Clash Quick Start

Step 1: Import a Subscription

Before you start, get the subscription URL from your provider or a local configuration file compatible with your client. A client is not a proxy service, so installing one won’t automatically give you a working outbound. Subscription URLs often contain credentials. Paste yours only into a client you trust, never post it in a public forum, and don’t share screenshots of errors that show the full URL.

Add a Remote Profile

Open the client and look for “Subscription,” “Configuration,” or “Profiles” in the sidebar or bottom navigation. Choose “New,” “Add,” or “Import from URL.” If prompted for a type, select remote subscription. Give it a recognizable name, then paste the full URL into the URL field. Check that there are no extra spaces or line breaks at either end, then choose Save, Download, or Import.

Some provider websites have a one-click import button. After you click it, the system may ask whether to open the client. Allow it, then check that the new profile actually appears in the client. Opening the client from your browser only completes the handoff; it doesn’t mean the subscription has downloaded. If the import window doesn’t open automatically, return to the configuration page and add the copied URL manually.

When the profile finishes downloading, select it in the list or choose “Enable” or “Set as Current.” Some clients select imported profiles automatically; others only save them. Go to the Proxies page and check that policy groups or outbound options are available. If it’s still empty, first make sure the profile is enabled. Don’t move on to connecting yet.

Check the Format and Update Status

A successful import doesn’t necessarily mean the subscription contents are usable. If the profile appears in the list but shows a parsing error, missing proxies, or a load failure, check its status message. Sign in to your provider’s website and make sure you copied a configuration URL for Clash or Mihomo—not an account page, payment page, or link intended for a different protocol client. See Subscription and Configuration Formats for an overview.

If an update fails, first check whether you can reach the subscription source without a proxy, then check your account status and whether the URL has been reset. If your provider issued a new URL, update the existing profile and download it again. Don’t paste credential-bearing URLs into unfamiliar online conversion tools, or create multiple profiles with the same name before you know what went wrong. That makes it harder to tell which profile is active.

To use a local file, choose “Import File” on the same page and select the configuration file. Select and enable it after importing. A regular local file usually won’t update automatically with your provider’s subscription; follow the client’s indicated profile type when maintaining it. You’re ready for the next step when the current profile loads successfully and the Proxies page shows selectable groups or outbounds.

Step 2: Choose a Proxy Mode

Go to the client’s home, Proxies, or settings page and look for “Mode,” “Outbound Mode,” or “Mode.” For your first setup, choose Rule. This mode uses the rules in your current configuration to decide whether requests go direct or through a proxy, making it a good starting point for everyday use. Mode changes usually take effect immediately. If the client asks you to reload the configuration, do that before continuing.

Understand Modes and Outbound Selection

After selecting Rule, go to the Proxies page and choose an outbound. The mode determines how requests are routed; a policy group determines which outbound a given request uses. They serve different purposes. Find the main policy group intended for manual selection. It may be named PROXY, Proxy Selection, or something chosen by the configuration author. Expand it and choose an available proxy outbound. Group names vary, so don’t look for one exact label.

If a policy group contains other groups, expand them to see where they lead. For your first test, explicitly select a proxy outbound so nested selections don’t make it look as though the connection has switched when it hasn’t. If you select DIRECT, the request connects directly; if you select REJECT, it’s blocked. Seeing a name or test result beside an option doesn’t, by itself, prove that an actual web request used that outbound.

Some configurations include an automatic selection group. Choosing it means using the configuration’s built-in testing and switching behavior, not a fixed outbound. You can keep the default selection for now and check the actual outbound in the connection details during verification. If you’re unsure how group types such as select and url-test differ, see the policy group terminology guide. There’s no need to restructure groups just to make your first connection.

When to Use Global and Direct

Global typically sends requests that reach the core through a global policy group. It’s useful for briefly checking whether a problem is related to rule-based routing. After switching to Global, make sure the global group has an available outbound selected. This doesn’t mean every app on your device is being routed through the core. If an app isn’t sending requests to the core at all, changing the outbound mode won’t fix it.

Direct sends requests that reach the core straight to their destination, so it can’t verify that a proxy outbound works. You don’t need to cycle through all three modes when getting started: stay on Rule and explicitly select a proxy outbound. Use Global temporarily for comparison only when troubleshooting, then switch back to Rule. For a deeper look at rule matching order, see the rule-based routing guide once your connection works.

At this point, confirm two things: the mode is set to Rule, and the policy group for your target request has an outbound selected. Next, make sure your browser or other app sends requests to the client. Selecting an outbound alone doesn’t change your system’s network route.

Step 3: Connect

Before connecting, quit any other proxy or VPN clients to prevent them from competing over system proxy, routing, or DNS settings. Return to the current client and make sure the core is running, with no configuration load failures or port conflict warnings. If the client has separate controls for starting the core and enabling the system proxy, start the core first.

