Clash Subscription Import and Connection Guide

Before You Start: Get a Client and Compatible Subscription

Choose a client for your platform on the Clash download page, install it, and open it once. If you’re new to Clash, start with Clash Plus. You can also follow these steps with Clash Verge Rev or another compatible client. There’s no need to edit YAML, change DNS settings, or turn on every option.

The client reads your profile and routes connections. A subscription provides server details and proxy groups, and may also include routing rules. Installing a client alone won’t give you a working proxy. Before you begin, get a subscription URL explicitly marked as compatible with Clash or mihomo from your provider, and make sure the service is active. A regular web address or account login page is not a subscription URL, and can’t be used in its place.

Treat your subscription link like a password: it may contain account details. Don’t post it publicly or paste it into an unfamiliar online converter. If you need to share a screenshot for troubleshooting, hide the full link, server addresses, and credentials first. If the link may have been exposed, reset it in your provider’s account dashboard; deleting the screenshot isn’t enough.

Finally, note whether your current network can access the sites you normally use, and temporarily quit other proxy or VPN apps. That makes it easier to tell whether a later issue is caused by your network or by a change to the request route. Once you have the client and subscription ready, start on the Profiles page.

Step 1: Import a Subscription and Activate the Profile

Add a Remote Profile

Copy the Clash-compatible subscription link from your provider, then return to the client and open Profiles or Subscriptions. Choose Add, Add Subscription, or Import from URL, paste the link, and give the profile a clear name, such as “Daily.” If the page also offers a local file option, choose the remote subscription so you can update it later.

Save and wait for the download to finish. A successful import usually shows the profile name and update time, or displays an import confirmation. Then select the profile and choose Use, Activate, or the equivalent. Some clients switch to the new profile automatically; others only add it to the list, so don’t move on just because a profile card appears.

Open Proxies and check for proxy groups or nodes, then open Rules to see whether rules have loaded. Subscription contents vary, and proxy groups may have names like “Select,” “Proxy,” or something else. The name doesn’t matter; what matters is that the core has loaded the profile. If the page is still empty, return to Profiles and check which profile is selected instead of repeatedly toggling the system proxy.

Import Failed? Check Download and Parsing Separately

A timeout or connection error usually means the profile wasn’t downloaded. First check that you can reach your provider’s website, then copy the link again and make sure it has no leading or trailing spaces or line breaks. Some clients let you choose a direct or proxied route for subscription downloads. If you don’t have a working profile yet, use a network route that already works rather than relying on a proxy connection you haven’t set up.

A YAML error or unsupported format means the downloaded content may not be a compatible profile. An expired link may return a login or error page that the client then tries to parse as a profile. Go back to your provider and choose its Clash subscription option; don’t try to fix the error by deleting lines. If you only have a Base64 link bundle, don’t assume the client can import it directly. See Frequently Asked Questions for more on format compatibility.

For a local YAML file, choose Import from File and select the profile on your device. Unlike a remote subscription, it usually won’t fetch changes from the server automatically; you’ll need to replace the file yourself or switch to a remote URL. Either way, next check the active run mode and outbound route.

Step 2: Choose Rule Mode and a Proxy

Go to the home screen or Settings and find Run Mode. For your first setup, choose Rule. This determines how the core handles connections it receives; it doesn’t decide which apps send connections to the core. Choosing a mode doesn’t mean your browser or other apps are using the proxy yet. You’ll enable traffic routing in the next step.

Start with Rule Mode, Not Global

Rule mode checks domains, addresses, and other conditions against the rules in your profile, then sends each connection to the specified proxy group or direct route. It’s a good everyday option, as long as your profile includes rules that suit your needs. If one site won’t connect, you can check which rule matched later; there’s no need to change the whole profile first.

Global mode sends regular connections that reach the core through the selected global proxy. It’s useful for a quick comparison, but it doesn’t mean every app on your device is being routed. Direct mode sends regular connections that reach the core straight to their destinations, so it can’t test whether remote proxy nodes work. These modes may sound similar, but they solve different problems. Rule mode is the best place to start and makes troubleshooting easier.

Choose a Node for the Proxy Group You Use

Open Proxies and find the main outbound group referenced by your rules. If it lists individual nodes, select one that’s available. If it lists another proxy group, open that group and confirm the final selection. Groups such as Auto Select or Failover may be managed by the profile, so leave their defaults in place rather than changing every group manually.

You can run the client's connection or latency test and wait for a result. It only shows whether the node can reach the specific test target; it doesn’t guarantee every app will work. A single timeout also doesn’t prove the node is unusable. Choose a route that passes the test, then check it with a real request for a more reliable result.

If you only need one service to work, don’t start by making broad rule changes or deleting proxy groups. Subscription updates may overwrite local edits, and clients handle overrides differently. Once you have a working connection, see the Protocols and Core Technical Guide for rule order, protocol types, and profile compatibility. For now, just confirm that Rule mode is selected and the proxy group points to a suitable route.

