Clash Subscription Import and Connection Setup Guide

Before you begin: check the client, subscription URL, and system time

Before starting setup, make sure a maintained Clash GUI client is installed on the device. Different clients may use the same or similar config formats, but their menus are not standardized. This guide describes paths by feature name rather than by fixed button locations. If you cannot find the exact localized label, look for its English equivalent: Profiles means the config list, Proxies covers proxies and policies, Connections shows active connections, and Logs contains runtime logs.

You also need a valid subscription URL or a YAML config file that the client can read. Clash does not generate subscription content. Subscription URLs are usually provided by the network service you use; copy the complete link from its account page and do not remove parameters manually. If you received a local YAML file, choose “Import from file” and follow essentially the same steps as for a subscription.

Check that the device date, time, and time zone are correct. An inaccurate system clock can cause HTTPS connections, subscription updates, or remote resources to fail. On desktop, enable automatic time settings; on mobile, the default network time is usually sufficient. Also temporarily quit other tools that modify the system proxy or create a VPN, so multiple programs do not take control of the same network path and make troubleshooting inconclusive.

For a first-time setup, complete only the minimum working loop. Do not change DNS, ports, rule sets, scripts, and override settings at the same time before the connection works. Advanced settings depend on one another, and changing too much at once makes the source of a failure difficult to identify. After completing this guide, see the glossary for config fields, policy groups, rules, and DNS; platform permissions, startup behavior, and system-specific details are covered in the complete cross-platform setup guide.

Import the subscription and select the active config

After opening the Clash client, go to the “Config,” “Subscription,” or Profiles page. On desktop, this is usually in the window sidebar; on mobile, it is generally in the config area on the home screen. Look for “New,” “Add,” “Import from URL,” or a plus button, then paste the complete subscription URL into the input field. Use a short, recognizable name or keep the name generated by the client. Make sure there are no spaces or line breaks before or after the URL, then save, download, or import it.

The import process reads the remote config. When it succeeds, a new config entry should appear, usually with its name, update time, or an update button. Do not leave the page immediately; click the entry first to make it active. Some clients use a check mark, dark background, or “Enabled” label to indicate the active item. Others switch automatically after import, but it is still worth confirming manually. Saving a subscription in the list alone does not mean the running core has loaded it.

After selecting the config, run one manual update. This confirms that the subscription URL is reachable and the config can be parsed, while saving the latest content locally. When the update finishes, open the “Proxy” or Proxies page. If you can see policy groups defined by the config, such as Proxy, Auto, Streaming, Final, or custom names, the config has loaded. Policy group names are determined by the provider and do not need to match these examples.

If a format error appears immediately after import, first distinguish a URL problem from a file-content problem. Copy the subscription URL again from the service page and make sure no query parameters were omitted. Confirm that you did not paste a webpage URL, account dashboard URL, or subscription instructions instead of the subscription itself. If the client reports a YAML parse error, the returned content is often not a compatible config file, or its indentation and field structure are invalid. Do not force an import by randomly deleting the reported lines; they may contain policy groups, rules, or DNS dependencies.

A subscription URL is part of your account configuration and should not be included in screenshots, shared logs, or public text. When showing an error to someone else, keep the error type and menu location but redact the full URL. After confirming that the config is selected and its policy groups are visible, continue to proxy mode settings. The client now has a runnable config, but traffic may not be passing through it yet.

Choose Rule mode and confirm the policy group

Open the “Proxy,” “Mode,” or Proxies page and find the three common modes: Rule, Global, and Direct. For first-time use, choose Rule mode. It matches the rules in the config from top to bottom and uses domains, IPs, processes, or rule sets to decide whether a connection should go direct, be rejected, or use a specified policy group. It suits everyday use and is the default design for many subscription configs.

Global mode sends most interceptable connections through the current global policy. It is useful for briefly checking whether a routing rule is causing an access problem, but it is not ideal as the default for every situation. With Global mode enabled, local services or LAN addresses that should be direct may also take a different path. Direct mode bypasses the proxy and is commonly used to pause proxying or run a comparison test. Direct mode does not exit the client; the system proxy may remain enabled, so check the connection switch after troubleshooting.

After choosing Rule mode, review the main policy groups on the page. Groups with “select,” “Select,” or manual-selection behavior require you to choose an available option. Groups using url-test, fallback, or load-balance are usually handled automatically by the config logic. The policy groups shown in the client are not additional subscription lists; they are the logical layer the config uses to organize connection paths. When you change an upper-level policy group, rules that reference it below will use the new selection.

For the first setup, adjust only the top-level primary policy group; there is no need to change streaming, messaging, download, or region-specific groups one by one. Start with the default recommended by the provider, then return to the proxy page and confirm the selection was retained. If a policy group is empty, cannot expand, or shows every option as unavailable, return to the previous step and update the subscription again instead of enabling the system proxy. An empty group usually means the config did not load completely or the converted subscription is incompatible with the client core.

Once the mode and policy groups are set, Clash knows how to handle incoming connections, but the operating system is not yet sending application traffic to the client. Next, choose between the system proxy and TUN as the interception method. They cover different types of traffic, so do not repeatedly toggle both without understanding the platform behavior.

Enable the system proxy; use TUN only when needed

On Windows, macOS, and Linux clients with a desktop environment, start with the system proxy for the first connection. Open the client’s settings or home-page switch and find System Proxy, “Set as system proxy,” or “System proxy,” then turn it on. The client points the operating system’s HTTP and HTTPS proxy to its local listening port. Browsers and desktop apps that follow system proxy settings will then send requests to Clash.

