Clash Setup Guide
Import a Subscription and Connect in 4 Steps

Start by getting your subscription link. Log in to your provider's user dashboard and find the section labeled "Subscription Link," "Subscription," or "One-Click Subscribe," then copy the long address starting with https://. Copy the whole string — it often ends with a parameter block, and missing even a few characters will cause the import to fail. If the dashboard offers a "Clash-specific subscription" option, use that one, since it outputs a format Clash can parse directly.

Back in the client, go to the subscription page. On desktop it's usually in the sidebar, labeled "Profiles"; on mobile it's in the bottom tab bar or a side drawer. Near the top of the page there's an input field, or a "New / Import" button that reveals one when tapped. Paste the link you copied and click "Download" or "Import."

The client fetches the config file remotely, and within a few seconds a profile card appears showing the config name, node count, traffic info (if your provider supplies it), and last update time. Seeing the card means the fetch succeeded. One more action remains — select this card so it becomes active (highlighted border or a checkmark). Only then will the client actually use this profile. If multiple profiles exist, only the selected one is in effect.

If the fetch fails, the errors fall into two common categories: a timeout or connection error usually means your current network can't reach the subscription server; a 404 or format error usually means the link expired or wasn't copied completely — go back to the dashboard, reset the subscription, and copy it again. For what's actually inside a config file and how to manage multiple profiles, see the glossary; for a breakdown of error types, see Troubleshooting Subscription Update Failures.

With the profile in place, the next stop decides how traffic gets routed.

Clash has three basic proxy modes, switchable from a set of radio buttons at the top of the main screen or the "Proxies" page. Rule: traffic is matched against the rules in the config file one by one — routed traffic goes through the proxy, direct traffic bypasses it. This is the recommended everyday mode. Global: all traffic goes through the selected node with no distinction, useful for temporarily testing whether a node works. Direct: no traffic goes through the proxy at all, effectively a bypass. For a first run, switch to "Rule" mode and let the rule sets bundled in the subscription handle the routing logic.

With the mode set, pick a node next. Go to the "Proxies" page, where you'll see one or more policy groups — node groups pre-arranged by the config author, commonly named things like "Proxy Selector," "Auto," or "Proxy." Expand the main policy group and click the latency test icon (a lightning bolt or waveform symbol); the client will test every node in the group, and within a few seconds each one shows a millisecond value.

Select a node with a lower latency value. Generally, latency under three digits is fine for everyday use; a node marked "timeout" is currently unavailable and should be avoided. Latency only reflects handshake time, not raw bandwidth — that distinction, along with the differences between policy group types, has its own entry in the glossary.

How rule mode matches traffic line by line, what DIRECT and REJECT outbounds mean, and how to add your own rules are advanced topics not covered here — the full chapter is in the Beginner-to-Advanced Handbook. Mode and node are now set, but traffic hasn't actually been handed to the client yet — the next stop flips the main switch.

On desktop (Windows / macOS / Linux), the key switch is called "System Proxy," located prominently on the client's home screen or settings page. Turn it on, and the client writes its local listening address (typically 127.0.0.1:7890, though the exact port is shown in the client UI) into the OS proxy settings. From this moment, your browser and any app that follows the system proxy will route traffic through Clash first, then out according to the mode chosen in the previous step.

Two visual signals confirm the switch is active: the client icon in the system tray (bottom-right on Windows) or menu bar (top-right on macOS) changes to an active color; and the traffic graph or up/down speed numbers on the client's home screen start moving — as long as some app is online, the numbers won't stay at zero.

Mobile works differently. On Android, tap the connect button on the main screen; the first connection triggers a system-level VPN authorization prompt — tap "Allow," and a key or VPN icon appears in the status bar, confirming traffic is being handled; subsequent connections won't prompt again. Clash Plus on iOS works the same way — the first time you start the proxy, it asks to add a VPN configuration, which you confirm once in the system dialog.

One boundary worth knowing: the system proxy only covers apps that "follow system proxy settings" — command-line tools and some client software ignore it by default. To capture all traffic, you need TUN mode, which operates at a lower level through a virtual network adapter — see how it works and how to enable it in the TUN Mode Setup Guide, with a fuller explanation in the handbook's TUN chapter. You don't need TUN for a first setup — the system proxy is enough to cover browser use cases.

The toggle is on and the icon is lit, but that doesn't guarantee it's actually working — the final stop runs a check.

The most direct check: open a browser and visit a site whose behavior normally reflects your connection route. If the page loads normally and at an acceptable speed, the proxy path is basically working. To avoid cache interference, test in a private/incognito window.

Then look for evidence inside the client itself. Go to the "Connections" page, where new entries should keep appearing, each showing the target domain, the matched rule, and the actual outbound node name. If you see the target domain paired with the node you selected in step two, that's solid proof traffic is going through the proxy; if every entry shows DIRECT as the outbound, the sites you're currently visiting are all being routed direct by the rules — try a site that clearly needs the proxy instead.

If you're comfortable with the command line, you can explicitly specify the local proxy port and send a request in a terminal:

curl -x http://127.0.0.1:7890 -I https://www.example.com

A response header starting with HTTP/2 200 or similar means the request successfully passed through Clash's proxy port; if it hangs or reports connection refused, the port is wrong or the client isn't listening — go back to step three and double-check the port number.

If verification fails, work through this order: go back to the proxy page, retest latency, and switch nodes; confirm the mode isn't stuck on "Direct"; then check whether the system proxy toggle is actually turned on. If it's still not working after these three steps, go through the nine-point checklist item by item, or find the matching issue in the troubleshooting category of the FAQ.

With all four stops covered, everyday use is set up. Two small follow-ups worth doing: set an auto-update interval for the profile on the subscription page so node info doesn't go stale; and turn on launch-at-startup in settings so the client is ready as soon as the system boots. The handbook has a section covering recommended values and where to find each setting.