Provider, subscription, and node: three different things

When you first set up Clash, a provider, a subscription link, and a proxy node can seem like three names for the same product. They are connected, but each plays a different role. Knowing which one you are dealing with makes it easier to choose a service, import it correctly, and troubleshoot a connection without exposing account details.

  • Provider: The service or organization that gives you access to proxy resources. It may offer an account dashboard, subscription links, usage limits, and customer support. In configuration files, proxy-providers is also the name of a separate feature that can fetch a list of proxies; it is not automatically the same thing as the company selling access.
  • Subscription: A URL or configuration file that supplies information to a Clash-compatible client. Depending on the service and format, it may contain proxy definitions, proxy groups, rules, DNS settings, or only some of these.
  • Node: A specific proxy endpoint with connection details such as a server address, port, protocol, and authentication information. In many configurations, nodes appear under proxies. A node is one possible route, not the subscription itself.

A useful comparison is a transit pass and the routes it makes available: the provider manages access, the subscription delivers configuration, and the nodes are individual routes. The analogy is not exact—providers can change their available nodes, and configuration files can include more than connection endpoints—but it helps separate the terms.

What a subscription link actually delivers

A subscription link is usually a web address that the client requests to retrieve configuration data. The provider can update that data without asking you to replace the link each time. Some subscriptions return a complete Clash-compatible configuration. Others return a proxy list that a client or core combines with local settings. The exact result depends on the service’s format and the client’s import behavior.

A complete configuration can include more than nodes. It may define proxy groups such as a general selection group, rules that send different traffic to different groups, DNS behavior, and listener settings. A proxy-list-only subscription may supply node definitions while relying on the client’s existing configuration for groups and routing. This is why two subscriptions that display similar node names can behave differently after import.

Term What it refers to What it does not tell you
Provider The service or organization supplying access and configuration Whether every advertised node is currently reachable
Subscription URL A link the client uses to retrieve configuration or proxy data Whether the returned content is compatible with every client
Node A specific proxy endpoint and its connection parameters Which traffic will use it, or whether its label is accurate
Proxy group A selection or routing layer that can contain nodes or other groups That a particular node is selected for every connection
Rule A condition that directs matching traffic to a group or policy That traffic reaches Clash in the first place

Some configurations use mihomo’s proxy-providers to fetch proxy definitions separately from the main configuration. A proxy provider in YAML can have its own URL, update interval, and processing options. The client’s subscription card and this core feature are related ideas, but they are not interchangeable terms. If a guide says “provider,” check whether it means the commercial service or the YAML field.

Check a service before signing up

Do not choose a plan based only on the number of nodes or a promise of “unlimited speed.” Availability, performance, and terms can differ by location, network, device, and time of day. A careful review does not guarantee that a service will suit you, but it can help you avoid obvious mismatches and unclear commitments.

  • Read the plan limits. Check the billing period, data allowance, device or simultaneous-connection limits, renewal terms, and what happens when a limit is reached. “Unlimited” may still be subject to fair-use conditions.
  • Look for compatibility details. Confirm that the service supplies a format supported by your client and core. A generic “proxy subscription” label does not guarantee that every Clash-compatible app can import it directly.
  • Check support and service notices. Find out how the provider communicates maintenance, outages, refunds, and account issues. A clear status or support channel is more useful than a long list of unverified node labels.
  • Review privacy and payment information. Understand what account details are collected, how the service describes its data practices, and whether cancellation is straightforward. Do not assume that using a proxy makes all activity anonymous.
  • Be cautious with downloads and certificates. A subscription should not require you to install an unknown root certificate or disable basic device protections just to import a link. Ask the provider what a requested certificate is for before proceeding.
  • Start with a low-commitment option if available. A short trial or modest plan can help you test compatibility and ordinary performance before making a larger payment. Read the renewal terms before entering payment details.

Public speed tests and screenshots are only snapshots. They may use a different route, location, time, or test method from yours. If you can test the service, compare it using the same device and network, and check the sites or applications you actually need rather than relying on a single headline speed figure.

Many subscription URLs contain a token in the path or query string. Anyone who obtains a working link may be able to retrieve the associated configuration, use your account allowance, or discover connection details, depending on the provider’s setup. It is safer to handle the link like a password than like an ordinary public web address.

  1. Copy it only from the provider’s official account page. Check that you are signed in to the correct account and that the displayed link is current. Avoid links forwarded through an unknown person or posted in a public channel.
  2. Import it into the client directly. Use the client’s subscription or configuration import feature where possible. Avoid pasting the full URL into public converters, online YAML validators, issue trackers, or screenshots.
  3. Keep a private backup if needed. Store a local configuration backup in a place you control. A backup containing subscription tokens or node credentials should be protected just like the original link.
  4. Redact before asking for help. Remove the full URL, account identifiers, passwords, tokens, and private server details from logs and screenshots. A short error message and client/core version are usually safer starting points.
  5. Reset an exposed link. If you posted it publicly or sent it to the wrong person, use the provider’s account tools to regenerate or revoke it if available, then update your client with the replacement.

