Clash Setup Guide for Beginners

Before You Start: Get a Subscription and Check Your Network

To follow this guide, you need an installed client and a Clash-compatible subscription link or config file from your provider. The client reads the config and forwards connections; it is not itself a proxy service. Installing the app without a usable config won't give you a remote exit node. A subscription link is usually a full URL and may contain an account identifier. Treat it as private information—don't post it in public comments, screenshots, or online conversion tools.

Before importing, make sure your device can reach websites that normally connect directly. If your current network is offline, the subscription download and connection test may both fail, making it hard to pinpoint the problem. For your first setup, let only one client route traffic. If another VPN or proxy app is already installed, disconnect it first; there's no need to uninstall it just for testing. Success means you can open the target website and the client log explains how the request was routed—not just that a switch turned green.

Step 1: Import the Subscription and Set It as Active

Open the client and go to Config, Profiles, or Subscription. Find the add, create, or import option, choose import from URL, and paste the full subscription link from your provider. You can give it a helpful local name; this won't affect the connection. Check that the link has no extra spaces, line breaks, quotation marks, or text added by a chat app, then select Save, Download, or Import and wait for the result.

After a successful import, the page usually shows a new config with its name, last update time, or an update button. Select the config or choose Enable or Use this config to make it active. Saving the link to a list doesn't necessarily load it into the core. Open the Proxy page and check that the config's policy groups and nodes appear without parsing errors before moving on. Some clients activate newly imported configs automatically, but it's still worth checking.

If you have a local YAML file, use the import from file option to select it. Don't paste the entire file into the subscription URL field. Local files usually don't receive automatic updates from your provider; follow their instructions to reimport or replace the file when you need an update. Confirm that the imported config is enabled. A matching file extension doesn't guarantee compatibility—the contents may still use a config structure your core doesn't support.

Import Failed? First Find Out Where It Failed

If you see a download failure, connection timeout, or address unavailable error, check whether the link has expired, whether your provider's website opens, and whether your current network can reach the subscription URL. On a first import, the client may not have a working proxy yet, so don't assume you can download the subscription through a connection that isn't set up. If the download completes but you get a YAML parsing error, unknown field, or unsupported proxy type, check compatibility between the subscription format and client core. Login pages, error pages, and links made for other clients aren't valid Clash configs.

Repeatedly clicking Update won't help you find the cause, and you shouldn't send a private subscription link to strangers for troubleshooting. Note the error type, check where the link came from and which format you selected, then try once more. For more details, see Frequently Asked Questions. Before continuing, make sure both conditions are met: the config appears in the list, and its contents appear on the Proxy page. Then choose a mode so you don't keep working with an old config.

Step 2: Choose Rule Mode and an Exit Node

Open the client's mode settings and select Rule, Rules, or Rule mode. This option is usually on the home screen, at the top of the Proxy page, or under the operating mode settings. Rule mode uses the config's rules to decide whether each connection goes direct, through a policy group, or gets rejected. It's a good starting point for a first setup. Don't edit the rules file or change several mode-related switches at once. Get the existing config working first so you have a reliable baseline.

Global mode generally sends connections that reach the core and aren't handled specially to the global policy group. It doesn't automatically route every app on your device through the core. Direct mode is mainly useful for testing direct connections. In short, the mode decides how intercepted traffic is routed; the system proxy or mobile VPN decides which traffic reaches the core. These are separate settings. Switching to Global without enabling traffic routing may leave your browser bypassing the client entirely.

Next, open the Proxy or Proxies page and find the policy group used for your main proxy traffic. It might be called Node Select, Proxy, or something customized by your provider; names aren't standardized across clients. Open the group and choose an available option. For your first connection, pick a clearly identified remote node. If you select another policy group, check its next level to see which node is actually selected. If the final choice is DIRECT, that connection will bypass the proxy and won't test whether a remote node works.

Choose a Working Node—Don't Chase the Lowest Test Result

Run the client's connection or latency test once for a candidate node. A timeout means the test request didn't finish within the time limit, but the cause could be an unreachable node, an unreachable test target, or a temporary network issue. It doesn't necessarily mean the entire subscription is invalid. Try another node and keep one that completes the test. Even a successful result only confirms that the test route worked at that moment; you'll still need to verify access in a browser.

If the config already has automatic selection, failover, or policy groups for different purposes, leave the other groups as they are and check only the main group used by your target connection. Don't set every group to the same exit node; that could override your provider's routing design. Policy group nesting, automatic switching, and rule priority are advanced topics. Once the connection works, see the Advanced Config Guide. You're ready to continue when Rule mode is selected and the main policy group has a clearly identified exit node.