After enabling it, do not manually change the operating system proxy address unless you are troubleshooting a port conflict. The client normally fills in the local address and the port corresponding to mixed-port, then restores the system settings when disabled. If you manually set a different port from the one the client listens on, the system proxy may appear enabled while applications cannot reach the local service. For the detailed relationship between port settings, see the general configuration section in the complete setup guide.

Android and iOS GUI clients usually create a local tunnel through the system VPN interface. After you tap the connection button, the operating system displays a VPN configuration or permission prompt. Approve it; a VPN indicator may appear in the status bar and the client’s connection control will change state. This permission only allows the client to create a local network interface; it does not prove that the subscription and policies are correct, so complete the next verification step.

TUN mode handles applications that ignore system proxy settings, along with some UDP, command-line, and system-level connections. If you only need a browser and ordinary desktop apps, use the system proxy to verify the setup first. If command-line tools, game launchers, or specific apps do not honor the system proxy, disable duplicate interception or enable TUN according to the client’s instructions. TUN on Windows may require administrator rights; macOS may request a network extension or helper service; Linux depends on permissions, routes, and firewall rules.

After enabling the connection, watch for clear errors in the client. Normally, the running state remains enabled and the logs do not repeatedly report the same port conflict, permission denial, or config-loading failure. If the system proxy switch turns itself off, the client may not have permission to modify system settings. If TUN stops immediately after starting, check administrator rights, network-extension approval, and other VPNs. Do not click the switch repeatedly in quick succession; a previous process may not have released its port before a new instance starts.

At this point, the config, mode, policies, and system interception form a complete chain. The next step is not only to check whether a webpage opens, but also to use the client’s connection records to confirm that the request actually went through the active config rather than being served from a browser cache or a page that was always reachable directly.

Verify that it works with a target page and connection records

Keep the client running, open a new browser window, and visit a target page that requires the current proxy path to load normally. Prefer a simple page you have not opened before so cached content does not affect the result. A page loading is only the first check; return to the Clash client and open Connections, “Connections,” or the Logs page to confirm that the domain you just visited created a new connection record.

Connection records usually show the destination domain, matched rule, and final policy group. You only need to confirm that the request entered the client and was handed to the expected policy by Rule mode; there is no need to match a particular display format. If a record shows DIRECT, the config decided that request should go direct, which is normal when expected. If the destination should use a proxy but is marked DIRECT, inspect rule matching instead of repeatedly importing the same subscription.

Visit a website that is normally reachable directly to confirm that the basic network has not been blocked unexpectedly. Rule mode is designed to handle different requests according to the config, so verification should cover both proxy and direct paths. If the first target works but all local services fail, Global mode may still be enabled or the TUN route may not be excluding the LAN correctly. Return to the proxy page to check the mode, then review whether “Allow LAN” matches your needs in settings.

For command-line testing, check whether the tool reads the system proxy. Some commands ignore desktop proxy settings by default, so a successful browser test and a failed command-line test are not contradictory. Set proxy environment variables according to the tool’s documentation, or use TUN after confirming platform permissions. Do not judge the entire client by a single command. Application interception, DNS resolution, and proxy mode are separate layers and should be checked individually.

Finish with one disable-and-reenable test. Turn off the system proxy, VPN, or TUN and confirm that normal networking returns; then enable it again and watch whether the client enters a stable connected state. This can reveal a system proxy that was not restored, permissions that worked only temporarily, or a client that fails to load the active config after restarting. After re-enabling, you do not need to re-import the subscription; just confirm that the same config remains selected.

Restore settings in reverse order when the connection fails

If no pages load after enabling the connection, first disable the system proxy, VPN, or TUN so the device returns to its original network path. Confirm that the direct network works, then return to Clash and inspect the config. Troubleshoot in reverse order: check the interception switch first, then the proxy mode and policy selection, and finally update the subscription again. This quickly shows whether the problem is in the operating system interception layer or the config content.

First check whether the client is still running and whether its local port is listening successfully. If the port is occupied, quit duplicate client instances and other proxy tools, then restart the current client. Do not change mixed-port, the system proxy port, and the subscription config at the same time, as this creates multiple inconsistencies. If the port error disappears after restarting, enable the system proxy again for verification.

Next check the proxy mode. Switch Global mode back to Rule mode and restore the primary policy group to the subscription provider’s default option. If the problem continues, briefly switch to Direct mode: if Direct works but Rule does not, system interception is functioning and the issue is more likely the policy selection or rule target; if Direct also fails, check the system proxy port, TUN permissions, or conflicts with another VPN first.

Then check the subscription update. Disable proxy interception and update the active config again, watching for HTTP errors, timeouts, or YAML parsing messages. After a successful update, select the config again and open the policy page to confirm that the groups have returned. If the subscription remains unreadable, check its status in the service provider’s account page instead of blaming the client interface.

DNS problems often appear as unreachable domain names while direct connections to certain IPs or existing connections still work. During first-time setup, avoid copying complex DNS snippets at random. Keep the subscription’s built-in settings first and confirm the basic connection. If you still need to handle fake-ip, nameserver, fallback, or DNS leaks, see the network and DNS concepts in the glossary and the systematic configuration guide. For deeper troubleshooting, change one field at a time and keep the original config available for recovery.