This guide assumes you already have a working subscription URL. The subscription service, proxy nodes, and network routes are provided by the relevant service provider; the Clash client primarily reads the configuration, applies rules, and forwards connections.
Go to the Download Center and choose a graphical client for your operating system. Windows and macOS users typically install a package; Android users should use the system-approved installation method; iOS users can get the app from the App Store; Linux desktop users can choose a client with a graphical interface.
Find the Clash or generic subscription entry on your subscription provider’s website and copy the complete URL. Do not copy only the short title shown on the page, and avoid selecting spaces before or after the URL. Subscription URLs are often long, so typing them manually can easily omit characters.
After installing the client for the first time, open it once. If the system asks for network access, VPN configuration, administrator privileges, or permission to run in the background, handle the request as needed. Do not rush to enable every switch yet: first make sure the client opens normally and that you can find its subscription or configuration page. If an update fails later, you can then tell whether the problem is reading the subscription rather than applying the system proxy.
If another proxy client is already installed, temporarily quit it and disable any system proxy or VPN connection it left behind. When multiple programs compete for the system proxy, virtual network adapter, or local port, you may see “Connected” in the interface while webpages remain unreachable. After completing this guide, decide which client to keep as your everyday entry point.
Have the client retrieve the configuration and confirm that proxy groups and the node list appear.
After launching the client, look in the sidebar or bottom navigation for “Subscriptions,” “Configurations,” “Profiles,” or “Remote Configurations.” You will usually find an Add button, a URL field, or an option to download a configuration from a URL. Click Add and choose “URL,” “Remote,” or “Remote Subscription” as the type. If both a local file and a remote URL are available, this guide uses the remote URL option.
Enter an easy-to-recognize name, such as “Daily Subscription.” The name only distinguishes configurations on this device and does not affect the connection. Paste the complete subscription URL into the URL field. Check that the beginning of the URL is intact and that no spaces or line breaks were added at the end, then click “Add,” “Save,” or “Download.” The client will request the configuration from the subscription URL, so keep the current network connection available during this brief process.
After saving, the new configuration usually appears in the list. Some clients download it immediately; others require another click on an “Update” button. Once the update finishes, the configuration card typically shows an update time, and the Proxies page will show proxy groups and node names. If the list contains only the configuration name and no proxy groups, the file may not be active yet. Click “Use,” “Set Active,” or the selection indicator to make it the current configuration.
Do not import several similar subscriptions in succession. Complete connection verification with one configuration first to avoid interference from multiple groups with similar names. Add a backup configuration only after the first subscription works. Updating a subscription retrieves the latest server-side configuration; it does not switch nodes. After the update, you still need to choose a proxy mode and strategy group in the next step.
Rule mode is best for everyday use; Global mode is more useful for briefly isolating problems.
Open the “Proxies,” “Proxy,” or “Mode” page and find the three common options: Rule, Global, and Direct. For a first setup, choose Rule. Rule mode determines where connections go based on domains, IP addresses, applications, and fallback order in the configuration: requests that need a proxy go to a strategy group, while suitable requests connect directly. This avoids routing all traffic through one line.
Global sends most connections to the global strategy group. It is useful for checking whether a website is inaccessible because no rule matched, but it is not recommended as the only everyday setting. Direct connects directly and is commonly used to pause the proxy or run comparison tests. The Terminology Guide briefly explains the matching logic, rule order, and fallback behavior behind these mode names. For a systematic introduction to writing rules, continue to the Beginner-to-Advanced Guide.
After selecting Rule, several strategy groups usually appear below. Their names depend on the subscription configuration and may include “Node Select,” “Proxy,” “Auto Select,” “Failover,” or groups organized by purpose. Open the group handling most traffic and choose a specific node, or select a predefined subgroup such as “Auto Select.”