Step 3: Connect and Route Traffic Through the Client

Return to the client's home screen and confirm that the core is running. Some desktop clients start the core automatically; others require you to select Start or Connect. If the app reports a config loading failure, a port conflict, or a service that isn't ready, fix that first. If the core isn't running, enabling the system proxy could send browser requests to a local port with nothing listening, making websites that previously worked inaccessible.

For your first desktop test, enable the system proxy. The switch may be on the home screen or settings page, or in the context menu for the tray or menu bar icon. Once it's on, test with a browser that follows system proxy settings. You don't need to enter a port manually in the operating system settings. If your browser has a proxy extension or a manually configured proxy or PAC file, check that it isn't overriding the system settings. An enabled switch only means the client tried to apply the setting; it doesn't prove every app is using it.

On mobile, tap Connect and approve the system VPN configuration or connection request the first time it appears. Return to the client and make sure the connection stays active instead of immediately dropping back to disconnected. A VPN icon in the system bar means the routing interface is established, not that the remote node is working. If the system denies permission, another VPN is already connected, or device management restrictions block the feature, resolve the permission issue or conflict before testing further.

For Your First Test, Don't Add TUN or Other Network Changes

TUN routes traffic at the virtual network adapter level and usually requires extra permissions and routing settings. For a first desktop check in a browser, the system proxy is easier to troubleshoot. Don't enable TUN, change DNS, and add firewall rules all at once just to make the status look complete. Consider TUN only after the browser works through the proxy and you need to route an app that ignores system proxy settings. Using the system VPN interface on mobile doesn't mean you also need a TUN switch with the same name.

After connecting, open a new browser tab, visit a website, and check whether activity appears in the client's connection list. Terminals, games, and some standalone network apps may not use system proxy settings, so they're not good choices for your first test. If the browser works but command-line tools still connect directly, keep the working config and see Frequently Asked Questions for details on which apps are routed. Don't keep switching nodes when the current one works. At this point, the config, exit node, and traffic routing are in place; next, confirm the request in the logs.

Step 4: Verify the Website, Matched Rule, and Exit Node

First, use a browser to visit a website you know should connect directly and confirm that your basic network is working. Then visit the target site that should use your selected exit node. Open a new tab and reload the page so you don't mistake an already-open page or cached content for a successful connection. Loading the target page is the first check, but it doesn't show which exit node handled the request. The main page, images, and API calls may also match different rules.

Next, open the client's Connections or Logs page and reload the target site. Look for a record matching its domain or destination address. Fields vary by client, so focus on the destination, matched rule, policy group, and final exit node. If the record shows that the request matched a rule and went through the proxy chain you selected, and the page loaded, the connection passed the test. If it clearly shows DIRECT, the request bypassed the proxy. Check the mode and rules instead of assuming the node is working.

For an additional check, visit a trusted IP lookup service and note the exit information it reports. In Rule mode, the lookup site's own request may be routed by the rules, so the result only reflects that request's path. If it still shows your local network's exit, that doesn't prove every other destination bypassed the proxy. Likewise, a changed exit IP doesn't mean every app on your device is being routed through the client. Use the target request's connection log as the primary check and the IP lookup as supporting evidence; together, they're more reliable than a status switch alone.

Connection Test Failed? Check the Config, Exit Node, and Routing in Order

If there's no matching connection record at all, first confirm that the right config is active and the core is running, then check that the system proxy or mobile connection is still enabled. Also check whether a browser extension is using its own proxy settings. An empty list may simply be filtered or cleared after a short retention period. Remove any filters and watch the list while reloading the page. Only after ruling these out should you assume the request never reached the core.

If a record appears but the connection times out, check that its final node matches the one you expected, then try another working node with the same destination. If only one website fails, don't change all your network settings right away. If several proxy destinations fail, check the subscription, remote nodes, and current network. Treat DNS errors, certificate errors, and connection refusals separately; they have different causes. When asking for help, include your operating system, client name, and steps to reproduce, but remove subscription URLs, account details, and other private information.

After verification, note the active config name, operating mode, and main policy group selection. Change only one setting at a time from here on. You can add startup behavior, scheduled updates, per-app routing, and DNS optimizations later; there's no need to set everything up on your first connection. If you're still stuck, see Clash Frequently Asked Questions. To learn about rule sets, Fake-IP, or merging multiple subscriptions, continue to the Advanced Config Guide. You're done when the target site loads and the connection log shows the expected route.