Clash Subscription and Connection Guide

01 Import a Subscription and Activate the Configuration

Open the client and go to Configuration, Subscriptions, or Profiles. Find an option such as New, Add, or Import from URL, select the remote subscription type, and paste the full URL into the address field. If there are separate name and URL fields, use a recognizable name such as “Everyday setup.” Put only the subscription link in the URL field—no notes, quotation marks, or punctuation added by your chat app.

After clicking Download, Import, or Save, wait for the configuration to appear in the list. Normally, its card shows a name, and the Proxies page shows its proxy groups or nodes. A card with the right name doesn't prove the remote content downloaded successfully; check for download errors, parse errors, or empty content. If there's a refresh button, use it once to confirm the URL returns content the client supports.

Set the Imported Configuration as Active

Some clients activate an imported configuration automatically; others require you to open its card and select Use, Activate, or a similar option. Check that the active indicator is on the newly imported entry, then open the Proxies page. If you still see group names from an old configuration, select the new one again and wait for the core to load. Don't delete other configurations; keep a working one available as a fallback.

For a local file, use Import from File and select the saved .yaml or .yml file. A complete configuration usually includes proxies, proxy groups, and rules; a standalone list of nodes may not work as a full configuration. A file extension doesn't guarantee valid content, and saving a webpage as YAML doesn't convert its format. For these distinctions, see Subscriptions and Configurations in the Glossary.

If Import Fails, Check the URL and Format First

Handle “Request failed” and “Parse failed” as separate issues. For a request failure, check that the URL is complete, the subscription is active, and your network can reach the subscription server. For a parse failure, confirm the link returns a configuration supported by Clash or mihomo—not an account login page, error page, or node list intended for another client. If your provider offers format options, re-import in the format that matches your client's core.

Don't send a full subscription URL to an unfamiliar conversion service just to make it “importable.” Don't adjust DNS, ports, or TUN at this stage either: the configuration hasn't loaded, so these switches can't fix its format. Move on once the proxy groups appear. Set an automatic update interval after connecting; there's no need to add complex update tasks during initial setup.

02 Choose a Rule Mode and Node

After the configuration loads, return to the home page, dashboard, or mode menu and find Rule, Global, and Direct. For your first setup, choose Rule mode. It applies the configuration's policies to connections that reach the core: some destinations connect directly, while others go through a proxy group. This preserves your subscription's routing rules and lets you check which rules matched in the logs.

Global mode is useful for a temporary comparison test. It sends traffic that reaches the core to the global policy selector, where you choose a working node. Direct mode sends those connections straight to their destinations. The mode controls how traffic is handled after it enters the core; it doesn't determine which apps send traffic there. Switching to Global doesn't route every app on your device—the system proxy or VPN entry point must still be enabled separately.

Find the Proxy Group Used by Your Rules

Open the Proxies page and inspect the groups before trying individual nodes. The main selection group might be called PROXY, Node Selection, or something else; check how your subscription defines it. Expand the group and see whether it currently selects a node, an automatic selection group, or DIRECT. If there are nested groups, follow them until you can tell where the connection will ultimately go.

Run one latency test on candidate nodes and wait for it to finish before choosing. In a manual selection group, clicking a node usually marks it as selected. An automatic selection group may choose a node based on test results; what happens when you click depends on the group type. For initial verification, pin a working route in a manual group to avoid automatic switching complicating troubleshooting. To learn about types such as select and url-test, see Proxy Group Terms—there's no need to edit the configuration yet.

A Successful Reachability Test Doesn't Guarantee Web Access

A latency test typically checks how a node responds to a specific test URL; it doesn't measure the full experience of accessing every site from your device. A reported value means only that this probe got a response, not that download speeds, access to your destination, or every protocol will work. If a test times out, compare a few alternative nodes first rather than repeatedly testing every node. If all nodes fail, check your device's clock, subscription status, and basic network connection.

After choosing a node, keep Rule mode selected and note the main group and node name. Enable a traffic entry point in the next step. It's possible for the node test to succeed while your browser's exit IP stays the same: the system proxy may not be enabled yet. Node tests are initiated by the client; browser traffic depends on the network entry point the browser actually uses.

03 Connect and Route Traffic

First, make sure the client isn't reporting a core startup or configuration loading error. Some desktop clients start the core on launch; others require you to click Start or Connect. Running the core provides a local proxy service, but your browser can use it only when its network requests are routed through the right entry point. For initial setup, quit other software that changes system proxy settings or creates VPN tunnels to avoid conflicting changes.

