Clash Setup Walkthrough: From Import to Verified Connection

Import Subscription

A subscription link is a long URL starting with https://, provided by your service's dashboard, which the client downloads to get a config file containing nodes and rules. Head to your provider's user center and find "Copy Subscription Link" or similar, then copy the full link to your clipboard. Make sure you copy the Clash-format subscription—some providers offer multiple formats, usually labeled on the button—and the link must be copied in full, down to the last query parameter.

Open the client and go to the config page (both Clash Verge Rev and FlClash have a "Profiles" entry in the sidebar; Clash Plus has it in the bottom or side navigation). There's usually an input field at the top or top-right of the page, or an "Import"/"+" button that reveals one. Paste the subscription link you copied, then click "Import," "Download," or press Enter. The client will then request the subscription URL, which normally completes within a second or two.

Signs of a successful import: a new profile card or entry appears in the list, showing a name and update time—some clients also show traffic and expiry info from the subscription. Click this entry to set it as the active profile (in most clients, one click selects it, and the selected item gets a highlight or checkmark). Once that's done, the subscription is imported.

If the import fails or spins forever, there are usually three causes: the link wasn't copied in full, the subscription itself has expired, or your current network can't reach the subscription server. Try opening the subscription link directly in a browser—seeing a block of text confirms the link works and the issue is on the client side; if it won't open, reset the subscription in your provider's dashboard and try again. See the setup and configuration section in FAQ for a systematic troubleshooting guide.

Subscription is set → next, decide how traffic is routed

Choose Proxy Mode

Clash has three outbound modes that determine how traffic is forwarded: Rule mode matches traffic against the rules in your config file—local addresses go direct, everything else goes through a node; Global mode sends all traffic through the proxy without distinction; Direct mode sends nothing through the proxy. For daily use, pick Rule mode—it balances speed and reliability, keeps local sites direct, and automatically routes overseas sites through a node. Switch to Global mode only temporarily, when you need to check whether a rule is failing to match a specific site.

Where to switch modes: Clash Verge Rev has three mode buttons at the top of the "Proxies" page in the sidebar; FlClash has an outbound mode card on the home screen; Clash Plus has a mode selector on the main screen. Select "Rule" and it takes effect immediately, no restart required.

Next, pick a node. Go to the proxy page and you'll see one or more policy groups—node groups defined in the config file, commonly named things like "Proxy Selector," "PROXY," or "Auto." Expand a manual-selection policy group to see all available nodes and click one to select it. Most clients have a latency test button (a lightning bolt or waveform icon) on the proxy page—click it and each node will show a latency value in milliseconds; prefer nodes with low, stable values, and skip any showing a timeout. Policy group types and how they work have their own entry in the glossary.

If the proxy page is empty with no nodes at all, it means the profile from the previous step wasn't selected, or the subscription content is empty—go back to the config page, confirm the active profile is the one you just imported, and click "Update" manually if needed.

Mode and node are set → next, hand system traffic over to the client

Enable System Proxy

The first two steps only got the client "ready"—your system traffic still isn't routed through it yet. The most common way to route traffic through the client is system proxy: the client writes its mixed port (default mixed-port: 7890) into the OS proxy settings, and any app that follows the system proxy—browsers, mainly—starts sending and receiving traffic through that port.

Where to enable it and first-time authorization, by platform:

• Windows: find the "System Proxy" switch on the client's home screen or in Settings and turn it on. The tray icon usually changes color or gets a badge once enabled, and you can confirm 127.0.0.1:7890 has been written under Settings → Network & Internet → Proxy.
• macOS: also toggle the "System Proxy" switch. The first time, a system dialog asks for your user password—this is normal authorization needed to change network preferences; it takes effect after you enter it. The menu bar icon stays visible.
• Android: GUI clients typically take over traffic via VPN. Tap the start button on the main screen, and the system prompts "XX wants to set up a VPN connection"—tap "OK." A key icon in the status bar means it's running.
• iOS: on first launch, you'll be asked to "Add VPN Configuration." After allowing it, you'll see the entry in the system's VPN list under Settings, and can toggle it directly from within the app afterward.

Flipping the switch doesn't come with much fanfare—the interface won't change much, but the proxy chain is now established. Keep in mind that system proxy only covers apps that "respect system proxy settings"; browsers generally do, but many command-line tools and games ignore it. Taking over all traffic at the network level requires TUN mode, which involves a virtual network adapter and admin privileges—that's advanced territory covered in the corresponding section of the full documentation.

Traffic is routed → last step: confirm the chain actually works

Verify It Works

Don't assume it's working just because the switch is green—spend a minute checking two things.

First, browser-level check. Open a site that was previously unreachable and confirm it loads normally—that means browser traffic is flowing correctly. Also open a local site to confirm speed is normal—under Rule mode, local sites should go direct; if a local site is noticeably slower, a rule may be misrouting it through the proxy, or you may be in Global mode.

Second, client-side check. Switch to the client's "Connections" or "Logs" page and refresh the page you just visited—new entries should keep appearing, each showing the destination domain, the matched rule, and the node used. If overseas domains route through the node you picked and local domains show DIRECT, routing is working as expected. This page is also your most useful tool for future troubleshooting.

If you're comfortable with the command line, you can also compare exit IPs in a terminal:

« Without proxy, returns your machine's public IP »
curl https://api.ip.sb/ip

« Explicitly through Clash's mixed port, returns the node's exit IP »
curl -x http://127.0.0.1:7890 https://api.ip.sb/ip

If the two commands return different IPs, the proxy chain is confirmed working. If the second command returns a connection refused error, check that the port matches the mixed port set in the client.

If verification fails—the page keeps spinning, no entries show up in Connections, or the exit IP hasn't changed—it usually traces back to one of four things: an unavailable node (go back to step 2 and re-test latency), an expired subscription (go back to step 1 and update the profile), system proxy not applied (go back to step 3 and toggle it again), or DNS poisoning (see the DNS section in the full documentation). Work through them in order—node, then subscription, then the switch—and about 90% of issues resolve within the first two. For a more complete checklist, see FAQ.

exit 0 — setup complete; day-to-day use just means keeping the client running in the background