Clash Subscription and Connection Guide

STEP 01 / PROFILE

Import a Subscription and Enable the Configuration

Import the configuration before enabling the proxy. Your proxy service usually provides the subscription URL, which downloads configuration data such as nodes, policy groups, and rules. Use the format specified by the service as compatible with Clash or mihomo—not an account sign-in page, purchase page, or help article. Check that the copied URL has no extra spaces, line breaks, or punctuation added by a chat app, and preserve its original query parameters.

Add a Subscription URL

Open the client and go to Config or Profiles. Look for Add, Import, or Import from URL. If you’re asked to choose between a remote and local configuration, enter the subscription URL in the remote configuration field. Give it a short, recognizable name if needed. Submit it and wait for the download and parsing to finish. Avoid clicking Import repeatedly, which can create duplicate entries.

A successful import usually appears as a configuration card or entry. Select it; if the client also has an Enable or Use option, select that too. Then open Proxies and check that policy groups and nodes are listed. An entry in the list only means the file was saved—it doesn’t necessarily mean the core is using it. Confirm both that the configuration is selected and that its contents appear on the Proxies page.

Use a Local File or Update an Existing Configuration

If you have a .yaml or .yml file, use the file import option to select it. Don’t paste its file path into the subscription URL field. Some clients also let you paste configuration text. Select and enable the configuration after importing. Unlike a remote subscription, a local file usually won’t fetch server-side updates automatically. If the nodes change, download a fresh file or switch to a remote subscription explicitly provided by the service.

To refresh an existing subscription, use Update or Refresh on its entry. Afterward, make sure it’s still selected and check that your previously chosen node is still available. A remote update may overwrite edits made directly to the configuration, so avoid editing a downloaded file while repeatedly refreshing the subscription. For custom rules you want to keep, see Advanced Setup.

If the import fails to download, check that the URL is still valid, your network can reach the subscription server, and the server isn’t returning a sign-in page. If the download succeeds but parsing fails, check whether the format is compatible with your core before changing proxy modes. For specific errors, see Troubleshooting. Once the Proxies page shows valid policy groups, continue by choosing a mode and exit.

STEP 02 / POLICY

Choose Rule Mode and a Proxy Policy

For your first setup, choose Rule mode. You may find the mode selector on the home screen, at the top of the Proxies page, or in Settings. Rule mode uses the configuration’s rules to decide whether traffic is direct, proxied, or rejected. It doesn’t automatically determine what every website is for: the result depends on the active rules and policy groups. Before switching modes, make sure the configuration you imported in step one is enabled.

The Three Proxy Modes

Rule mode is suited to everyday use: selected traffic can go through a proxy while other requests connect directly. Global sends traffic that reaches the core through the exit chosen by the global policy, making it useful for temporarily troubleshooting rules. It does not guarantee that every app on your device routes through the core. Direct sends traffic that reaches the core straight to its destination; it does not enable proxying. The mode controls how traffic is handled once it reaches the core, while the system proxy or TUN controls how traffic gets there. They are not interchangeable.

Choose a Node in the Policy Group Used by Your Rules

After selecting Rule mode, open the Proxies page. Policy group names depend on the configuration author: a group might be called Proxy or have a localized name, so don’t look for one exact label. Find the selector for regular proxy traffic, open it, and choose a working node. If it lists another policy group, open that group too and confirm the final node or auto-test group. Otherwise, the outer group may look selected while the inner group is still set to DIRECT.

A manual selection group lets you pin an exit; an auto-test group may change exits based on its configured tests. For your first check, pin a node in a group that supports manual selection to avoid exit changes during testing. If the client offers a connection test, run it and wait for the result. The test target may differ from your actual traffic: a successful test confirms only that the test completed, not that every website or app will work.

mode: rule
rules:
  - DOMAIN-SUFFIX,github.com,Proxy
  - GEOIP,CN,DIRECT
  - MATCH,Proxy

This example sends matching GitHub domains to Proxy, then applies a geo-IP rule to IP addresses in mainland China, and sends any remaining connections to Proxy. Rules are checked from top to bottom; processing stops at the first match. Proxy is an example policy group name, which must be defined elsewhere in a complete configuration. This snippet explains how rules work; it is not a replacement for a working subscription.

You should now have two clear settings: the mode is Rule, and the proxy policy group has a suitable exit. If you’re unsure how nodes differ from policy groups, see the glossary. Next, focus only on routing traffic so you can confirm whether the connection is actually established.

STEP 03 / CONNECTION

Enable the System Proxy or Mobile VPN

Once the configuration and policy are ready, check that the client’s core is running. Some desktop clients start it automatically; others require you to click Start first. Mobile clients often combine starting the core and establishing the VPN in a single Connect action. An open client window doesn’t mean the proxy is running: configuration errors or an occupied listening port can prevent a connection.