Desktop: Enable the System Proxy

Find System Proxy on the client's home or settings page and turn it on. This usually points the system proxy address to a local listening port. Browsers without their own proxy settings typically follow the system setting. Keep the client running, then visit a test site in a new browser tab. Don't just refresh a fully cached page: without a new request, you may not see a corresponding entry in the connection list.

For initial setup, keep the client's default ports; there's no need to copy numbers from another guide. Clients may use different HTTP, SOCKS, or mixed ports. If you've set a proxy separately in a browser extension, terminal environment variable, or app, temporarily disable that setting before testing the system proxy. If you need to enter proxy details manually, use the listening address and port shown in your client. See Port Settings for details.

Some apps don't use the system proxy, so a browser working while an app shows no connection logs doesn't necessarily mean the node is broken. Finish the verification on this page before considering an in-app proxy or TUN. For Windows Store apps, see UWP Loopback. Don't enable multiple traffic-routing methods at once during your first connection.

Mobile: Approve the System VPN Connection

After choosing a configuration and node in the mobile client, tap Connect or Start. The first time you run it, the system will usually ask to set up a VPN connection or grant permission. Confirm the app's name and source, then allow access when prompted. Return to the client and check that it's running; also check the system VPN status to confirm the tunnel is established. This tunnel is how the client receives device traffic—it doesn't guarantee the node can reach your destination.

If another VPN is already connected, disconnect it before starting this client. Android battery optimization can interrupt background operation; during the first test, keep the client in the foreground or running normally instead of force-stopping it. iOS uses a different permission flow from Android, so follow the system prompts. There's no desktop-style System Proxy switch to look for.

Don't Add TUN to Your First Connection

TUN can handle more traffic that doesn't follow the system proxy, but it also involves a virtual network interface, routes, permissions, and DNS. If browser verification works and you later need to route traffic from other apps, follow the TUN chapter in the Beginner-to-Advanced Guide and enable settings one at a time. If problems start after enabling TUN, switch back to the entry point you already verified instead of changing rules and DNS at the same time.

04 Verify That the Proxy Is Working

Keep the same node and mode. Open the client's Connections page, then visit a known destination in a new browser tab. Return to the connection list and find the domain or address you just requested. Check its matched rule, policy group, and final node. Field names vary by client; focus on connecting what you requested with the policy that matched and the route it took—not just the running switch on the home page.

Use Connection Logs to Check the Route

In Rule mode, seeing DIRECT is a normal outcome. For example, a destination matched by a direct-connection rule shouldn't go through the proxy node you selected. If a destination you expected to proxy matches a direct rule, first check that the right configuration and mode are active, then inspect why the rule matched. Don't delete large numbers of rules. If the subscription's default policies don't suit your needs, use the client's supported override or merge features after connecting; see Custom Rules.

If no new connection appears, check that the connection list isn't filtered and that entries aren't disappearing as soon as requests end; the logs page may help. If the request is still missing, check the system proxy, app-specific settings, and VPN tunnel rather than repeatedly switching nodes. If the request reaches the core but fails, use the logs to distinguish a DNS resolution failure, connection timeout, or destination refusal. Remove subscription URLs, credentials, and unnecessary browsing history before sharing logs.

Use Your Exit IP as a Secondary Check

Visit a familiar exit IP lookup site in your browser, note the result, and compare it with the policy shown on the Connections page. In Rule mode, the lookup site itself may match a direct rule, so seeing your local exit IP alone doesn't prove the proxy is broken. For a comparison, temporarily switch to Global mode, explicitly select the same working node in the global selector, and run the lookup again. Check the connection log to confirm the request used that node.

Switch back to Rule mode after the comparison. The displayed region for an exit IP can be affected by database updates, so don't judge a node by its listed location alone. The final node, request result, and change in exit IP together provide a more reliable picture. A single page load also isn't a measure of long-term connection quality; verify the route first, then observe everyday performance.

Troubleshoot a Failed Connection One Layer at a Time

If your browser can't open any pages, turn off the system proxy or disconnect the mobile VPN tunnel first, then check whether the basic network works. If connectivity returns after stopping the client, check in this order: configuration loaded, node reachable, entry point correct, rules behaving as expected. Change one thing at a time and retry the request so you can identify what affected the result. For the full troubleshooting workflow, see the Connection Troubleshooting Guide.

After verification succeeds, note the active configuration name, traffic entry point, and main group selection, then set an appropriate subscription update schedule. Remote updates may replace the original configuration; keep long-term customizations in a location the client preserves. Before closing the desktop client, turn off the system proxy or confirm the client restores the system settings automatically, so the proxy address doesn't keep pointing to a stopped local service.

To switch platforms or clients, visit the Download Center. To learn about proxy groups, rule order, and network modes, browse the Glossary, then work through the Beginner-to-Advanced Guide chapter by chapter.