Enable the System Proxy on Desktop

In your Windows, macOS, or Linux client, find and enable the “System Proxy” switch. Check that the client confirms it’s on. This directs apps that respect system proxy settings to the client’s local listening address. A browser is a good choice for your first test. Command-line tools, games, and some apps with their own network settings may ignore the system proxy, so don’t use them to judge whether the entire setup is working.

If the system asks to install a helper service, enter an administrator password, or allow network changes, first make sure the prompt comes from your current client, then follow its instructions. If permission is denied, the switch in the client may not have changed the system settings. Recheck the status in the client rather than assuming a click connected you. For more macOS permission guidance, see macOS Client Permissions.

System proxy support varies across Linux desktop environments. If the client says the system proxy is on but your browser ignores it, check whether the browser uses the system proxy or has an extension setting its own proxy. For your first setup, don’t change proxy settings in the system network panel, browser extensions, and client all at once. Start with one clear control point so it’s easy to undo changes and track down problems.

Allow the VPN Configuration on Mobile

Android and iOS clients usually have a “Connect” button. After you tap it, the system may ask to allow a VPN connection or add a VPN configuration. Check that the prompt comes from your client, then allow it. Return to the client and make sure the connection stays active. If you dismissed the first permission prompt, tap Connect again. Importing a profile doesn’t mean the system VPN connection is established.

If another VPN is connected on your device, disconnect it in its app before starting the current client. A VPN icon in the status bar only means a network tunnel has been established; it doesn’t prove that your selected proxy outbound works. Mobile clients may also split traffic by app. Apps excluded from routing won’t use the proxy as expected. For your first test, use a browser, then check the included or excluded app settings for other apps.

Once the connection switch stays on, move to the final step. Instead of toggling it repeatedly, make an actual request to see which route the traffic takes.

Step 4: Verify the Connection

Open a website that should use the proxy, then visit a site you normally use that should connect directly. Don’t rely solely on the client’s status, a system icon, or an outbound test result. Check both that the pages load and how the client handled the requests. Together, these checks distinguish a running core from a target request that actually went through the proxy.

Check the Connection Log

Leave the client running and open the “Connections” or request details page, then refresh the target page in your browser. Find the new connection and check the domain, matched rule, selected policy group, and final outbound. If the connection details show the expected proxy outbound and the page loads, that request is using the proxy successfully. Fields vary by client, so use the information it provides.

If the page loads but the log shows DIRECT, the request went direct and doesn’t prove the proxy is working. Check whether a rule routes the target domain directly and whether the relevant policy group is set to DIRECT by mistake. If the target request doesn’t appear in the proxy log, don’t assume the subscription is broken: browser caching, an existing persistent connection, separate proxy settings, or an app that isn’t being routed can all cause this. Refresh the page; if needed, close the relevant tab and reopen it.

For a comparison, you can turn off the connection briefly, revisit the same site, and then turn it back on. Checking your public IP can also help, but in Rule mode the IP-check site itself may connect directly. Its result is useful only after you confirm that the request went through the proxy. Don’t assume the results from one IP-check page apply to every app.

Troubleshoot by Connection Path

If the target site won’t load but other sites work, first check the selected proxy outbound and account status. Then check the failed connection for a refusal, timeout, or DNS error. Try a known working outbound, changing only one thing at a time. If switching to Global temporarily fixes it, investigate the rules or policy group selection rather than reinstalling the client. Switch back to Rule after the comparison.

If no sites load after you connect, turn off the system proxy or disconnect on mobile and check whether your basic internet connection works. If it doesn’t, troubleshoot Wi-Fi, mobile data, or the system connection first. If it works until you connect, check the core status, current configuration, outbound selection, and traffic-capture permissions. On desktop, make sure another client hasn’t overridden the local proxy settings.

If the logs show a DNS resolution failure, first make sure it corresponds to your latest request. Then check whether the network requires you to sign in through a web page and whether the configuration’s DNS resolver is reachable. When getting started, don’t replace the entire DNS setup or assume every connection issue is a DNS leak. For more on DNS routing, see DNS Configuration and Troubleshooting. This keeps the basic setup steps focused and avoids introducing unnecessary variables.

Save Your Settings and Quit Cleanly

Once the target request uses the proxy and your usual direct-connect sites still work, keep the current mode and policy group selection. After future subscription updates, check that the profile is still enabled and your selected outbound is still available. Automatic updates don’t guarantee that every selection stays the same; if your provider changes group or outbound names, you may need to select them again.

Before quitting the desktop client, turn off the system proxy and exit normally from the client menu. If you used TUN, disconnect it using the client’s shutdown process as well. On mobile, tap Disconnect and confirm the status changes. If the client crashes and you lose internet access, check whether the system proxy still points to a local service that has stopped, then restore your usual network settings. There’s no need to delete the subscription or reinstall the client right away.

Your first connection is now set up. Keep your subscription updated, watch for load errors, and preserve a working configuration before making changes. For routine checks, see Subscription Updates and Routine Maintenance. If you come across unfamiliar configuration terms, look them up in the Terminology Guide before changing anything.