Clash Setup Guide: From Importing a Subscription to Verifying It Works
This page follows one continuous workflow: prepare → import the subscription → choose a mode → start the connection → verify. Follow the steps in order to complete your first setup; each section has an anchor so you can jump around from the table of contents anytime. If you haven't installed a client yet, grab a build for your system from the download page first.
This guide follows the workflow rather than any single client's screenshots. Menu naming varies slightly across Clash Plus, Clash Verge Rev, FlClash, and others — "Subscription" is sometimes called "Profile" or "Profiles," and "System Proxy" is occasionally labeled "Set as System Proxy." If a label doesn't match, look for the function instead: any page that accepts a pasted link is the subscription entry, and any toggle-style button is the connection switch. See the client comparison guide for differences and recommendations.
Preparation: Client and Subscription Link
Before you start, you need two things ready: an installed client and a working subscription link.
-
Install the client
Go to the download page, pick the client for your operating system, and install it. Clash Plus is the top pick across all platforms; Clash Verge Rev is also a common choice on Windows/Linux. Installation works like any other app — if Windows SmartScreen blocks it, see the blog post "Complete Walkthrough: Installing Clash on Windows".
-
Get a subscription link
The subscription link comes from your service provider, usually found in the "Subscription" or "One-Click Subscribe" section of their user panel — just click the copy button. It's a plain HTTPS address that looks like this:
https://example-provider.com/api/v1/client/subscribe?token=a1b2c3d4e5This link points to a complete Clash config file containing nodes, proxy groups, and routing rules. Treat it like an account credential — don't share it publicly. This site does not provide any subscription service; contact your provider for the link.
Import the Subscription
Hand the link you copied in the previous step to the client, which will download and save the full config.
The import entry point varies slightly by client — use the table below to find the right page:
| Client | Subscription Entry | How to Import |
|---|---|---|
| Clash Plus | "Subscription" tab on the main screen | Paste the link → tap "Add" → wait for the download to finish |
| Clash Verge Rev | "Profiles" page on the left sidebar | Paste into the top input box → click "Import" → click the profile card to select it |
| FlClash | "Profiles" page at the bottom | Tap the "+" in the bottom right → choose "URL" → paste and save |
| Clash Meta for Android | "Profile" → New Profile → URL | Enter the link and save, then check the profile in the list |
The import process has three observable checkpoints: after pasting and confirming the link, the client shows a download progress bar or a brief loading state; once the download completes, the subscription list shows a new entry with a name and update time; switching to the "Proxies" page, you should see proxy groups and a node list — seeing the node list means the import succeeded, and you can move on. If nothing happens for a long time or you get an error right after confirming, it's usually an incomplete link or a network issue — see Troubleshooting at the end of this page.
If you don't have a subscription link and only have a config.yaml file, use the same entry point and choose "Import from File" (or "Local Import"), or simply drag the file into the client window. See Config File Overview on this page for what each field means.
Choose a Proxy Mode
After importing your subscription, check the mode setting first. Mode determines "which traffic gets proxied," and picking the wrong one is the most common beginner mistake.
Rule Mode
Matches traffic against the rules section in the config file one entry at a time: traffic hitting a direct rule skips the proxy, everything else is routed through a proxy group. Use this for everyday browsing — the routing logic is maintained by whoever put together the subscription, so manual tweaking is rarely needed.
Global Mode
Ignores all rules and sends every connection through the currently selected node. Useful for temporarily checking whether a rule is failing to match a particular site — switch back to Rule mode once you're done, or even local traffic will get routed through the proxy.
Direct Mode
Sends all traffic directly, bypassing every node. Effectively disables the proxy while keeping the client running — useful for comparing speeds or ruling out the proxy as a cause.
The mode switch usually sits on the client's main screen or at the top of the "Proxies" page, with the three options side by side — tap one to switch instantly. It maps to a single field in the config file:
mode: rule # Options: rule / global / direct — rule is recommendedOnce the mode is set to Rule, go to the "Proxies" page and pick a node inside a proxy group — the default group is usually named PROXY or something custom set by your provider. Open it and click any node to select it. How to pick a node is covered together with the latency test in the verification step below.
Start the Connection
Launching the client only makes it "listen on a local port" — you still need one more step to point system traffic at it.
-
Desktop: turn on the System Proxy switch
Find the "System Proxy" switch in the client's settings or main screen and turn it on. This points your OS-level proxy settings at Clash's mixed port (
127.0.0.1:7890by default), so browsers and most apps that respect the system proxy will route through it. On macOS, the first time you enable it you'll get an authorization prompt — just enter your system password. On Windows, once it's on, you'll see the corresponding entry under "Settings → Network & Internet → Proxy." -
When you need to capture all traffic: TUN mode
Some apps — command-line tools, certain games and client software — don't read system proxy settings. If those need to be proxied too, turn on "TUN mode" instead: the client creates a virtual network adapter and intercepts all traffic at the network layer. TUN mode requires admin/system extension permissions — follow the client's prompts to grant access and install the service the first time. You only need one of System Proxy or TUN, not both.
-
Mobile: authorize the VPN tunnel
On Android, tap the start button on the main screen; the system will prompt a VPN connection request — tap "OK," and a key icon in the status bar confirms you're connected. On iOS, Clash Plus similarly asks to add a VPN configuration the first time you launch it — allow it in the system prompt, and after that, starting and stopping is a single tap inside the app.
