Clash Getting Started

Before You Start: Get the Client and Subscription Ready

First, make sure the client launches and locate its “Configuration” or “Subscription” page. If you haven't installed a client yet, visit the Clash Download Center and choose one for your operating system and processor architecture. Not sure which client to use? Start with the client comparison. You don't need to install multiple tools or run a command-line core first.

Get a working subscription URL that the provider explicitly supports for your client or the mihomo configuration format. The client reads the configuration and handles connections; installing it doesn't automatically provide working nodes. If you only have a web account, order page, or login URL, find the subscription export option on your provider's site and copy the full URL.

Before you begin, quit other proxy or VPN tools that are routing traffic, and note whether a manual system proxy is already set. For your first setup, use one subscription and one routing method so it's easier to pinpoint issues. Don't start by enabling TUN, changing DNS, editing rules, and switching ports all at once. Get a basic connection working first, then add features as needed.

01 Import a Subscription and Enable the Configuration

Open “Subscription” or “Configuration” in the client's sidebar and click “New,” “Add,” or the plus button. In the dialog, choose URL import and paste the complete subscription URL into the link field. If the client lets you add a note, use a recognizable name, such as “Daily setup,” to tell subscriptions apart later.

Check that there are no extra spaces, line breaks, or punctuation added by a chat app at either end of the URL. Keep its query parameters; don't copy only the part before the question mark. Subscription URLs often contain credentials, so don't post the full URL in public comments or paste it into an unfamiliar online conversion tool. When asking for help, describe the error and redact sensitive parts of the URL.

Click “Import,” “Download,” or “Save” and wait for the client to retrieve the configuration. You should see a configuration card or subscription entry in the list; some clients also show the update time and parsing results. Select the entry or choose “Enable” or “Set as active.” Importing and enabling are separate actions—don't stop just because the subscription appears in the list.

Next, open the “Proxy” page and check that proxy groups and selectable nodes are available. If you see the configuration name but no proxy groups, return to the configuration page and confirm the newly imported configuration is active. If parsing fails, fix the subscription content or format rather than repeatedly toggling the system proxy. Check “Logs” for the latest import error and note its key terms; there's no need to copy the entire configuration.

Using a Local YAML File

If your provider supplied a local configuration file, choose “Import from file” on the configuration page, select the relevant .yaml or .yml file, and enable it. A local file may not have a remote update source, so don't assume it will refresh automatically when the provider makes changes. You don't need to edit node details for your first setup. If you need to understand the fields, see the config.yaml troubleshooting guide.

If Import Fails, Resolve It Before Moving On

If the error says the URL is unreachable, first confirm your device has a working internet connection, then copy a valid URL again from your provider. If it reports a format or indentation error, make sure the export is a configuration supported by your client—not a login page or subscription in another format. A subscription parsing error doesn't mean all nodes are unavailable. See the Help Center for format differences or follow the subscription troubleshooting steps in the Troubleshooting guide.

You're ready to move on when the configuration is active and its proxy groups appear on the proxy page. Once both are confirmed, choose an operating mode.

02 Choose Rule Mode and a Proxy Group

Open the “Proxy,” “Overview,” or “Mode” page and find the “Rule / Global / Direct” options. For your first setup, choose “Rule.” The client then uses the configuration's rules to decide whether each connection goes direct, uses a proxy group, or follows another configured action. Rule mode doesn't automatically route every app through the client; you'll set which traffic is captured in the next step.

“Global” usually sends connections handled by the core through the global proxy policy. It's useful for briefly checking whether rules are affecting a connection, but isn't a general fix for every issue. “Direct” sends traffic handled by the core straight to its destination and is usually useful for temporarily restoring direct access. Switching modes won't fix an expired subscription or change whether a destination service is available.

After choosing a mode, open the main proxy group provided by your configuration. It might be called “Proxy,” “Node Selection,” or something else; the label doesn't need to match this guide. Expand the group and choose a known working node, or use the “Auto Select” strategy if one is available. If the main group points to another group, keep expanding until you confirm the final choice isn't an unintended direct policy.

If the client offers a connectivity test, run it once on a candidate node to rule out obvious connection failures. The result reflects only that test destination under current conditions; it doesn't guarantee that your browser, games, or every website will work. Don't judge success by a single number—check actual connection activity as well.

Keep the subscription's existing rules; don't add a blanket override such as “proxy all connections.” If a site that should use a proxy is matched as Direct, check the connection log and see rule and routing troubleshooting. For now, confirm Rule mode is selected and the main proxy group is set, then route traffic through the client.

03 Enable Traffic Routing

Once your subscription and proxy group are ready, the client still needs to receive connections from your apps. Desktop system proxy settings, mobile system connection authorization, and TUN are separate options—you don't need to enable all of them. Start with the basic routing method for your device, keep the client running, then verify the connection.

