Clash Setup Guide: From Subscription Import to Verified Connection

A subscription link is an https URL that the client fetches periodically to get the full node list and routing rules — no need to add nodes one by one. Copy it from your provider's user dashboard, and copy the whole thing to the very end: one missing character or extra space and the import fails. What the underlying YAML structure looks like is covered separately in the setup section of the FAQ.

With the link copied, open the client and find the profile management page. Entry-point names by client:

After you tap import, the client downloads the subscription content, and within seconds a profile card appears on the page — usually showing the profile name, node count or file size, and last update time. Seeing the card means the import succeeded. Tap the card to set it as the active profile; it'll show a highlighted border or checkmark. Some clients auto-activate a fresh import, so just confirm the selected state is showing.

If the import spinner ends in an error, the three usual culprits are: an incomplete link, an expired or depleted subscription, or the server requiring a client tag parameter like &flag=clash at the end of the link. If it still fails after checking each of these, work through the subscription-failure section of the Troubleshooting Guide — it beats retrying blindly.

Another scenario: your provider hands you a .yaml file instead of a link. Every client also supports "import from file" at the same entry point — just pick the local file. The difference is that updates require manually replacing the file afterward. If you imported via link, set the auto-update interval to roughly 24 hours in the profile card's settings so node changes are picked up automatically.

Once the profile is active, don't rush to enable the connection yet — check the proxy mode first. It decides which traffic goes through the proxy and which connects directly. The switch usually sits on the home page or "Settings" page, with three options:

Pick Rule mode most of the time: local sites connect directly without detours, and traffic that needs a proxy follows the rules to a node — balancing speed and reliability. Global mode is only meant for temporary use, since routing everything through a node actually slows down local sites. For how a rule is written and what DOMAIN-SUFFIX and GEOIP mean, the Troubleshooting Guide has a full reference — no need to repeat it here.

With the mode set, head to the "Proxies" page to pick a node. Find the group named Proxy or "Node Selection" and open it to see the full node list. Tap the latency test button first (usually a lightning bolt or waveform icon) and wait for a millisecond figure to appear next to each node — lower means faster response. Pick one that's low and stays consistent across a few tests; skip anything showing timeout. If the profile includes an "Auto Select" group, that works too — the client switches automatically based on test results, saving you the manual pick.

With a node picked, go back to the home page and turn the connection on. Desktop and mobile handle traffic takeover differently, so let's cover them separately.

Windows / macOS / Linux

Turn on the "System Proxy" switch on the home page. This points the OS's HTTP/HTTPS proxy at the client's local listening port (typically 7890 or 7897 — the home page shows the exact number), and browser and most app traffic then flows through Clash. Two things to note: some command-line tools ignore the system proxy and need separate environment variables, and a few apps ignore it entirely — for those, switch to TUN mode to take over traffic at the network layer instead. Both mechanisms and how to enable them are covered in full in the system-proxy section of the Troubleshooting Guide; for a first-time setup, the system proxy alone is enough.

Android

Tap the connect button on the home page, and the system shows a "VPN connection request" prompt — this is Android's VpnService mechanism, which Clash uses to build a local tunnel and take over traffic. Just tap "OK." A key icon appears in the status bar once granted. If it disconnects automatically after running in the background for a while, the system's battery-saver has likely killed it — add the client to the battery-saver whitelist.

iOS

The first connection prompts "Add VPN Configuration." Confirm in the system dialog and verify with your passcode or Face ID, and the VPN toggle at the top of Settings lights up. After that, you can connect and disconnect directly from the client without going to system settings each time.

Once the switch is on, the upload/download rates and traffic stats on the home page should start showing numbers. Staying at zero isn't necessarily a problem — no app may be using the network right now. Whether it's actually working gets verified next.

Check 1: Browser test. Visit a site that previously wouldn't load — if it loads now, the connection is basically working. At the same time, open the client's "Connections" or "Logs" page: each visit adds a record showing the target domain, the matched rule, and the node used. A record with a non-empty node field confirms traffic actually went through Clash rather than direct connection.

Check 2: Command-line test (desktop). Swap in the listening port shown on your home page and run:

curl -I -x http://127.0.0.1:7890 https://www.google.com

A response header like HTTP/2 200 means the proxy port is working; hanging or a connection refused error means the port isn't listening or is taken by another program.

Check 3: Exit IP test. Open any IP geolocation lookup page — the region shown should match the selected node's location, not your local ISP. If the IP checks out but some sites still misbehave, it could be a DNS leak or a rule mismatch — the DNS section of the Troubleshooting Guide covers detection methods and fake-ip configuration.

If any of the three checks fails, match your symptom to the right section of the Troubleshooting Guide: no internet at all, every node timing out, or slow speeds each have their own chapter and process — much faster than blindly reinstalling. If all three pass, setup is done — just leave the client running in the background, and the subscription will update automatically at the interval you set.