Clash Guide: From Subscription Import to Connection Verification

Step 1: Import the Subscription and Select the Configuration

After opening the client, go to the “Subscription,” “Config,” or “Profiles” page. Desktop clients usually place this entry in the left navigation, while mobile clients may put it at the top of the home screen or inside Settings. Find the URL field, paste the complete subscription URL you prepared, and click “Import,” “Download,” or the confirmation button on the right. Some clients ask for a configuration name first. This name is only for local identification—you can use the service or purpose, and it does not change the subscription content.

After clicking Import, wait for the request to finish instead of clicking repeatedly. Normally, a new item appears in the configuration list with its name, update time, or an update button. You must then click the item to make it active; appearing in the list alone does not mean the client is using it. Common indicators include a brand-colored marker, a changed background, a selected radio button, or the current configuration name shown at the top of the page.

After selecting the configuration, switch to the “Proxy” or “Policy Groups” page. You should see the policy groups defined in the configuration, such as “Auto Select,” “Node Selection,” “Failover,” or “DIRECT.” Names vary by subscription, so they do not need to match these examples exactly. The key check is that the policy group page contains content rather than remaining blank, loading indefinitely, or showing only an error. If it is still empty, return to the configuration page and verify that the imported item is enabled.

Set Up Automatic Updates

After the subscription imports successfully, check the update interval in its configuration details. Common options include hourly updates or manual refreshes. During basic setup, frequent refreshing is unnecessary; unless the provider announces a change, keep the client's default interval. Updating fetches the configuration again but usually does not change the system proxy switch. If the policy groups change after an update, simply confirm the current selection again.

If the subscription import fails, first check that the URL is complete, then try fetching it again on the current network. A timeout usually means the client did not retrieve the configuration within the allowed time; a format error means the response is not YAML the client can recognize. Do not fix format issues by changing file extensions, and do not save a web error page as a configuration file. Find related errors under “Installation and Configuration” in Troubleshooting.

Once the configuration is selected and the policy groups open normally, subscription import is complete. The next step only determines how the client handles connections; you do not need to import the configuration again.

Step 2: Choose a Proxy Mode and Policy Group

Open “Mode,” “Proxy Mode,” or the mode selector on the home page. Most Clash clients offer three basic modes: Rule, Global, and Direct. For initial setup, choose “Rule” mode, commonly called Rule mode. It reads the rules in the current configuration and checks the destination domain, IP address, or rule set from top to bottom. After the first match, it hands the connection to the corresponding policy. This sends connections that need a proxy through the proxy policy while keeping LAN traffic and configured services direct.

Global mode sends most connections through one proxy policy. It is useful for briefly checking whether the proxy itself works, but not for determining whether the rules are correct. Direct mode bypasses the proxy and is commonly used to pause proxying or run comparison tests. For everyday setup, keep Rule mode selected and switch to Global or Direct only temporarily while troubleshooting.

Choose an Available Item in the Policy Group

With Rule mode selected, open the “Proxy” page and find the policy group handling the main proxy traffic. It may be called “Node Selection,” “Proxy,” “Manual,” or another name defined by the provider. Expand the group and choose the provider-recommended automatic policy or another currently available option. A policy group sits between the rules and the actual connection method: rules usually hand traffic to a policy group, which then selects the specific option to use.

If the configuration contains multiple policy groups, do not change them one by one. Start with the top-level main selection group and leave the other groups at their defaults. For example, when rules send streaming, downloads, and common websites to separate groups, those child groups usually already have default options. Changing too much at once makes troubleshooting harder. Adjust individual groups only after connection verification succeeds.

Labels such as “Auto Select,” “Load Balance,” and “Failover” describe how a policy group works; they are not proxy modes. Proxy mode determines whether the client reads rules, while the policy group chooses the path after a rule matches. These concepts are easy to confuse—see Clash Concepts at a Glance for detailed definitions.

Step 3: Start the Core and Enable System Connectivity

Return to the client's home or “Settings” page and check the core status first. Some clients start the core automatically after installation and show “Running” immediately; others require you to click a start button. The configuration and rules only handle connections once the core is running. If enabling the system proxy has no effect, first check whether the core is still stopped.

