additional reference, but compare the result with the client’s connection logs. The lookup site is also routed according to your rules, so its result only shows the outbound address used to reach that site—not necessarily the route for every app. For a meaningful comparison, turn off traffic capture and establish a new connection. A change in one IP lookup result doesn’t prove that all traffic on the device is being captured.

If It Doesn’t Work, Check the Connection Path

If the target request doesn’t appear in the client at all, check the system proxy, mobile connection status, browser proxy settings, and app exclusions. If the connection is logged but goes direct, check the current mode, matched rule, and proxy group selection. If the log shows a proxy route that fails, try another available candidate and review the logs from the same time. This order helps avoid repeatedly changing the subscription before traffic capture is working.

A connection timeout in the logs may mean the destination is unreachable, the node connection failed, or the current network is having issues. For a DNS resolution error, check the domain and DNS settings. Note the time and destination, change only one relevant setting, then retry. For more detail, see Clash Logs: Troubleshooting Common Errors. There’s no need to learn every configuration field before your first successful connection.

Everyday Use After Setup

Once routing works as expected, keep the working configuration and node selection. If the available nodes change, update the subscription first, then check whether your proxy group selection is still valid. When switching networks, waking the device, or resuming use, check that the client is running and then start a new connection. Set up launch at startup or automatic connection after verifying the basics; neither is required for your first successful connection.

When you’re done, turn off the system proxy or TUN on desktop before quitting the client so your system doesn’t keep pointing to a stopped local port. On mobile, disconnect using the client’s Disconnect button. You’ve now completed the full setup: import a subscription, choose a mode, connect, and verify the results. Add custom rules, change DNS, or enable LAN access later only if you have a specific need.