Clash Setup Guide

Before You Start

First, visit the client downloads page and choose an installer that matches your operating system and processor architecture. Install and open the client. If you already have a client and can reach its main screen, you can continue. On desktop, make sure the app has finished any installation prompts, permission requests, or core downloads. On mobile, let the app complete its initial setup; there’s no need to change system network settings in advance.

The client reads the configuration, applies rules, and routes traffic, but installing it doesn’t provide a working proxy by itself. You’ll also need a Clash-compatible subscription URL from your provider or a compatible local profile. A subscription management page, an account sign-in page, and the subscription URL are different things. Copy the Clash- or mihomo-compatible URL from your provider’s subscription section—not the account page URL from your browser’s address bar.

Before you begin, keep a network connection that can reach your subscription provider, and temporarily disconnect other proxy or VPN apps. This makes it easier to tell which app is handling traffic and helps prevent repeated changes to system proxy settings. If you already have a profile, back it up first, especially any custom rules or DNS settings. You don’t need to write YAML by hand or enable TUN to follow this guide; start with the client’s built-in import and connection features.

Step 1: Import a Subscription

Add a Remote Profile

Open the client’s “Subscriptions,” “Profiles,” or “Configuration” page and look for “Add,” “Import,” or a plus button. Choose an option such as “Import from URL” or “Remote Profile,” then paste in the subscription URL. If there’s a name field, enter something easy to recognize, such as “Daily profile.” This name is for local reference and won’t change the subscription. Check that no spaces, line breaks, or punctuation from your chat app were added to the beginning or end of the URL, then save or download it.

The client will fetch the remote content and parse the profile. On success, you’ll usually see a subscription card or profile entry; some clients also show when it was last updated. Don’t assume the import worked just because an entry appeared. Open the “Proxies” or “Proxy Groups” page and confirm that the provider’s proxies and groups are listed. If the page is still empty, check the download or parsing result on the profile page and fix any import errors before continuing.

Set the Active Profile

If the client supports multiple profiles, you may need to click “Use” or “Activate,” or select the profile, to make it active. Some clients activate a profile as soon as it’s imported; others only save it. After switching, the group names on the Proxies page should match the new profile. If you still see the old groups, check which profile is selected and reload it as prompted. Avoid changing the mode, ports, and DNS settings all at once; otherwise, it’s harder to identify what caused a problem.

If you only have a local YAML file, choose “Import from file” on the same page, select the file, and confirm. A local file usually won’t receive remote subscription updates; whether it changes later depends on the file and how the client manages it. After importing a remote subscription, try a manual update to confirm it works before enabling scheduled updates. An update replaces the profile with content from its source, so save custom changes using the client’s override or persistence features.

If you see a format error, download failure, or a message that the content isn’t a profile, check that you chose the right subscription format, then verify your account status and subscription URL. Don’t disable security checks to bypass an error, and don’t submit a URL containing account parameters to an unfamiliar conversion service. See the FAQ for common errors, or visit subscription troubleshooting if the problem persists. Once the profile is active and its proxy groups appear, choose a mode.

Step 2: Choose a Proxy Mode

Start with Rule Mode

Open the Home, Settings, or Proxies page and look for “Mode,” “Operating Mode,” or “Rule.” For a first setup, choose “Rule.” This mode uses the profile’s rules to decide whether requests go through a proxy, connect directly, or are rejected. Rule mode only determines how requests that reach the core are routed; it doesn’t automatically send traffic from every app to the client. You’ll enable traffic routing in the next step.

Global mode typically sends requests that reach the core through the selected global policy. It can be useful for a quick comparison while troubleshooting, but it shouldn’t replace checking your rules. Direct mode sends requests that reach the core straight to their destination. “Global” doesn’t mean the entire device is being routed through the client: an app that ignores the system proxy and isn’t routed through a virtual network adapter may bypass the client even in global mode. Keep Rule mode for now so you can test the routing defined in your subscription.

Choose an Outbound Policy

Open the “Proxies” or “Proxy Groups” page and find the main selection group in your profile. It might be called “Proxy Selection,” “Node Selection,” or something else; group names are set by the profile author and aren’t standardized across clients. Expand the group and choose a proxy you know is available. If the profile offers an auto-select group, you can choose that instead. Groups may reference one another, so check which proxy the auto-select group actually uses rather than relying on its top-level name.

You don’t need to adjust every group during a first-time setup. Keep the default relationships for groups such as streaming, downloads, and local network, and make sure the main group for everyday browsing isn’t accidentally set to Direct. A built-in connection test can be a useful first check, but success only means that the test destination was reachable through that route; it doesn’t guarantee every site or app will work. Don’t delete the profile just because one test fails: the test URL, current network, and selected proxy can all affect the result. Judge the setup using both real-world access and connection logs.