Import the subscription and test it in stages

Client names and menu labels differ across Clash Verge, Clash Verge Rev, Mihomo-based apps, and mobile clients. Look for a section called Subscriptions, Profiles, Configurations, or a similar term. The goal is to add the remote source, confirm it updates successfully, and then verify the routing choices it provides. Importing a link does not necessarily turn on a system proxy or route all device traffic.

  1. Choose the right client and core. Check that the application runs a core compatible with the format and protocols your service provides. The client is the interface; the core processes the configuration and handles connections. Their version numbers are separate.
  2. Add the remote subscription. Paste the link into the client’s subscription or configuration import screen. If the client asks for a name, use a neutral label that helps you identify it without including account credentials.
  3. Refresh once and read the result. A successful refresh means the client fetched and processed a response; it does not prove that every node is reachable. If it fails, note the exact error, time, and HTTP status if shown, but do not share the token.
  4. Inspect the available groups and nodes. Open the proxy or policy view. Choose a selection group if one is provided, then select a node inside that group. A group may also include automatic selection, fallback, or direct-routing options.
  5. Test one connection path. Use the client’s latency check as a quick reachability signal, not as a guarantee of application performance. Then open a site or app that should use the proxy and check the client’s connection log or traffic view to see which rule and group handled it.
  6. Enable the traffic handoff you need. For browsers and other apps that respect the operating system proxy, enable the client’s system proxy option. For apps that do not use it, a supported TUN mode may be needed. Start with the simplest setup that meets your needs.
mixed-port: 7890
allow-lan: false
mode: rule
proxies:
  - name: Example node
    type: <provided protocol>
    server: <provided server>
    port: <provided port>

This is a structural illustration, not a working subscription or a complete configuration. The protocol and authentication fields depend on the service, and angle-bracket placeholders are not valid values to paste into a live config. In many client workflows, the imported subscription supplies these details, so you do not need to construct node entries manually.

For a guided overview of client setup, see the Clash getting-started guide. If you are still choosing an app, compare the supported platforms and core options before importing sensitive account data.

Understand why a node can test well but traffic still fails

Clash routes traffic through several stages. An application first has to send its traffic to the client, then the configuration’s rules determine what happens to it, and a proxy group may select a node. A successful latency check tests a particular connection to a node; it does not confirm that the application uses the expected group or that its request matches a proxy rule.

  • The node test fails: Check whether the subscription is current, whether the device has internet access, and whether the selected core supports the node’s protocol. Try another node from the same group before changing unrelated settings.
  • The test succeeds but a browser is direct: Confirm that the browser follows the system proxy and that the client’s system proxy is enabled. Then inspect the connection log to see the matched rule and selected policy.
  • Only some apps fail: The app may ignore system proxy settings, use a different network stack, or require traffic capture through TUN. Check the app’s own proxy options and the client’s routing mode before concluding that the node is unavailable.
  • A group shows an unexpected choice: Check whether the group is manual, automatic, fallback, or nested inside another group. Selecting a node in one group may not change a different group used by the matching rule.
  • Everything stops after an update: Keep the previous working configuration if possible, inspect the update error, and check whether the provider changed the returned format or groups. Avoid repeatedly deleting and re-importing the subscription before you know which step failed.

In Rule mode, rules decide which policy handles a connection; a matching rule can send traffic directly rather than through a proxy. Global mode generally directs traffic that reaches the core through a selected proxy policy, while Direct mode bypasses proxy nodes. These modes do not fix an application that never sends traffic to Clash. For that reason, verify the application handoff, rule match, group selection, and node health as separate checks.

Frequently asked questions

Is a subscription the same as a proxy node?

No. A subscription is a link or configuration source that can provide one or more nodes and other settings. A node is an individual endpoint. A subscription can be refreshed as its contents change, while a node is one of the available connection choices at a given time.

Does “proxy provider” always mean the company I pay?

No. In everyday conversation it may mean the service selling access. In a mihomo configuration, proxy-providers refers to a feature for fetching proxy definitions. Check the context, especially when reading a YAML guide or an error message.

Does importing a subscription send all my device traffic through a proxy?

No. Importing adds or updates configuration. You still need a traffic handoff such as the system proxy for apps that honor it, or a supported TUN setup for broader capture. Rules and proxy groups then determine how traffic received by the core is routed.

Do not share the full link publicly. It may contain an account token. Share the client and core versions, the exact error text, and a redacted configuration excerpt instead. Remove URLs, credentials, tokens, and private server details before posting.