Clash Setup Guide: From Subscription Import to Verified Connection

PREPBefore You Start: Client & Subscription Link

Before setup, make sure two things are ready — without either one, the rest won't work. The client and the subscription are separate: the client is the app itself, the subscription is your node source, and swapping one out never affects the other.

• Client: install one for your platform from the download page. Not sure which to pick? Clash Plus is the top choice on Windows, macOS, Android, and iOS; on Linux desktop, go with Clash Verge Rev. See Client Comparison for the differences.
• Subscription link: provided by your service, found by logging into your account dashboard and copying the "Subscription URL". This link contains your personal credentials — don't forward it to anyone, and never post it in a public repo or chat group.

Once both are ready, start at STEP 01. The underlying format of subscription links (the difference between Base64-encoded and YAML manifests) isn't covered in this guide — check the "Subscription & Config" section on the Glossary page if you want the details.

STEP 01Import Your Subscription Link

The subscription link is how your client fetches its node list: the client downloads nodes and routing rules from this address and saves them as a "profile", which you then keep current with periodic updates. You only import it once — swapping nodes or rules afterward just happens through updates. If your provider gives you multiple subscription URLs (for different lines or protocols), import any one — the client only cares about the list content, not which URL you used.

On Clash Plus

1. Open the client and go to the "Profiles" tab in the bottom navigation — this lists all saved subscriptions.
2. Tap the "+" in the top right and choose URL (remote subscription) as the type — don't pick "Manual Input", that's for single nodes.
3. The name field can be anything (e.g. your provider's name); paste the full subscription link into the URL field. The token parameter at the end is easy to miss, so double-check it after pasting.
4. Save and return to the profile list, then tap the profile you just added — a checkmark should appear next to it to show it's active.
5. The client will download the profile, and the card should show a node count and last-updated time — that means the import worked.

Clash Verge Rev and FlClash

Clash Verge Rev: go to the "Subscriptions" page in the sidebar, paste the link into the field at the top, click "Import", then click the resulting profile card to activate it. FlClash: go to "Profiles", tap the "+" in the bottom right, choose "Import from URL", paste and save, then select it. Android and iOS have slightly different menu layouts but the same feature names; on iOS, Clash Plus can read a link straight from your clipboard — copy it first, and the import screen will pick it up automatically.

Checking the Import and Setting Auto-Update

Expand the active profile — you should see several proxy groups (Auto-Select, Manual Select, grouped by region) along with a node list. If you see no nodes, the profile either isn't active or failed to download. If it fails, first check the link is complete and that you can open the URL directly; if it still fails, see the "Subscription update failed" entries on the FAQ page. Set the auto-update interval to 24 hours — providers add and remove nodes and change endpoints from time to time, and a profile that never updates will end up with most nodes timing out.

STEP 02Choose a Proxy Mode

Clash has three working modes, switchable on the main screen or the top of the Proxies page in any client. Changes apply instantly, no restart needed:

• Rule: traffic is routed by the built-in rules in your profile — local sites go direct, overseas sites go through the proxy. This is the mode you'll leave on for everyday use.
• Global: all traffic goes through the proxy. Only use this if rules aren't working or for quick debugging — leaving it on long-term slows down access to local sites.
• Direct: no traffic goes through the proxy at all, effectively the same as being off. Useful as a temporary baseline for troubleshooting.

For the strict definitions of these three modes, see the "Proxy Modes" section on the Glossary page; rule syntax and proxy group fields are covered in the Config Field Reference page and aren't expanded on here.

Picking a Node

In Rule mode, open the Proxies page — you'll see a list of proxy groups first (Node Select, Auto-Select, region groups, etc.). Groups typically come in three flavors: manual select, latency-based auto (url-test), and failover (fallback), all pre-configured by your provider in the subscription — you just need to know how to open a group and pick a node. Tap a group to expand its candidate nodes, tap the lightning icon to run a latency test, and pick one with low, stable latency. If you'd rather not sort through them, just leave the group on Auto-Select and let the client switch based on latency automatically. Keep in mind latency only reflects connection speed, not bandwidth — if video buffers or downloads are slow, try a different node first before checking anything else.

STEP 03Start the Connection

With mode and node ready, turn on the proxy toggle. On Clash Plus: flip the switch at the top of the main screen. On Clash Verge Rev: turn on "System Proxy" in Settings, or use the shortcut toggle on the main screen. Once enabled, the client starts listening on a local port (mixed port 7890 by default, shared for HTTP and SOCKS traffic) and points the system proxy at it — see the Glossary page for what these port fields mean. If port 7890 is already in use by another proxy app, the client will warn about a port conflict — change the port in settings, or quit the other app first.

System Permissions

On Windows, the first launch triggers a Firewall prompt — check both Private and Public networks and allow access. On macOS, the first time you enable the system proxy, you'll be asked for your login password to install a helper tool, and some clients also need you to approve a network extension in System Settings. If access is blocked, or you see "can't be opened" or "is damaged", follow the steps in Fixing macOS Permission Issues. On Android, a "Connection request" dialog appears the first time — confirm to allow the VPN connection. On iOS, you'll be asked to add a VPN configuration — verify it as prompted to finish.

TUN Mode (Optional)

Browsers and most desktop apps work fine with the system proxy. Games, command-line tools, and UWP apps that ignore the system proxy setting need TUN mode instead, which uses a virtual network adapter to capture all system traffic. TUN mode requires admin privileges — see the Config Field Reference page for how to enable it. Windows UWP apps have their own loopback restriction, covered in a dedicated troubleshooting article.

Signs it's working: the tray or menu bar icon changes, real-time upload/download speeds appear on the main screen, and the Connections page starts filling with new entries.

STEP 04Verify It's Working

Two checks to confirm your traffic is actually going through the proxy:

1. Open an IP lookup site (like ip.sb) in your browser — the exit IP should now match your node's region. Then visit a site that wouldn't load before — if it opens normally, the proxy is working. Also try opening a local site to confirm it still connects directly and loads at normal speed, which shows rule-based routing is working correctly.
2. Go back to the client's Connections page — you should see a live connection log, with each entry showing the destination domain, the rule that matched, and the node it went through. Entries here confirm traffic is actually flowing through the client, not through a browser extension or some other channel.

If you're comfortable with the command line, you can test the port directly without going through the system proxy: curl -x http://127.0.0.1:7890 https://ip.sb. If it returns your node's exit IP, the client itself is working fine and the issue is with your system proxy settings.

Troubleshooting Order If It's Not Working

Check these one at a time, in order, and re-verify after each change: ① is the system proxy toggle actually on — some security software resets it automatically; ② is the mode stuck on Direct; ③ try a different node to rule out a single bad node; ④ update your subscription to rule out expired or removed nodes; ⑤ disable any other proxy-related browser extensions to rule out conflicts. For a more complete troubleshooting tree, see the "Troubleshooting" section on the FAQ page.

Also worth checking is DNS: in Rule mode, DNS is handled by the client's built-in module and usually needs no manual setup. If you suspect a DNS leak, start with the DNS entry on the Glossary page, then adjust the dns field as described on the Config Field Reference page.

NEXTGo Further

Four steps is all you need for everyday use. Anything not covered here is handled by these pages:

Run into a specific error message? Search the FAQ page by keyword first — this core guide stays intentionally lean and won't change with every client update.