Clash Setup Guide: Four Steps to Import a Subscription and Verify the Connection

Confirm two things before you begin. First, you have any Clash-based client installed and running: Clash Plus or Clash Verge Rev is recommended for Windows and macOS, and Clash Plus or Clash Meta for Android is recommended on Android; installers and system requirements for each platform are grouped on the downloads page. Second, you have a working subscription link — a URL starting with https://, provided by your proxy service in its user panel, which the client uses to pull the full configuration including nodes and rules.

Be careful to tell "subscription link" apart from "node share link": the former returns a complete YAML config or a convertible node list and can simply be pasted into subscription management; the latter is a single-node URI such as ss:// or vmess:// — some clients support importing these individually, but they carry no routing rules and aren't suitable for everyday use. For the structural differences and how to convert between the two, see Understanding Subscription Formats; term definitions used throughout are collected in the Glossary and won't be repeated here.

After launching the client, find the "Subscriptions" entry in the sidebar or bottom tab bar (some clients label it "Profiles"); this opens the subscription management page, which is empty the first time you use it. Look for a "New / Import / +" button near the top of the page, click it, choose "Import from URL," and paste the full subscription link into the field — make sure there's no leading or trailing whitespace and that the link starts with https:// — then click "Download" or "Confirm." The client immediately requests that address, and within a few seconds a new configuration entry appears in the list, usually showing a name, update time, and traffic info.

After a successful import, do two things. First, tap the entry to make it "Selected / Active" — only a selected profile actually takes effect, and this step is easy to miss when several subscriptions are present at once. Second, open the entry's edit or settings option and set the "Auto-update interval" to around 24 hours: providers adjust nodes from time to time, and auto-updating keeps your node list from going stale. Once that's done, switch to the "Proxies" page — you should see nodes grouped by policy group. Seeing node names there confirms the subscription imported correctly, and you can move on to the next step.

If the import fails or the list stays empty, try opening the subscription link directly in a browser: if it returns text (YAML or a Base64 string), the link itself is valid and the issue is more likely on the client's networking side; a 404 or timeout means the link has expired and you'll need to copy a fresh one from your provider's panel. If a URL isn't convenient, you can also save the config text your browser retrieved as a .yaml file and load it via "Import from file" on the subscription page — it works the same way, just without auto-update.

Back on the client's main screen, find the mode switcher, which usually offers three options. "Rule mode" matches each connection against the routing rules in your config: local and LAN traffic connects directly while everything outside your region goes through the proxy — this is the recommended default for daily use. "Global mode" pushes all traffic through the proxy indiscriminately, so even local sites get routed through a node and speeds actually drop; it's only useful for temporarily checking whether a specific site should be proxied. "Direct mode" bypasses the proxy entirely, effectively turning routing off. Set the mode to Rule mode; the rule-matching order and syntax details are explained step by step in the rules section of the Configuration Guide.

With a mode chosen, switch to the "Proxies" page to pick an exit node. Nodes are organized into policy groups — common group names include "Proxy Select," "Auto Select," and "Fallback," with meanings defined by whoever provides your subscription. In the top-level manual-selection group, click the "Latency Test" button (a lightning bolt or waveform icon) in the top-right corner; the client pings every node in the group, and within a few seconds a millisecond figure appears next to each one — green means low latency, and nodes showing a timeout are temporarily unavailable. Click a node with lower latency and a region that fits your needs; its name highlights to show it's now the active exit.

Two things worth knowing: first, the latency figure only reflects handshake time, not download bandwidth — an 80ms node isn't necessarily faster than a 150ms one, so judge by actual use; second, if the policy group includes an "Auto Select (url-test)" group, selecting it lets the client periodically re-test and switch to the fastest node automatically, handy if you'd rather not manage this manually. For a layered approach to troubleshooting disappointing speeds, see Diagnosing Slow Speeds in Three Layers.

Picking a node doesn't automatically route traffic through the proxy — you still need to tell the operating system to hand requests over to Clash. On Windows and macOS, find the "System Proxy" toggle on the main screen or settings page and turn it on; the client points the system's HTTP and SOCKS proxy settings to the local listening port, commonly 127.0.0.1:7890 by default. Once the toggle is on, your browser and most apps that respect system proxy settings start routing through Clash from that moment. You can confirm the port number in the client's settings or the config file's mixed-port field, and switch to a free port if it's already in use.

Android works a little differently: the main screen has a prominent start button, and tapping it triggers a system VPN connection request — approve it, and a key icon in the status bar confirms the VPN tunnel is up, meaning all app traffic now flows through Clash without a separate system proxy setting. macOS users may hit network extension approval and keychain access prompts the first time they enable system proxy or TUN mode; mishandling these can stall the startup process, and step-by-step guidance is available in Handling macOS Permission Prompts.

Two optional settings you don't need to touch yet: "TUN mode" takes over all traffic — including command-line tools and games — via a virtual network adapter, covering apps that ignore the system proxy, but it requires administrator privileges and interacts with DNS settings, so it's worth reading up on in the Configuration Guide once the basic flow is working; "Launch on startup," once enabled in the client settings, restores the proxy state automatically on boot and suits long-term use, but during initial setup it's easier to observe behavior by starting and stopping things manually.

A toggle being on doesn't guarantee the proxy is doing anything — finish with two checks. The first uses the client's own panel: open the "Connections" or "Logs" page, then visit any website outside mainland China in your browser. If the proxy is working, the connections page scrolls with new entries in real time, each labeled with the target domain, the rule it matched, and the node actually used — seeing your target domain routed through your chosen node confirms routing is behaving as expected; if an entry shows DIRECT, that domain was matched to a direct rule, which is normal routing, not a failure.

The second check uses the command line for an unambiguous result. Open a terminal (PowerShell on Windows) and run the following command, forcing the request through your local proxy port to an IP-checking endpoint:

curl -x http://127.0.0.1:7890 https://api.ip.sb/ip

The command returns an IP address — if it matches your chosen node's region rather than your local broadband's exit IP, the proxy chain is fully working. If the command reports "connection refused," the port number likely doesn't match what the client is actually listening on; go back to the settings page, double-check mixed-port, and try again.

If the panel shows a connection and the command returns a node IP, but pages still won't load in your browser, the culprit is usually one of three things: the browser isn't picking up the system proxy, a DNS resolution issue, or a rule mismatch — check them in order to pin it down, with a full checklist in Connected But No Internet: A Troubleshooting Checklist. At this point, the basic setup is complete: subscriptions update automatically on schedule, and day-to-day use is just switching nodes on the Proxies page — everything else can stay as it is.