Clash Subscription Import and Connection Guide

Pre-setup checklist

Prepare the client and a valid subscription

Before you begin, prepare two things: a Clash client for your current operating system and a valid subscription URL generated by your network service provider. The client reads configuration, selects policies, and handles system connections; the subscription URL supplies proxy nodes, policy groups, and routing rules. They serve different purposes. Installing the client without loading a configuration usually leaves no selectable nodes on the proxy page.

If the client is not installed on your computer or phone, first visit the client downloads page and choose a graphical build for your platform. For a first setup, avoid starting with a core archive, which usually requires manually writing configuration files and startup arguments. After installation, open the client once so the system can complete permission prompts and initialize its configuration directory, then continue with the subscription import.

A subscription URL is usually a URL beginning with https://. Copy it from the management page of the service you currently use. Make sure no characters are missing from either end, and do not mistake a webpage or plan description URL for the subscription URL. Some services offer separate formats for Clash, universal subscriptions, and other clients; choose the entry explicitly labeled for Clash or YAML configuration when available.

This guide uses a typical graphical client and does not require changing port, DNS, or TUN settings first. Keeping the initial scope small makes troubleshooting easier: once the basic connection works, add advanced features one at a time so you can identify which setting caused a problem. For a systematic explanation of cores, configuration file structure, and complex routing rules, read the user manual after completing this page.

Step 1

Import the subscription and select the profile

After opening the Clash client, go to the “Config,” “Subscription,” or “Profiles” page. You will usually find a URL field and an “Import,” “Download,” “Add,” or “Update” button. Paste the copied subscription URL in full, make sure there are no extra spaces, and click the appropriate button. The client will request the configuration from the subscription URL and save the successfully loaded content in the local profile list.

After a successful import, the page usually adds a new profile. Its name may be preset by the service provider or may simply be the configuration filename. Do not leave the page as soon as you see the new entry: click the profile or use its adjacent enable button to make it the active configuration. The selected item typically shows a highlight, checkmark, or “In use” status. This matters because downloading a subscription locally does not mean the client is using it.

Once the profile is selected, open the “Proxy” or “Proxies” page to check the result. You should normally see several policy groups, such as automatic selection, node selection, failover, or groups for specific sites. Group names vary between subscriptions, so there is no need to look for one exact label. If the page is no longer empty and at least one policy group can be expanded, the client has parsed the configuration and you can continue.

If no new entry appears after clicking Import, read the page’s message first. A timeout usually means the current network cannot reach the subscription server; an unsupported format means the returned content is not a configuration the client can read directly; a 404 or expired-link message may mean the subscription URL is no longer valid. Do not start changing proxy ports and DNS settings while the problem is still at the download stage. Copy the URL again or generate a new one from the service management page.

Some clients can import local files. If the provider supplies a .yaml or .yml file, use “Import locally,” “Add from file,” or a similar option to select it. Select the imported file in the profile list afterward as well. If the subscription format, conversion process, or update failure is more complex, see the installation and configuration section of FAQ instead of manually rewriting large sections of YAML during the first setup.

Step 2

Choose rule mode and an available policy

After the configuration loads, find “Proxy Mode,” “Mode,” or the mode switcher in the client. Common options include Rule, Global, and Direct. For a first setup, choose Rule mode: the client uses the rules in the subscription configuration to decide whether each connection should use a proxy, connect directly, or be handed to a policy group. This handles traffic that needs a proxy while keeping suitable direct connections on their normal route.

Global mode sends most connections through one proxy policy. It can be useful for a quick node check, but it is not ideal as the only long-term setting during initial troubleshooting. Direct mode bypasses the proxy and is mainly useful for temporarily disabling proxying or running a comparison test. If your goal is a standard first connection, keep Rule mode enabled; there is no need to test all three modes.

Next, open the proxy policy page and expand the group responsible for most traffic. It may be called “Node Select,” “Proxy,” or “Manual Select,” or have a custom name chosen by the subscription provider. For an initial test, choose a specific node or use the automatic selection policy already configured in the subscription. The client usually highlights the selected item or adds a checkmark.

Some clients include a latency test button. It can indicate whether a node responds, but the result represents only the probe request and does not guarantee that every site will be reachable. Do not repeatedly chase a particular number during initial setup. A node that is not timing out and can pass the later webpage test is sufficient. If every node times out, update the subscription and check the local network before enabling more traffic-capture options.

Policy groups can be nested: the main selection group may point to “Automatic,” which then chooses a specific node. This is normal. Make sure the top-level group responsible for regular traffic has a selection; there is no need to edit every site-specific group manually. Subscription providers usually supply default policies, and keeping those defaults makes first-time verification easier.

After choosing the mode and policy, the configuration is ready, but system traffic may not yet be entering the client. The next step is to enable the system proxy so browsers and apps that follow system proxy settings send their connections to Clash. The mode determines “how a connection is handled,” while the system proxy determines “whether it is handed to the client first.” Both are required.

Step 3

Enable the system proxy and connect

Return to the client’s home page, general settings, or system settings area and find the “System Proxy” switch. Turn it on. The client will write its local proxy address to the operating system’s proxy settings, allowing browsers and apps that follow system settings to send requests to Clash. An enabled switch usually shows the brand color, a checkmark, or “Enabled.”

