Clash Setup Guide: Import a Subscription and Test Your Connection

Before You Begin: Install a Client and Get a Compatible Subscription

The goal of this guide is to establish a repeatable connection; you don't need to understand the entire YAML file first. Before you begin, get two things ready: a client that matches your operating system and processor architecture, and a Clash- or mihomo-compatible subscription URL from your provider. If you haven't installed a client yet, choose your platform on the downloads page. For installation permissions, system extensions, and other details, see the cross-platform installation and setup guide. A subscription is not an account included with the client, and installing the app won't automatically provide working nodes.

Open a website you can normally access directly to make sure your Wi-Fi, Ethernet, or mobile connection is working. Then quit any other proxy clients or VPNs that are intercepting traffic, so they don't compete to change your system proxy, routes, or DNS. If your work device is managed by your organization, don't override its network settings; first check which connection methods are allowed.

A subscription URL may contain account identifiers, so treat it like a password. Copy it using your provider's “Copy subscription” option. Don't use the URL of an account management page, and never post the full link in a public forum. The four steps below use one configuration and one node. Leave listener addresses, LAN sharing, and custom rules unchanged for now so any issues are easier to trace.

Step 1: Import a Subscription and Activate the Configuration

Open the client's Configuration or Subscription page and look for “New,” “Add subscription,” or “Import from URL.” Paste the subscription URL you copied into the link field, and check for spaces or line breaks at either end. If there's a name field, enter something recognizable, such as “Daily setup.” The name is for local organization only; it doesn't change the nodes returned by the server. Click “Import” or “Download,” then wait for the client to fetch and parse the subscription.

After a successful import, the configuration list usually gains a card or entry showing details such as its name and last updated time. Click “Use,” “Activate,” or the selection button, then open the Proxy page. Some clients activate a configuration automatically; others save it without selecting it. Don't rely on a success notification alone: check that the active configuration has changed and that the Proxy page shows the nodes and proxy groups defined in it.

If your provider supplied a local .yaml or .yml file, choose “Import from File” and activate it after importing. A complete configuration usually includes nodes, proxy groups, and rules; a snippet containing only a few node fields may not work on its own. Don't delete indentation or rule sections just to get past a parse error. First confirm the file is intended for your client and the mihomo core.

If the list is empty, first determine whether the download failed or the configuration couldn't be parsed. A failed download is often caused by an expired URL or an unreachable subscription service. A parse failure may mean the server returned a web page, the format is incompatible, or the current core doesn't support a field. Don't keep pasting the same URL and creating duplicate configurations. Note the field name and line number in the error, then check subscription import issues. Before sharing an error, remove the subscription URL, node passwords, and account details.

Step 2: Choose a Rule Mode and Proxy Node

Find “Operating mode” or “Mode” and set it to “Rule,” often shown as Rule in English. Rule mode uses the active configuration to decide whether each request goes direct, through a proxy, or is blocked. It's a good choice for your first setup and makes it easier to check behavior in the connection log. Note that operating mode and TUN are separate settings: the mode determines how traffic is routed, while TUN determines which traffic enters the client. Enabling one does not replace the other.

After switching modes, open the Proxy or Proxy Groups page and expand the main proxy group. It might be called Proxy, Node Selection, or something else chosen by the subscription author. Check the available options and select a specific node, or choose an Auto Select group that contains working nodes. If the current selection is DIRECT, requests matched to that group will connect directly. If you choose another proxy group, inspect the next level until you confirm the final outbound node.

Click the test button next to a node, or choose “Test All” to check whether your current network can complete the test request. A result only shows that the test destination was reachable at that moment; it doesn't guarantee that every website or app will work. A timeout may also be caused by the test URL. For your first setup, don't keep switching nodes to chase the lowest latency. Choose one that passes the test, then verify it with real traffic in step four. If a location or service restriction applies, choose a different outbound node for that specific use.

Global mode usually sends requests that enter the client to the global proxy group. You can briefly use it to compare behavior while troubleshooting rules, but it doesn't automatically intercept traffic from every app; desktop apps may still bypass the system proxy. Direct mode usually sends requests entering the client straight to their destinations, so it isn't useful for testing proxy nodes. If you test Global mode, switch back to Rule afterward and check that the primary proxy group selection is still in place.

Don't add rules from unknown sources at this stage or copy someone else's proxy group names into your configuration. Every target referenced by a rule must exist in the active configuration; otherwise, it may fail to load or route traffic unexpectedly. For a full explanation of rule order, domain matching, and fallback rules, see the rule configuration guide. For your first setup, keep the subscription's original rules and confirm the proxy group's outbound node.

Step 3: Enable the System Proxy or Mobile VPN

On desktop, make sure the client is running, then enable “System Proxy” or “Set as System Proxy.” In ClashX, use the menu bar icon to open the relevant menu; other clients usually have a toggle on the home or settings page. Once enabled, browsers and apps that follow the system proxy send requests to the local listening port. Closing the main window doesn't always quit the process, but quitting the client stops the local listener. Keep it running while you test the connection.