Return to the Home page and confirm that the correct profile and Rule mode are still selected. You’ve now decided how requests are handled once they reach the client; next, you’ll route requests from the system or apps into it. If a proxy group is missing, first check that the right profile is active. For more on rule matching, group references, and Direct policies, see the configuration FAQ. There’s no need to rewrite the entire rule set just to get connected for the first time.

Step 3: Connect and Route Traffic

Enable the System Proxy on Desktop

On Windows, macOS, or Linux, find the start button on the client’s Home page, or check the status area to confirm that the core is running. Some clients start the core automatically; others require you to click “Start,” “Connect,” or a power button. Then turn on “System Proxy.” If the system asks for permission, confirm only after checking that the prompt comes from your client. The system proxy updates the proxy settings for your OS or desktop environment so apps that follow those settings can use the client’s local proxy.

Test with a browser first. Most browsers use the system proxy, but extensions, custom proxy settings, and some desktop environments can change that behavior. On Linux, results also depend on the desktop environment and whether apps read its proxy settings. If an app doesn’t use the system proxy, check its network settings instead of repeatedly switching proxies. If you need to enter a proxy address manually, use the listening address and port shown in your client—not numbers copied from another guide.

Approve the VPN Prompt on Mobile

In the Android or iOS client, tap “Connect” or the main toggle. The first time you connect, the system will usually ask to create a VPN connection or add a VPN configuration. Approve the prompt and wait until the client shows Connected, then test in your browser. The system VPN interface routes device traffic to the app; whether that traffic uses a proxy or connects directly still depends on the client mode, profile rules, and which apps are covered.

Mobile operating systems usually limit how many VPN connections can be active at once for the same user or network environment. Disconnect any other VPNs, network-filtering tools, or apps that use the VPN interface before connecting this client. If you’ve configured per-app routing on Android, make sure the browser you’re testing is included. On iOS, check that the connection status in Settings matches the client. If permission is denied or the connection drops immediately, resolve the permission or connection issue first instead of trying different policies.

Use TUN Only When Needed

If the browser works through the system proxy but another app still bypasses the client, consider TUN mode. TUN routes traffic through a virtual network adapter and can cover more apps than the system proxy, but may require a service, administrator access, or a network extension. Follow your client’s prompts to grant permission, then check routing and DNS behavior again. Clients differ in whether the system proxy should remain on when TUN is enabled; follow the client’s instructions and avoid stacking traffic-routing tools without understanding how they interact.

Step 4: Verify the Setup

Compare What You See with the Connection Log

Leave the client running and open a new browser tab. Visit a site that normally works without a proxy to make sure basic connectivity is intact, then visit a site you actually need to access through a proxy. Use sites you know rather than relying on a particular test site. If the browser is reusing an existing connection, close the old tab and open a new one. After changing the mode or policy, make a new request so you don’t mistake the result of an existing connection for the effect of the new setting.

Next, open the client’s “Connections,” “Active Connections,” or “Connections” page. While you load the site, find its domain in the list. Check three things: the destination, the matched rule, and the outbound policy. If the domain appears, the request reached the client. The matched rule explains why that route was chosen, and the outbound policy or policy chain shows which proxy was used—or whether the request connected directly. Some clients show only an address or a simplified policy name. You can cross-check the same request in the logs; there’s no need for every client to display identical fields.

In Rule mode, a site showing Direct isn’t necessarily a problem; compare it with the routing rules in your profile. Likewise, a changed exit IP doesn’t prove that every app on the device is being routed through the client. An IP lookup reflects only the request that performed the lookup; other processes may use different settings. After testing the browser, open the apps you actually need, refresh a page or sign in, and check whether the client logs a connection from each one. This is the way to verify which apps are being routed.

Choose What to Check Next

If you need to troubleshoot, note the failed destination, time, mode, and policy in use, then check the logs from the same time. Change one thing at a time—for example, switch to a different proxy or briefly compare Rule mode with Global mode—then restore the original setting. Logs may contain domains, device addresses, and profile sources; redact account information before sharing them. For no internet access, proxy timeouts, or DNS issues, follow the relevant section of the Troubleshooting Guide. Reinstalling the client won’t help identify the cause.

After these checks, your first setup has a result you can verify: the correct profile is active, Rule mode and the main policy are selected, traffic routing is enabled, and requests follow the expected path. Keep your subscription active and check that policy selections haven’t changed after an update. Before exiting, disconnect or turn off the system proxy, then close the client. Features such as auto-connect, launch at startup, and per-app routing are optional; enable them one at a time after the basic connection is stable. See the FAQ for more on these features.