On Desktop, Test Your Browser with the System Proxy

Turn on System Proxy from the client’s home screen or Settings. This usually points your system proxy address to a port the client is listening on. Browsers that follow system proxy settings will then send requests through the client. Keep the client running and test in a regular browser window. If you use a separate proxy-switching extension, check whether it overrides the system settings and sends traffic through a different exit.

A system proxy does not route traffic from every app. Some apps have their own proxy settings; others connect directly. Command-line tools may not automatically use the desktop system proxy, so a successful browser test doesn’t prove terminal traffic is proxied. To configure an app separately, use the address and port the client is actually listening on. 7890 is a common example, not a guaranteed default. You don’t need to enable LAN access for initial setup.

On Mobile, Approve the System VPN Request

Android clients usually have a Connect button. When you tap it, Android asks for permission to establish a VPN connection. Verify that the request is from the client you installed, then allow it and check the client’s status. On iOS, the client may ask to add a VPN configuration the first time you connect. Follow the system prompts, then return to the app and connect. A VPN icon in the status bar confirms the system tunnel is up; verify the actual proxy exit in the next step.

If another VPN app is running, disconnect it before testing to avoid competing for the system VPN connection. On Android, if the connection often drops when the screen locks or you switch apps, check whether battery management is restricting background activity and adjust it as the client recommends. Settings vary by device; you don’t need to disable all system protections. Devices managed by a school or employer may restrict VPN configurations, so follow your organization’s requirements.

Enable TUN Only If You Need It

Consider TUN only if your desktop browser works but a specific app ignores the system proxy. TUN routes traffic through a virtual network interface and may require a system service, permissions, and routing changes. Install the required service or grant permissions as prompted by your client before enabling it. Don’t turn on every network option just to test a webpage. For TUN and DNS settings, see Advanced Setup; for now, keep the client’s recommended defaults.

After this step, don’t rely only on a “Connected” status. Keep the mode, configuration, and node unchanged, open a new webpage, and check where its traffic goes in the next step. If no webpages load after enabling traffic routing, turn off the routing option you just enabled to restore your normal connection, then troubleshoot in the order described in the final step.

STEP 04 / CHECK

Verify the Connection and Traffic Logs

Check both the result in your browser and the client’s logs. A webpage may open because its rule chose a direct connection; a VPN icon doesn’t prove the node works. Start by opening a public site you expect to use the proxy, such as https://github.com/ with the example rules. Reload the page or open it again. Choose a test target that matches your own rules; whether one site loads is not a complete test of your network.

Check the Matched Rule and Actual Exit

Open the client’s Connections page while the webpage loads and look for its domain or destination address. Fields vary by client; focus on the destination, matched rule, policy group, and proxy chain. If you expect traffic to use a proxy, the record should show the selected proxy exit. If it shows DIRECT, check the mode, rule order, and current policy group selection before assuming the node has failed.

Some connections last only briefly and disappear from the active list as soon as a page loads. Keep the Connections page open while reloading, or use the client’s logs to help. Don’t leave verbose logging enabled just to capture one entry: logs may contain visited domains, so redact sensitive information before sharing them. After switching nodes, existing long-lived connections may still use the old exit. Start a new request or restart the app to get a more reliable result.

To check your exit IP, you can also use a trusted IP lookup page, but confirm that the lookup request itself matches a proxy policy. In Rule mode, different destinations may use different exits, so one lookup does not represent every app on your device. Once the browser test passes, test the apps you actually use one by one. Check whether each follows the system proxy or needs TUN to route its traffic.

Troubleshoot in This Order

1. Check the configuration first. Make sure the configuration you just imported is enabled, the Proxies page isn’t empty, and the logs show no parsing errors. A failed subscription update and a failed proxy connection are separate issues; troubleshoot them separately.
2. Next, check the exit. In Rule mode, confirm the policy group used by the destination isn’t set to DIRECT. Pin one node for testing. If needed, try another available node from the same subscription, changing only one selection at a time.
3. Then check traffic routing. If there’s no matching connection entry when you make a new request, check the system proxy, the app’s own proxy settings, or the mobile VPN status. If an entry appears but the connection fails, check the node and network reachability.
4. Check DNS and other details last. Investigate DNS in the logs only if you see a specific name resolution error. Don’t start by deleting all DNS settings. For related concepts, see the glossary; for specific fixes, see Troubleshooting.

To tell a rules issue from a node issue, briefly switch to Global, choose an exit in its global policy group, and make a new request to the same destination. If Global works but Rule doesn’t behave as expected, review the rules and policy groups. If both fail, keep checking the exit, traffic routing, and network. This is only a troubleshooting step: switch back to your usual Rule mode afterward so you don’t leave a temporary test setting in place.

For everyday use, keep your subscription active and update it when the service changes its configuration. When you’re done, turn off the system proxy or disconnect the mobile VPN before quitting the client. If you lose internet access after closing the desktop client, check whether the system proxy still points to a local service that has stopped. For custom routing, merged subscriptions, or network stack changes, see the Advanced Setup Guide; you don’t need to configure everything on your first connection.