With a desktop client, the system proxy address is usually set automatically, so you don't need to enter it again manually. If your browser has a proxy-switching extension, set it to follow the system settings or temporarily disable its proxy feature so it doesn't point to a different port. Also check for older clients still running in the background. If two apps compete for the same listening port, the interface may show the proxy as enabled even though binding failed.

For your first connection, leave TUN off and verify everything with the system proxy. TUN can capture traffic from apps that don't follow the system proxy, but it may require administrator privileges and change virtual adapters or routes. If your browser works through the proxy but a game or command-line tool doesn't, the issue is more likely to be how its traffic enters the client than a broken installation. Test the browser first, then choose an explicit proxy or TUN for the target app using the platform guides.

Android and iOS work differently: tap “Connect,” “Start,” or the power button on the client's home screen. The first time, the system will ask for VPN permission. Make sure the prompt is from the client you installed, then allow the connection and check its status in the app. The VPN icon in the status bar only confirms that traffic interception is active; it doesn't guarantee that the selected remote node works. Verify access in the next step. If another VPN is already connected, decide which one you need rather than repeatedly switching between them.

To check the port, open the client's port settings or the active configuration and look for the mixed port. A common value is mixed-port: 7890, but use the value shown by your client rather than overriding it just because a guide uses a particular number. A mixed port accepts both HTTP and SOCKS proxy requests. When configuring another app to use a proxy, check the address, port, and proxy type. Local connections usually use 127.0.0.1; you don't need to enable “Allow LAN.” For details, see mixed port settings.

Step 4: Verify Access and Rule Matches

Return to your browser and open a site that should connect directly to confirm your basic network still works. Then visit a destination that should use the proxy under your current configuration. Test one page at a time; if needed, use a new private window to reduce interference from browser cache and extensions. Don't rely on the client icon's color or a single page load. Check both the result and the client log to distinguish a successful proxy connection from direct access or a cached page.

Open the client's Connection page and look for the relevant domain or destination while you refresh the page. If the client shows the rule, proxy chain, or outbound node, check each in turn: did the request enter the client, which rule matched, which proxy group handled it, and which node was ultimately selected? For example, if a domain expected to use the proxy shows DIRECT, review its rule and proxy selection. If it shows the proxy group and selected node but the connection still fails, check the node and destination service.

If there's no connection list, open the Logs page and use the standard information level to watch requests as they happen. Some clients don't show every connection detail at the default log level, so a missing entry alone doesn't prove that the request never reached the core. Raise the log level briefly if needed, then restore it. Before sharing logs, remove subscription URLs, authentication details, and sensitive browsing records. Don't upload the full, unedited configuration.

If a page won't load, review the first three steps in order. Make sure the configuration is still active, then try the same test with another node. Next, check whether another app has overwritten the system proxy, and finally verify which rule matched the domain. If every test destination fails, check traffic interception and the node first. If only one site fails, check the site's status, the outbound location, and the specific error. Change one thing per test and note the result to avoid changes canceling one another out.

Command-line testing is optional, not a requirement for your first setup. If you're on desktop and have confirmed the mixed port is 7890, run the command below to send this request explicitly through the local HTTP proxy. On Windows, use curl.exe to avoid command alias differences in some terminals. This only tests the proxy entry point and result for that request; it doesn't mean the entire operating system or every app is using the proxy.

curl --proxy http://127.0.0.1:7890 --head https://example.com

If the command can't connect to the local port, check the listening port and make sure the client is running. If the local port responds but the remote request fails, check the node and logs. An HTTP response means the request received a response; it doesn't have to return a particular status code. If you see a certificate warning, don't disable verification. Check the system time, destination certificate, and network, then see Troubleshooting in the Help Center.

Disconnect and Everyday Use: Keep a Working Configuration

After verifying the connection, note the active configuration name, operating mode, and primary proxy group selection. To switch nodes later, just change the relevant proxy group; you don't need to import the same subscription again. After updating a subscription, check that your current selection still exists. If your provider removes or renames a node, the previous selection may stop working. Avoid saving long-term rules by editing files generated from a remote subscription; an update may overwrite your changes.

To pause a desktop proxy, turn off the system proxy before quitting the client. Otherwise, the system may keep pointing to a local port that is no longer listening. On mobile, use the client's Disconnect button to end the VPN connection. If websites stop working after you quit, check for leftover system proxy or browser extension settings before restoring network settings. Don't delete the configuration right away; it contains useful context for reproducing the issue.

For startup options, see the startup guide. For Windows permissions and traffic interception, see the Windows installation and setup guide. Advanced settings for LAN sharing, custom routing, and TUN are covered in the documentation. Once your first connection is stable, enable these features one at a time and repeat step four's checks after each change.