If startup shows bind: address already in use, port 7890 is already taken by another process — commonly a different proxy client that's still running. For the exact commands to find and free the port, see the blog post "Fixing Clash's 'Port Already in Use' Error."
Verify It's Working
Don't judge proxy status by whether a webpage loads — run a command-line check instead for a clear, repeatable result.
Open a terminal (Windows 10 and later ship with curl.exe, usable directly from PowerShell or CMD) and run the following command to force the request through Clash's local mixed port:
curl -I -x http://127.0.0.1:7890 https://www.google.com/generate_204If the first line of the response shows HTTP/2 204 or HTTP/1.1 204 No Content, the whole chain — local machine → Clash → node → target site — is working. Here are three common failure outputs and what they mean:
Connection refused: Clash isn't listening on port 7890 — either the client isn't running, or the config uses a different port. Go back to the previous step to check;timed out: the request reaches the node and stalls there — the current node isn't working, try a different one;- A
200response with an ISP landing page as the content: the request never actually went out — check whether the mode is mistakenly set to Direct.
Node latency test
Once the command check passes, run a latency test on your proxy group from the "Proxies" page (usually a lightning bolt or speed-test icon in the top-right corner of the group). Each node will then show a millisecond value — lower means faster response, so prefer nodes with a low and stable value. Nodes showing "timeout" are currently unusable, so skip them. If values swing wildly or are all high, see Troubleshooting for causes and fixes. At this point, your first setup is complete.
Config File Overview
Importing a subscription is really just downloading a YAML config file. Knowing a handful of core fields saves time when troubleshooting.
# config.yaml core fields (excerpt, with comments)
mixed-port: 7890 # Shared HTTP/SOCKS5 listening port
allow-lan: false # Whether other devices on the LAN can use this machine's proxy
mode: rule # Proxy mode: rule / global / direct
log-level: info # Log level, can be set to debug temporarily when troubleshooting
external-controller: 127.0.0.1:9090 # External control API, used by dashboard-style tools
proxies: [] # Node list, filled in by the provider's config after a subscription import
proxy-groups: # Proxy groups: define "which traffic goes to which node"
- name: PROXY
type: select
proxies: []
rules: # Routing rules, matched top-to-bottom, first match wins
- DOMAIN-SUFFIX,cn,DIRECT
- GEOIP,CN,DIRECT
- MATCH,PROXY # Fallback rule: anything not matched above goes to the PROXY groupManual edits only take effect after you reload the config or restart the core in the client. Subscription-based configs get overwritten by the provider's content every time they update, so for lasting customizations, use the "Override/Merge" feature the client provides. DNS-related fields (nameserver, fallback, etc.) are more involved and covered separately in "Breaking Down Clash's DNS Configuration."
Troubleshooting
If you followed the steps and something still isn't working, check here first. Each entry follows a "symptom → cause → fix" structure.
Subscription update fails with a timeout or 404
There are two distinct causes here. A 404 or 403 means the link itself is dead — go back to your provider's panel and copy a fresh link; note that some panels invalidate all old links after a redesign. A timeout means the request to download the subscription is being blocked on the network — most clients have a "Update subscription via proxy" option; turn it on (assuming you already have a working node) and update again. On a first import with no working node yet, try completing the import on a different network first, such as a phone's mobile hotspot.
Subscription imports successfully but no nodes show up
This is usually caused by an empty or malformed subscription. Check the file size in the subscription list or view its content: if the proxies section is an empty array, the provider's config genuinely has no nodes (often because the plan expired) — this has nothing to do with the client. If the content is HTML instead of YAML, the link points to a webpage rather than the subscription endpoint — go back to the panel and copy the link labeled for the "Clash" format.
Client shows connected, but the browser can't load pages
Check three things in order along the chain: first, make sure the "System Proxy" switch is actually on (the client running isn't the same as the system proxy being active); second, run the curl command from Verify It's Working — if that succeeds but the browser still doesn't work, check whether a browser extension with its own proxy settings is conflicting with Clash; third, if the command also times out, switch nodes and try again — a single bad node is the most common cause.
Startup error: bind: address already in use
The mixed port (7890 by default) is already taken by another process — common when two proxy clients are installed at once, or when a process didn't fully quit last time. There are two fixes: find and quit the process using the port, or change mixed-port in the config to an unused port (e.g. 7891). For the exact commands on all three platforms and how to change the port, see this dedicated article.
Latency tests time out for all nodes, or values swing wildly
All timing out: first switch to Direct mode to confirm your own network is fine, then check whether your subscription has expired. If the network is fine and the subscription is valid, the provider's nodes are likely down as a whole — wait it out or contact the provider. Values swinging wildly: a latency test only captures the state of the link at that instant, affected by both your local network and the node's current load — go by the median across several tests rather than chasing the single lowest reading; overall higher numbers during peak hours are normal.
Enabling TUN mode disconnects everything instead
TUN mode relies on the client's system service and DNS hijacking setup. First confirm that the authorization/service installation steps were fully completed the first time you enabled it (Clash Verge Rev needs a system service installed, FlClash needs admin rights). If it's still broken, turn off TUN and fall back to System Proxy mode to confirm the basic link works, then check whether enhanced-mode: fake-ip is enabled in the dns section of the config — TUN mode usually needs it. See the DNS configuration article for the details.