Once the core is running, enable “System Proxy” on desktop first. Windows and macOS write the client's local proxy address to the system network settings, allowing browsers and other apps that follow system proxy settings to send connections through Clash. When enabled successfully, the switch stays on and the corresponding proxy entry appears in the system network settings. For the first test, do not enable TUN mode at the same time; fewer variables make verification easier.

Android and iOS clients usually intercept traffic through the system VPN interface. After tapping “Connect,” “Start,” or the home-page switch, the system displays a VPN permission prompt. Confirm that the app name matches the current client and allow the connection; a system VPN indicator should then appear in the status bar. This mobile VPN interface passes traffic to the local proxy core and does not necessarily mean a traditional enterprise VPN is being used. Actual routing is still determined by the current Clash configuration.

When to Use TUN Mode

TUN mode creates a virtual network interface that can intercept more apps that ignore system proxy settings. It is also useful for UDP traffic and command-line programs. If a browser works normally through the system proxy but a particular app consistently bypasses it, consider enabling TUN. The first desktop activation may request administrator access or installation of a network component; complete the authorization in the client and then check the core status again.

System Proxy and TUN cover different types of traffic. Some clients allow both to be enabled, but basic setup is easier when you verify one primary interception method at a time: use System Proxy for browser testing first, then disable it and test TUN when broader coverage is needed, or follow the combination recommended by the client. If the network goes offline, this makes it easier to tell whether the cause is the configuration, virtual interface, DNS, or permissions.

Avoid Conflicting Network Tools

Before connecting, check whether other proxies, VPNs, network filters, or packet-capture tools are still running. When several programs modify the system proxy, routing table, or DNS at once, every interface may show “connected” while traffic actually follows a different path. During basic verification, keep only the current Clash client active; temporarily disable standalone proxy extensions in the browser as well. Restore only the tools you genuinely need, one at a time, after verification.

If the system proxy switch turns off immediately, check whether the core is running, whether system permissions allow proxy changes, and whether another program is using the client's port. If TUN fails to start, return to System Proxy and complete the browser test first, then review TUN permissions, virtual adapters, and DNS under Troubleshooting. Do not change the port, DNS, and rules simultaneously before a connection is established.

Once the client shows the core as running and System Proxy or the mobile VPN is enabled, proceed to verification. An enabled switch is only a prerequisite; use real connections and logs to confirm that traffic is actually following the expected rules.

Step 4: Verify the Connection and Rules

Close any test pages you opened earlier, then open a new browser tab and visit a commonly used website. A new connection avoids interference from cached pages, existing long-lived connections, and browser preloading. After the page loads, do not rely on the page alone. Switch back to the Clash client's “Connections” page and check for a new record corresponding to the destination you just visited.

A connection record usually shows the destination domain, connection type, matched rule, or policy used. Fields vary by client, but new connections should keep appearing. Open a record and confirm that it went through a policy group in the current configuration rather than showing DIRECT for everything. DIRECT is normal when visiting a LAN address that should bypass the proxy; judge the result by the destination type instead of treating every direct connection as a failure.

Next, run a routing comparison: visit a service that the configuration should access directly, then one that should use a proxy policy. Return to the connection records or logs and compare the matched rules. In Rule mode, logs commonly include information such as DOMAIN-SUFFIX, GEOIP, GEOSITE, or MATCH. If the two destinations follow their expected paths, the subscription, Rule mode, policy group, and system interception are working together.

Use Logs to Find the Failing Layer

If the page will not open but a connection record already appears, System Proxy or VPN interception is probably working. The issue is more likely the policy choice, remote connection, DNS, or rule result. Open “Logs” and review entries from the time you visited the site. If a connection timed out after being sent to a policy, switch back to the provider's automatic policy and test again. If DNS resolution failed, check the DNS configuration and local network first.

If no new record appears at all when you visit a page, the problem usually occurs before traffic reaches the core. On desktop, check that System Proxy is still enabled and that the browser is not using separate proxy settings. On mobile, check for the system VPN indicator and whether power-saving settings stopped the client. In TUN mode, also confirm that the virtual interface actually started rather than merely displaying an enabled switch.

After verification, keep Rule mode and the current main policy group. Future subscription updates usually do not require repeating the entire process; update the configuration and confirm that it remains selected. If access suddenly fails after an update, note the configuration name and time before and after the update, then check the mode, policy group, and system switch in order. Do not start by deleting every configuration.