Quick Start with Clash

Before You Begin: Client and Subscription

First, visit the client downloads page and choose an installer that matches your operating system and processor architecture. If you’re new to Clash, start with a maintained graphical client and open it after installation. Clash Release Hub lists client downloads and Chinese-language guides; it is not an official developer of any client and does not provide proxy nodes or subscription services. Installing the software does not automatically give you a working proxy connection.

Before continuing, get a valid subscription URL in Clash or mihomo format, or a YAML configuration file containing proxies, policy groups, and rules. Subscriptions are usually provided by the service you use. A regular webpage URL, account login page, or single protocol link may not import as a configuration. If multiple formats are available, choose one compatible with your client’s core.

Subscription URLs may contain account details. When copying one, avoid leading or trailing spaces. Don’t post the full URL in public forums or share screenshots that show it. If another proxy client, VPN, or browser proxy extension is already running, note its settings and temporarily disable it. That makes it easier to tell which program is handling traffic during your first test. Configure one client at a time, then decide whether to combine it with other networking tools once it works.

Step 1: Import and Enable a Subscription

Open the client’s Configuration or Subscription page and look for New, Import, or a plus button. Choose the URL import option and paste in the subscription address. If asked for a name, use something easy to recognize, such as “Daily.” This is only a label in the client and won’t change the remote subscription. Check that the URL is complete, select Import, and wait for the download and parsing to finish.

After a successful import, you should see a configuration entry, usually with a name, source, or last-updated time. Select the entry or use its Enable or Use menu to make it the active configuration. Some clients enable it automatically after import; still, check for a selected indicator. Seeing an entry alone doesn’t mean the core is using that file. This step is complete when the configuration’s policy groups appear on the Proxy page.

Clash Verge Rev: Check the Active Configuration

In Clash Verge Rev, open Configuration, import the subscription URL, then select the card that appears. If the interface offers Update and Edit, don’t mistake Update for Enable: updating fetches the latest content, while selecting a configuration tells the core to use it. Return to Proxy and check for proxy groups. If the configuration appears but the Proxy page is empty, first make sure it’s selected, then check the logs for parsing errors instead of repeatedly toggling the system proxy.

To use a local file, choose File Import or open the YAML file from the Configuration page. Don’t just change the file extension to .yaml; the file itself must use a format supported by the client. Local files usually don’t receive remote subscription updates. If you need ongoing sync, use a URL subscription from a known source with a valid address—not a cloud-drive sharing page posing as a direct configuration URL.

If import fails, first determine whether the network request failed or the configuration couldn’t be parsed. For a network error, check whether the URL has expired, the account is still active, and your current network can reach the subscription service. For a parsing error, check the format and make sure the file doesn’t contain webpage content. Don’t keep importing and creating duplicate entries. If updating the subscription requires a proxy, use an existing working connection or the client’s supported update-proxy setting. See the Troubleshooting guide for details. Once the configuration is enabled, move on to choosing a mode.

Step 2: Choose Rule Mode and a Proxy Group

Open the Proxy page and find the mode selector. Options are usually Rule, Global, and Direct, though they may also appear as 规则, 全局, and 直连. For initial setup, choose Rule. The active configuration evaluates each connection against its rules, sending traffic that needs a proxy to the relevant policy group while handling other traffic as configured. This preserves the subscription’s existing routing and makes issues easier to diagnose in the logs.

After selecting Rule mode, check the policy groups on the page. Group names are set by the configuration author; they might be Proxy, 节点选择, or something else based on their purpose. There’s no single required name across all clients. Find the group used for most proxied traffic, expand it, and select an available proxy or an automatic group already defined in the configuration. Look for a selected border, checkmark, or current member name to make sure your choice was saved before leaving the page.

The group type determines how you choose a member. A select group requires a manual choice; url-test and fallback groups select members using their configured checks, so you don’t need to convert them into manual groups. A group may also contain another policy group. In that case, check the selection at the next level rather than assuming the group name represents a specific exit. Avoid changing several groups at once during initial setup; otherwise, it’s harder to trace what went wrong if the test fails.

Clash Custom Rules: Keep the Original Order at First

Rule mode evaluates rules in order. Once a rule matches, later standard rules are usually not checked. The snippet below illustrates how domain rules, geographic rules, and a final catch-all relate; it is not a complete, standalone configuration. Proxy must match the name of an existing proxy or policy group. If your subscription uses a different name, don’t paste this in as-is.

rules:
  - DOMAIN-SUFFIX,github.com,Proxy
  - DOMAIN-KEYWORD,google,Proxy
  - GEOIP,CN,DIRECT
  - MATCH,Proxy

DOMAIN-SUFFIX matches a domain and its subdomains, DOMAIN-KEYWORD matches a keyword in the domain, GEOIP checks geographic data for the destination IP, and MATCH serves as a catch-all. You don’t need to add these rules manually when getting started; first test the configuration included with your subscription. If you do need to customize rules, check how your client handles overrides or merges. Editing a remote subscription directly can mean your changes are overwritten at the next update. For rule conflicts or unexpected matches, see the Troubleshooting guide.

Global mode can help with a brief comparison test, but it doesn’t mean every app’s traffic is being routed. It only changes how traffic is handled after it reaches the core. Direct mode doesn’t turn off the client; it tells the core to handle connections it receives as direct. Once Rule mode and the main policy group are set, the next step is to route browser or app requests to the core.

Step 3: Enable Traffic Routing

Your configuration and policy group control how the core handles requests it receives; they don’t ensure that every app on your device uses the proxy. Desktop clients usually route traffic through the system proxy, while mobile clients typically use the system VPN interface. Make sure the client hasn’t reported a core startup failure, then enable one routing method for your platform. Test with a browser first; don’t change DNS, routes, and multiple advanced options at the same time.