Step 3: Connect and Route App Traffic Through the Core

On Desktop, Start with the System Proxy

On Windows, macOS, and other desktop systems, first check the client’s home screen to make sure the core is running. If there’s a separate start button, start the core first. Then enable System Proxy. This updates the proxy settings that apps read from the operating system. Browsers and other apps that follow those settings will usually send new connections to the client’s local listening port.

Leave TUN and Allow LAN off for now. Your local browser can use the system proxy without exposing a port to other devices on the same network. If the client shows a mixed port of 7890, that’s a local listening port shared by HTTP and SOCKS5—not a subscription URL or remote node port. The actual value depends on your client settings.

After enabling the switch, reload the browser page. If you manually configured another proxy in the browser or installed an extension that manages proxies, the system proxy may not be the setting it uses. Restore the browser’s system proxy setting, then try a new request. Terminal tools, games, and some download apps may ignore the system proxy, so their behavior alone doesn’t show whether the whole client is working.

On Mobile, Allow the System VPN Connection

On Android and iOS, tap Connect or the start button on the home screen. The system will ask for permission to add a VPN configuration or establish a VPN connection. Make sure the prompt is from the client you just installed, then grant permission as requested. Return to the app and check that the connection stays active and the system shows the VPN indicator.

VPN permission routes traffic through the client; it doesn’t mean every connection will go through a remote node. Whether traffic is proxied or direct still depends on the run mode and rules. If another VPN is already connected, disconnect it and try again. If Android asks which apps to include, use the default selection to start so your test browser isn’t accidentally excluded.

Enable TUN Only If an App Needs It

If your desktop browser works but an app that ignores the system proxy still connects directly, consider TUN mode. It uses a virtual network interface to route eligible traffic and may require installing a service or granting administrator permissions. Follow the client’s service and permission prompts, confirm the service is running, then enable TUN. Don’t just switch it on and ignore any error messages.

TUN routing also depends on routes, app exclusions, and the operating system, so enabling it doesn’t guarantee every request will use a proxy node. Don’t change the network stack, DNS, and routing options all at once. Keep the defaults and test one change at a time. If the network stops working, turn off TUN and return to the system proxy setup that worked, then see Troubleshooting FAQs for more help.

Your profile, outbound route, and traffic entry point are now set up. Next, check where a real request goes instead of judging by the color of a switch.

Step 4: Check Rule Matching and Test a Real Connection

Use a New Request to Check the Route

Open a service you normally access through a proxy, then reload the page or restart the app to make sure it sends a new request. A page that’s already loaded isn’t a reliable test: cached content may still appear when you’re offline. Also open a site you can normally access directly to make sure your basic network connection still works.

Switch back to the client’s Connections page, find the domain you just visited, and expand its details to check the matched rule, proxy group, and final route. Field names vary by client, but the checks are the same: did the request reach the client, where did the rule send it, and did the connection succeed? Short-lived connections may disappear quickly; if you can’t find one, refresh the page or search the logs by domain.

If the site should use a proxy but the details show DIRECT, the current rules sent it directly. Check the profile and rules instead of reinstalling the client. If the expected proxy group and node are shown but the page still fails, check the logs for a connection timeout, authentication failure, or DNS resolution error. Change one related setting at a time and repeat the same test so you can tell what made a difference.

Choose Your Next Step Based on What You See

If the client can’t see the request at all, check whether the app uses the system proxy, is excluded by per-app rules, or is being routed by another traffic-management tool. If the client sees the request but the route is wrong, go back to Step 2 and check the run mode and proxy group. If the route is right but the connection fails, check the node, service status, and network. Troubleshooting in order—traffic entry, rule routing, then outbound route—is faster than toggling switches at random.

You can also use a trusted IP lookup service as a quick check, but it only shows the route used to reach that service. In Rule mode, different sites may take different routes, so a local IP on one lookup page doesn’t mean all proxy connections are failing. Likewise, a changed IP alone doesn’t prove DNS is handled as expected. For DNS leaks or Fake-IP issues, see the relevant topic in Frequently Asked Questions.

Save Your Everyday Settings After Everything Works

Once the target service works and connection details look right, return to Profiles and configure automatic subscription updates. If the client lets you choose an update interval, pick one that suits how often your provider changes the subscription; there’s no need to check every few minutes. After an update, make sure your selected proxy group is still in place. The profile name may stay the same even when its nodes and rules change.

Enable startup options only if you need them, and check whether Start Client and Connect on Launch are separate settings. After restarting your device, confirm that the core and system proxy or VPN are active, then repeat a real connection test. Before quitting the client, turn off the system proxy or disconnect the device VPN so apps don’t keep sending requests to a local port that’s no longer listening.

If only one app won’t use the proxy, first check the traffic-routing settings in Step 3. If a subscription update fails, return to Step 1 and check the download route. To compare SS, Trojan, VLESS, or Hysteria2, or learn how mihomo relates to the client, read the protocol guide. On another device, choose a compatible client from the download page and repeat these four steps.