Windows, macOS, and Linux: Enable the System Proxy First

Find “System Proxy” in the client's “Settings,” “Overview,” or tray menu and turn it on. Windows clients often offer a quick toggle in the system tray. macOS may ask for permission to change network settings. On Linux, what works depends on the desktop environment and whether apps support proxy settings. The client will usually show that the system proxy is enabled, but you'll still need to verify it with an actual connection.

When you use the client's toggle, it usually sets the local listening address and port for you. There's no need to copy a fixed port from an online guide. If you need to check the system settings, use the HTTP or mixed port currently shown in the client. 7890 is a common example, not a guaranteed port for every client. An incorrect port sends apps to an address where nothing is listening.

Start by testing in a browser that follows system proxy settings. Long-open tabs may reuse old connections, so open a new tab and reload the target page. Command-line tools, some games, and apps with their own proxy settings may ignore the system proxy. If the browser works but another app doesn't, check how that app handles connections before changing your subscription.

Android: Approve the System Connection Request

In your Android client, confirm the current configuration is active, then tap “Start” or the connect button on the home screen. On first launch, Android usually displays a VPN connection request. Review and approve it, then return to the client to check its status. VPN here refers to Android's system interface for routing traffic; the client configuration determines how that traffic is handled.

If the connection drops as soon as you approve it, check whether another VPN app is running. Some clients also offer per-app proxy settings: if your target browser is excluded, its traffic won't reach the client as expected. For your first test, confirm the app is included. Check battery optimization and background permissions only if the connection drops after you switch away from the client; there's no need to change every system restriction in advance.

iOS: Start the Active Configuration and Approve Access

In your iOS client, select the configuration and proxy policy you just imported, then tap Connect. The first time you connect, follow the system prompts to allow a VPN configuration and complete any identity confirmation your device requires. Return to the client to make sure the connection stays active, then test in a browser. The system connection indicator only confirms that routing is enabled; it doesn't verify the destination or the rule used.

TUN Mode: Route More Traffic When Needed

Consider TUN mode only if basic browser access works but you also need to route apps that ignore the system proxy. TUN usually handles a wider range of traffic through a virtual network interface. On desktop, it may require installing a service, elevated permissions, or authorization for a network extension. Find “TUN Mode” in the client and follow the permission prompts. If it fails to start, resolve the service or permission issue shown instead of repeatedly changing DNS settings.

Clients handle system proxy and TUN combinations differently. For a first setup, follow your client's instructions and choose one main routing method to avoid conflicts with other network tools. TUN isn't a universal fix for connection issues. For more on routing and DNS, see the Help Center. If your connection stops working, restore the settings you just verified, then follow troubleshooting for no internet access.

04 Verify with a Live Connection

Keep the client running and visit a site in your browser that should work without a proxy to confirm your basic internet connection is still available. Then visit a destination that should use a proxy under your current configuration. Run both tests close together. Don't change nodes, modes, or DNS settings in between, or it will be harder to tell what caused the result.

Next, return to the client's “Connections” or “Active Connections” page and reload the destination site. Look for its domain or destination address, then check the matched rule, policy, and traffic sent and received. Some clients show the proxy chain in the connection details, which you can open by selecting the entry. A page loaded from cache may not create a new connection, so try a page you haven't opened yet.

In Rule mode, direct connections for sites that should bypass the proxy are expected. Destinations that should use a proxy should show the selected proxy group or node. If all traffic uses the same policy, first check that the client isn't in Global or Direct mode, then confirm the active configuration. An IP lookup can provide a clue, but it only shows the route used for that site's connection—not whether other apps are being routed.

Choose Your Next Step Based on What You See

If a page won't load and no matching request appears in the connection list, check the system proxy, the app's own proxy settings, or per-app routing on mobile. If the request reaches the client but times out, try another working node in the same proxy group. If other sites work and only one destination fails, keep your current settings and check the rule matched for that destination instead of reinstalling the client right away.

If the log explicitly reports a DNS resolution failure, check the DNS settings. If the error occurs while downloading the subscription, go back to step one instead of changing the routing method. Follow this order to narrow down the issue: configuration loaded → request reaches the client → policy used → destination reachable. For more help, take the error keywords with sensitive details redacted and consult the relevant section of the Troubleshooting guide.

Save a Setup You Can Reuse

Once the connection works, keep the active configuration, Rule mode, and routing method you've verified. If the subscription page supports manual updates, refresh it after your provider changes nodes, then check that the main proxy group still points to an available option. Set up automatic updates, launch at startup, and per-app routing later; avoid changing too many things as soon as your first connection works.

Remember how to stop the connection normally, and confirm that your device can still access the internet as before when routing is off. Your subscription is active, a proxy group is selected, app requests reach the client, and live connections follow the expected rules—that completes your first setup. For what comes next, browse the FAQ; you don't need to read every configuration field for everyday use.