Desktop: Enable the Clash System Proxy

Find System Proxy on the home screen or under Settings, then turn it on. The client registers a local proxy address and listening port with the operating system. Browsers and apps that use the system proxy can then send requests to the client. Some clients call this option Set System Proxy. You can usually confirm it in your operating system’s network proxy settings, where the address should point to your local device—not to a remote node’s server.

If your browser has a proxy-switching extension, set it to use the system proxy or temporarily disable it; otherwise, it may override the operating system’s settings. Open a new tab and revisit the site after making changes. If needed, close the existing connection and try again. Terminal commands, some games, and apps that manage their own network connections may not use the system proxy. So a working browser alongside an app that still fails doesn’t mean the subscription import failed.

Don’t guess the local listening port. If an app needs a proxy address entered manually, use the current HTTP, SOCKS, or mixed port shown in the client, and make sure the app’s protocol matches the listener type. You don’t need to enable Allow LAN for an initial test. Only change that setting if you need to share the proxy with other devices and understand which networks can access it.

Use TUN Mode Only When You Need Broader Traffic Routing

TUN mode uses a virtual network interface to handle traffic, which can help with apps that ignore the system proxy. It often requires a service component, system authorization, or elevated permissions. If your browser already works through the system proxy, you can leave things as they are. If you do need TUN, follow the client’s prompts to install or enable its service component, then turn on TUN mode and check for permission, virtual adapter, or routing errors. Don’t keep toggling the setting while an error remains unresolved.

System proxy and TUN mode don’t have to be enabled together. When you’re getting started, change one traffic-routing method at a time, verify it, and then decide which setup to keep. If your device also runs a corporate VPN, virtual machine network, or security software, check compatibility requirements first. If local network access breaks, undo the last change and see the Troubleshooting guide for routing and DNS checks instead of layering on more settings.

Android: Start Clash Meta and Approve VPN Access

After enabling the configuration on Android, return to the client’s home screen and tap Start or Connect. The first time you connect, Android usually asks for permission to set up a VPN. Read the prompt and approve it; this lets the client create a local VPN interface and does not mean you’ve purchased a separate VPN service. Once connected, you’ll usually see a VPN icon in the status bar and a running status in the client. Button names and status indicators vary by version, so follow what appears on your device.

If another VPN app is connected, disconnect it before starting this client. Android generally doesn’t allow two regular VPN services to route traffic for the same user at once. If per-app routing is enabled, make sure the browser you’re testing is included. If you use a bypass list, check that the browser hasn’t been excluded. If the connection only stays active while the app is in the foreground, check whether battery management is restricting background activity. There’s no need to grant every extra permission right away.

On iOS, choose Clash Plus from the iOS client downloads, enable the configuration using the app’s import flow, then follow the system prompts to allow a VPN configuration. Once connected, continue to the next step and verify using an actual request and the records visible in the client—not just the status bar icon.

Step 4: Verify with Connections and Logs

Leave the client running, open a site to test in your browser, then check whether its domain or destination appears on the Connections page. To avoid stale connections, make the request in a new tab. If the destination still doesn’t appear, close the site’s tab and open it again. A connection record means the request reached the core, but you still need to check which rule matched and which route it used.

Open the Logs page and set the log level high enough to show connection details, such as info. Visit the test site again. Some clients only keep logs from startup, so watch the logs as you reproduce the request. Filter by the destination domain to reduce noise from background traffic. The line below is an example format using a sample domain; it does not represent a real record from this site.

[TCP] 127.0.0.1 --> www.example.com:443 match DomainSuffix(example.com) using Proxy

Start with the destination address and make sure the record corresponds to the request you just made. Then check the rule type and content after match, followed by the policy after using. If the log shows DIRECT, the request went direct according to the configuration. A page loading successfully doesn’t mean it used a remote proxy. If the log shows a proxy group name, check the connection details or the group’s current selection to find which member actually handled the request.

Verify at three levels: did the request reach the client, did it match the expected rule, and did it succeed through the selected outbound? An enabled system proxy alone doesn’t prove the last step worked. A changed external IP doesn’t prove every app is being routed, either. If you need to check the exit IP, you can use a trusted IP lookup service as a reference, but rely on the connection details for the specific request. Don’t treat one lookup as a definitive result for the entire device.

If the browser can’t open a page and there’s no new record in the client, go back to Step 3 and check the routing method, browser extensions, and per-app settings. If the destination appears but the connection times out, check the main proxy group and try a known-working member before testing again. If the logs report a DNS resolution error, keep the original configuration and note the error; don’t change several DNS settings at once. These symptoms occur at different stages, so troubleshoot them in order.

Ongoing Use: Update Subscriptions and Exit Cleanly

When starting up for everyday use, first make sure the active configuration is still available, then enable traffic routing as needed. Update subscriptions manually from the Configuration page or use the client’s scheduled updates. After an update, check whether the main policy group selection was preserved. If something stops working afterward, compare the configuration before and after the update instead of reinstalling the client right away. When testing a custom rule, change one target at a time and keep a copy of the original configuration so you can roll back.

Before exiting on desktop, turn off the system proxy or use the client’s normal Exit command so it can restore the system settings. If you force-quit the process and your browser can’t connect, check whether the system still points to the local proxy port that’s no longer running. On mobile, disconnect from the client and confirm the VPN has stopped. Don’t delete the configuration to disconnect: configuration management and traffic routing are separate things.

That’s the end of the quick-start process. If you later run into subscription failures, DNS issues, an inactive system proxy, or client crashes, use the Troubleshooting guide to diagnose the symptoms. To switch clients, see the client comparison. Keep your subscription and any essential local rules, then repeat the four verification steps on this page.