Clash Setup Guide: From Importing a Subscription to Verifying It Works

Before starting, make sure you have two things ready: a Clash client already installed, and a working subscription link. No configuration happens in this step — it's just prep. Once you've got both, every step after this is straightforward.

Install a Client

If you don't have a client yet, head to the client downloads page and grab the installer for your platform — Windows, macOS, Android, iOS, and Linux are all covered, and installation works just like any other app. Not sure which one to pick? Check the client comparison — for beginners, the differences are mostly in interface layout; core features are the same, and this guide's four steps apply no matter which one you choose.

Get Your Subscription Link

A subscription link is a URL starting with https://, provided by your subscription service (often called a "proxy provider") in their dashboard — usually behind a "Copy Subscription" or "One-Click Subscribe" button that puts it straight on your clipboard. This link points to a config file that updates as your provider changes it, containing your nodes and routing rules — that's why you're importing a "link," not a static file; the client will periodically pull the latest version from it. You don't need to worry about the YAML vs. Base64 format differences right now — the client detects that automatically on import. If you want the details, check the "Subscriptions & Configs" section of the glossary.

With everything ready, open the client and turn that clipboard link into an active config. It's four quick actions, about a minute total.

1. Double-check the full subscription link is on your clipboard. Always use your provider's official "Copy Subscription" button — manually selecting the text often clips off trailing characters or picks up extra spaces, which is by far the most common cause of import failures.
2. Open the client's subscription page: in Clash Plus and Clash Verge Rev, it's labeled "Profiles" in the sidebar or bottom bar; in FlClash, it's "Config." You'll see a URL input field near the top, or an "Add / Import" button (a plus icon in the bottom-right corner for FlClash).
3. Paste the subscription link into the field and tap "Import" or "Download." The client fetches the config from that URL right away — on a normal connection, a new config card with a name and update timestamp should appear within seconds.
4. Tap that card to select it and make it the active config. Most clients highlight or check-mark the active card; some auto-activate the config right after import, in which case you'll just see it already selected.

How to tell the import worked: the config card shows an update timestamp, and often data usage and an expiration date too. Switch to the Proxies page — you should see a set of proxy groups with nodes listed under each. If the list isn't empty, the config loaded correctly and you're ready for the next step.

If the import fails or the Proxies page comes up empty, there are three usual culprits: an incomplete copy of the link, a subscription domain that's unreachable on your current network, or the provider having changed the subscription URL. Step-by-step fixes are in the "Setup Issues" section of the Help Center. If you're curious why YAML and Base64 subscriptions behave differently, or what subscription conversion actually does, check the relevant entries in the glossary — we won't get into that here.

Once the config is loaded, find the outbound mode switch on the home page or at the top of the Proxies page, get clear on what each of the three options does, then pick a working node. This decides where your traffic goes — worth two minutes to understand properly.

What Each Mode Does

• Rule: Traffic is matched against the routing rules in your config, one by one — sites that should connect directly do, sites that need the proxy use it, and anything unmatched falls back to a default rule. Stick with this mode for everyday use; it's also the default after importing a subscription.
• Global: All traffic goes through the selected node, no exceptions. Only useful for quickly testing whether a node works — leaving it on long-term routes traffic that should go direct through the proxy anyway, which just slows things down.
• Direct: All traffic bypasses the proxy entirely — effectively the same as turning the client off. Handy as a baseline when troubleshooting.

Just make sure the mode is set to Rule. The details of how rules get matched one by one, and what DOMAIN-SUFFIX, GEOIP, and MATCH each do, are deeper topics — the glossary's "Rules & Routing" section covers them entry by entry, and the full guide's routing chapter walks through it in detail. You don't need to understand any of that to follow this page.

Pick a Node and Test Latency

Switch to the Proxies page and you'll see several proxy groups. Find the one named something like "Proxy" or "Manual Select," then tap the lightning bolt (or speed test) icon next to the group name to test latency across all its nodes — within a few seconds, each node will show a number in milliseconds (lower is better), and any that time out will gray out or show timeout. Then tap a node with reasonable latency to select it. Groups named "Auto Select" or using url-test pick the fastest node automatically — no need to touch those, just leave them as-is.

With a node selected, the client is already listening on its local port — but your system isn't sending traffic to it yet. This step differs slightly by platform.

Windows and macOS

Find the "System Proxy" toggle on the client's home page or in settings, and switch it on. The client automatically points your OS proxy settings at its local mixed port — 127.0.0.1:7890 by default — no manual address entry needed. On macOS, the first time you turn this on, a system dialog may ask permission to change network settings; enter your password to confirm. Once the toggle turns green or highlighted, the system proxy is active.

Android

Android clients route traffic through a VPN tunnel: go back to the home screen and tap the main start button. The system will show a "Connection request" dialog asking to set up a VPN — tap "OK," and a key icon should appear in the status bar, confirming your device's traffic is now going through the client. iOS works similarly — just confirm the VPN configuration prompt the first time you connect.

Two edge cases worth flagging now: first, "System Proxy" only covers apps that respect system proxy settings — browsers do, but command-line tools and some desktop apps don't, and need TUN mode to be captured at the network level instead. That's an advanced topic covered fully in the TUN chapter of the full guide — no need to deal with it on your first setup. Second, if toggling the switch throws a port-in-use error (something like bind: address already in use in the logs), it means another program is already using port 7890 — see the "Troubleshooting" section of the Help Center for how to fix it.

A toggle being on doesn't guarantee anything's actually working. Spend one more minute on three checks to turn "looks enabled" into "confirmed working."

1. Open a new browser window and visit a site you normally reach without a proxy. In Rule mode, this kind of domain should hit the direct-connect rule, and it should load just as fast as with the proxy off — this confirms routing isn't accidentally sending direct traffic through the proxy.
2. Now visit a site that needs the proxy to load. If it loads fine, the node-to-exit proxy path is working end to end.
3. Back in the client, open the Connections or Logs page. It shows a live feed of connections, each tagged with the destination domain, the rule it matched, and the exit it used — direct traffic should show DIRECT as its exit, and proxied traffic should show the name of your selected node or proxy group. This is the most reliable way to confirm routing is behaving as expected — far more reliable than just eyeballing whether pages load.

If step two doesn't load: first check the system proxy toggle or VPN key icon is still active; then go back to the Proxies page, re-run the latency test, and switch to a different node with normal latency — a single bad node is the most common cause, and switching usually fixes it. If several nodes in a row don't work, you'll need to work through the client → config → local settings checklist in order — the full troubleshooting path is in the "Troubleshooting" section of the Help Center. If an outdated GeoIP database is causing routing mismatches, the maintenance chapter of the full guide covers how to update it.

That's it — subscription imported, mode chosen, connected, and verified. From here on, daily use is just two actions: open the client, turn on the system proxy, and let the rules handle the rest. Your subscription updates automatically on schedule, so you rarely need to touch it — if your provider announces a new subscription URL, just repeat step 2 with the new link.

Want to go deeper? Custom rule syntax, full TUN mode setup, and GeoIP database maintenance are all covered chapter by chapter in the full guide — good for reading straight through when you've got time. Running into a specific error? Search the Help Center by category. Not sure what a term means? Look it up in the glossary, organized by topics like "Core & Protocols" and "Rules & Routing."