Basic Clash Setup: From Subscription Import to Connection Testing

CONFIG INPUT

Import the Subscription and Select the Configuration

After opening the client, find the Config, Subscriptions, or Profiles page. Desktop clients usually place it in the left navigation, while mobile clients may put it at the top of the home screen or in a side menu. Locate the subscription URL field, paste the full URL, and select Import, Download, or the add button. If a name is required, enter a short, recognizable label such as “Daily Profile.” This name is only for local identification and does not change the subscription.

After submitting, wait for the download to finish and do not click Add repeatedly. A new entry should appear in the configuration list, usually with its last update time or availability status. Select the entry to make it active. Some clients activate a profile automatically after import, but check the selection indicator anyway: “downloaded” and “active” are separate states.

Next, open the Proxies page. You should see policy groups containing nodes, automatic selection options, or DIRECT. The presence of policy groups confirms that the core has loaded the configuration. If the configuration appears in the list but the Proxies page is empty, return to the profile list, verify that it is selected, and update it once. If the page remains empty, do not enable System Proxy; otherwise, traffic may be routed through an incompletely loaded configuration.

How to Import a Local Configuration File

If you received a YAML file, use Import from File, Open Configuration Directory, or the drag-and-drop area. After importing it, select it in the configuration list and confirm that policy groups appear on the Proxies page. Do not edit cache files managed automatically by the client, because subscription updates may overwrite them. For long-term custom rules, first learn how configuration merging or overrides work. See the installation guide for platform paths and configuration structure.

ROUTE SELECT

Choose Rule Mode and Configure Policy Groups

Once the configuration is active, open Mode or Proxy Mode settings. For a first setup, select Rule mode. Requests are then matched against the configuration's rules in order: local destinations use DIRECT, destinations requiring a proxy enter the specified policy group, and blocked connections are rejected. This lets you inspect Routing Rules without sending all traffic through the same outbound route.

Global mode sends most connections through one proxy policy. It can help identify a missing rule, but it is not a good default for evaluating a first-time setup. Direct mode bypasses the proxy and is useful for confirming that the local network works without it. Labels may vary, but look for the equivalents of Rule, Global, and Direct. Avoid switching modes repeatedly before completing basic verification, as the connection records will mix results from different modes and become harder to interpret.

After selecting Rule, open the Proxies page and inspect the policy groups. Common configurations include groups labeled Proxy, Select, Auto, or by purpose. Choose a responsive node in the primary manual selection group. If the configuration uses an automatic policy group, you can leave it on automatic, but confirm that the group contains candidate nodes. Policy groups may reference one another, so an outer group showing Auto can still depend on another group to select the actual outbound node.

Use Latency Only as an Initial Filter

You can run one latency test, but do not simply choose the lowest number. A latency test usually measures connection time to a specific probe URL and does not fully represent page loading, video delivery, or long-lived connection stability. For the initial setup, select a node that completes the test without repeated timeouts, then adjust it later based on real browsing performance. If every node times out at once, check whether the subscription has expired, the device clock is accurate, or the current network restricts these connections instead of testing each node repeatedly.

SYSTEM ENTRY

Enable System Proxy and Establish a Connection

Return to the client's home screen or settings and find System Proxy, Set as System Proxy, or a similarly named switch. On desktop, enable this first for the initial setup. It sends traffic from browsers and applications that honor system proxy settings through Clash. Confirm that the switch stays enabled and that no port conflict or permission error appears. Keep the client running; do not immediately close it or let a background cleaner stop the process.

Android and iOS clients usually capture traffic through the system VPN interface. After you tap Connect, the operating system displays a VPN connection request. Approve it, and a VPN indicator should appear in the status bar. This only confirms that the system tunnel is active; it does not prove that the proxy node works, so complete the verification step next. If the connection is rejected, check whether another VPN app is already using the tunnel. Most devices allow only one active VPN connection at a time.

Whether a Linux GUI client can set the system proxy directly depends on the desktop environment and permissions. If the browser produces no traffic records after you enable the option, check whether proxy settings were written to the browser or desktop network configuration. Command-line programs often ignore desktop proxy settings and require environment variables or TUN. For these Platform Deployment details, continue to the Linux installation section.

When to Consider TUN Mode

Use System Proxy first to test standard applications such as browsers. Some games, command-line tools, and applications that ignore system proxy settings will not use this entry point; consider TUN only for those cases. TUN captures network traffic at a lower layer and covers more applications, but it depends more heavily on drivers, administrator permissions, routing, and DNS configuration. Get System Proxy working first, then test TUN separately. If you enable multiple traffic entry points from the start, it becomes difficult to identify which layer caused a loss of connectivity.

Before switching from System Proxy to TUN, disable the previous entry point or check the client's documentation to confirm whether both can be used together. If TUN triggers a permission prompt, grant the required platform permissions and restart the client. Service mode, virtual adapters, and DNS interception are outside this 10-minute workflow; see the Complete Cross-Platform Installation and Configuration Guide for details.

RESULT CHECK

Verify Rule Matches and Network Recovery

After connecting, close any test pages already open in the browser. Open a new tab and visit a website that normally works over a direct connection. Then return to Connections, Logs, or a similarly named page in the client and find the domain you just opened. The record typically shows the destination, matched rule, policy, and actual node. A DIRECT match confirms that the direct route works. If the configuration should send the site through a proxy group, confirm that the displayed rule and policy match that expectation.

Next, visit a destination that should use the proxy under the current configuration and inspect the connection record again. The key question is not simply whether the page opens, but whether the request matches the intended policy. Browser caching can make an old page appear functional without generating a new request. Refresh it, load a new resource, or retest in a private window. Browser output alone cannot distinguish a working proxy from a cache hit or direct connection.

If the record shows that the request entered the proxy policy but the page still does not load, switch the policy group to another node that passed testing and retry the request. If that fixes the issue, the original node is the likely cause. If several nodes behave the same way, investigate DNS, the device clock and certificate validity, network restrictions, or configuration rules. For connection timeouts, DNS failures, and stale system proxy settings, follow the categories on the FAQ page.

Run a Disconnect Test

After verifying the proxy path, disable System Proxy or disconnect the mobile VPN. Then open a regular website and confirm that the device returns to its normal local network. This test can expose stale system proxy settings. If all websites stop working after the client exits, the operating system may still be using the old proxy address. Reopen the client and disable System Proxy normally; this is usually more effective than deleting the configuration.

Finally, reconnect and confirm that the client can reproduce the same path. One successful connection only proves that the setup worked at that moment. The basic setup cycle is complete only when you can disconnect, restore normal local networking, and reconnect successfully. You can then test other policy groups, automatic selection, and TUN one at a time, verifying each result in the connection records.