On Windows, the system proxy is usually on the home or settings page. On macOS, it may be in the shortcut menu for the menu bar icon. Android clients often use system VPN permission to create a local tunnel; iOS clients request permission to add a VPN configuration; Linux desktop environments may require the client to write the desktop proxy settings. When a system permission dialog first appears, confirm that it comes from the newly installed client, then follow the system prompt to allow it.

Do not enable TUN mode at the same time during this step. The system proxy is suitable for verifying browsers and common desktop apps with fewer variables. TUN mode creates a virtual network interface to handle programs that ignore system proxy settings, some games, or command-line traffic, and may require administrator access, service installation, and additional DNS settings. Enabling both capture methods before the basic connection is verified makes the source of a failure harder to identify.

After enabling the system proxy, keep the Clash client running and do not exit it immediately. Some desktop clients remain in the taskbar or menu bar after the main window closes, which generally does not affect the connection. If you choose “Exit” instead of “Minimize,” the local proxy port stops listening; even if the system proxy still shows a configured address, requests cannot complete. During the first test, leaving the client window open is the safest approach.

If the client says that a port is already in use, the local listening port in the configuration is occupied by another program. Check whether two proxy clients are running or an old process is still active in the background. Close the duplicate program and restart the current client. Do not change several ports at random to bypass the message: the system proxy address and the client’s listening port must match, and changing only one can send system requests to a nonexistent port.

A connection icon on a mobile device only means that the system has allowed the client to establish a local VPN tunnel; it does not prove that the remote node works. After the icon appears in the status bar, continue with the actual access test in the next step. The same applies on desktop: an illuminated system proxy switch only shows that the capture setting was written to the system. The final result must be judged from both webpage access and the client’s connection log.

Step 4

Verify the result with a webpage and connection log

After enabling the system proxy, close any existing error page in the test browser and open the target site in a new tab. Reopening the page reduces interference from old cache, failed connections, and the browser’s internal retry state. Use a site you normally know requires a proxy; no extra diagnostic tool is needed.

Once the page loads normally, return to the Clash client’s “Connections” or log page. It should show a connection record for the domain you just visited, along with the matched rule and policy used. A successful webpage and a matching connection record together confirm that browser traffic entered the client and that Rule mode selected a policy. The main first-time setup is now complete.

You can also run a comparison check: temporarily disable the system proxy, refresh the same page, observe whether the route changes as expected, and then enable the system proxy again. The purpose is not to switch repeatedly, but to confirm that the result comes from the client handling the traffic. If the result remains exactly the same after disabling it, the browser may have its own proxy settings, another proxy program may be active, or the site may already be directly reachable.

If the page still cannot load, check in this order

Return to the configuration page and confirm that the imported subscription is still the active profile. Then check that the proxy mode is Rule and that the main policy group has selected a specific node or automatic policy. Finally, check that the system proxy is enabled and the client is still running. This order covers configuration, policy, and traffic capture separately, making the cause easier to locate than changing many switches at once.

If the test domain never appears on the Connections page, the problem is usually in the system capture layer. Check the system proxy switch, make sure the browser has no separate proxy rules, and try fully quitting and reopening the browser. If a connection record does appear but shows failure, timeout, or an inability to connect, the traffic has reached the client. Update the subscription, try another node, and confirm that the local network can access ordinary websites normally.

If only a few sites fail while other sites that require a proxy work, the basic connection is probably working. The issue may involve subscription rules, domain resolution, or the target site itself. Do not reinstall the client or clear every configuration. Record the affected domain, the matched rule, and the selected policy, then continue symptom-based checks in FAQ; this is more effective than repeating the entire setup.

If the browser works but a game, command-line tool, or standalone app has no connection record, that program probably ignores system proxy settings. The basic configuration is still working; only the capture scope differs. You can configure a proxy specifically for that program or enable TUN mode after understanding its permission and DNS implications. Do not equate one uncaptured program with a failed subscription import.

Daily tasks after setup

Update subscriptions, switch policies, and exit safely

After the first connection works, daily use usually involves three tasks. The first is updating the subscription: when the node list changes, an existing node repeatedly fails, or the provider announces an update, return to the configuration page and click “Update” beside the active subscription. Afterward, confirm that it is still the active profile so the client does not switch to another local configuration after importing new content.

The second is switching policies. When network conditions change, choose another node or an automatic selection policy in the main policy group; there is no need to import the same subscription again. Reopen the target page after switching and watch for a new connection record. Existing long-lived connections may continue using the previous policy, so a new tab or restarting the relevant app gives a clearer result.

The third is exiting correctly. When you no longer need the proxy, turn off the system proxy before exiting the client. This prevents the operating system from retaining a proxy address whose listener has stopped. Some clients restore system settings automatically on exit, but turning off traffic capture first makes the current state easier to confirm. On mobile, disconnect from the client and then verify in the system interface that the VPN connection has ended.

A subscription URL is effectively a credential for accessing configuration, so do not publish it, forward it to public forums, or write it into a public configuration file. To set up another personal device, copy the URL again from the service management page and import it through the client’s built-in subscription entry. If the link expires, update it through the original service rather than looking for a so-called universal subscription from an unknown source.

You now have the basic Clash workflow: the configuration supplies rules and policies, proxy mode determines routing, the system proxy handles common apps, and the Connections page verifies the actual path. To learn about TUN, DNS, rule priority, configuration structure, and long-term maintenance, open the From Beginner to Advanced user manual. For specific errors or problems such as “the internet stops working after enabling it,” go straight to FAQ and troubleshoot by symptom.