If you are unsure which group is the main entry point, check whether it contains nodes from multiple regions, automatic selection, and options such as DIRECT. Other purpose-specific groups in the configuration often reference this main group. For the first connection, you do not need to adjust every group; select the main entry point first. Changing streaming, download, and messaging groups too early adds more variables to troubleshooting.
Node names only describe labels supplied by the configuration provider; they do not prove that a route is currently usable. Some clients support connectivity tests, which can help with initial filtering, but real websites and apps remain the final test. Testing many nodes in a row may also temporarily increase network requests, so once you find one reachable candidate, continue to the next step.
Use the system proxy to verify your browser first, then enable TUN only if needed.
Return to the “Overview,” “Home,” or “Settings” page and enable a switch such as “System Proxy” or “Set as System Proxy.” This points the system proxy to the port Clash is listening on locally. Browsers and most desktop apps that follow system network settings will then send requests to the client.
Windows and macOS clients can usually toggle the system proxy directly. On Android and iOS, you will commonly see a system VPN authorization prompt: after tapping Connect, confirm creation of the VPN configuration and look for the corresponding status-bar indicator. Linux graphical desktops vary widely. Some clients can write the system settings automatically, while others require you to specify the proxy manually in the desktop network settings. The interface may differ, but the test is the same: the client must be running, and the system must route traffic to it.
If the system requests administrator privileges, confirm that the request comes from the client you just launched, then approve it. The permission may be needed to change system proxy settings, create a virtual network adapter, or start a related network service. Return to the client and confirm that the core is running and the system proxy remains enabled. If the switch turns off immediately, the usual causes are insufficient privileges, a port conflict, or a core that failed to start. Resolve that state before continuing.
The system proxy covers browsers and many standard apps, but command-line tools, some games, virtual machines, and software that ignores system proxy settings may bypass it. Enable TUN only when such an app genuinely cannot be handled by the system proxy. TUN creates a virtual network adapter and processes traffic closer to the network layer, providing broader coverage while relying more heavily on system permissions and DNS settings.
For a first setup, do not change the system proxy, TUN, DNS mode, and rules file at the same time. The correct order is to enable only the system proxy and complete the next verification step; once the browser works, enable TUN for apps that remain outside the proxy. This makes it much easier to tell whether a network outage comes from the basic configuration or the virtual adapter. TUN stack, DNS hijacking, and routing options are Advanced topics; see How to Enable TUN Mode and the Complete Configuration Guide.
Use real requests to confirm that rule matching, strategy selection, and system routing are all working.
Keep the client running. Close the test page that is repeatedly loading in the browser, then open a new window or tab. Visit a website that should use the proxy under the current configuration. If it opens normally, do not stop there yet: return to Clash and open “Connections,” “Connection,” or “Logs” to check whether the domain request appears.
Connection records usually show the target domain, matched rule, and final strategy group. If the request matches the expected rule and is handled by the proxy group you selected, the subscription, rules, strategy group, and system proxy are working as one complete path. If the webpage opens but no corresponding request appears in the log, the browser may be using its own proxy, an extension, or another VPN. Eliminate those additional paths first.
Rule mode is not meant to send every request through the same route; it lets different requests choose an exit according to the rules. Open a familiar website that should connect directly and check whether it matches DIRECT or the appropriate direct strategy. The basic split is working as expected only when both proxied and direct requests work.
Next, test an app you use every day. If the browser works but the app fails, first check whether the app follows the system proxy. For command-line tools or software that ignores system settings, enable TUN only after confirming that the basic connection works, then test again. Do not immediately change the subscription, node, mode, and DNS when an app fails; changing one variable at a time is faster to troubleshoot.
Once the basic connection works, return to the proxy group, switch to another node, and refresh the test page. New connections should use the new selection; existing connections may briefly keep the old route, which is normal. Then manually update the subscription once and confirm that the configuration can still be retrieved. At this point, the everyday workflow—“update subscription → choose strategy → enable connection → check records”—is complete.
At least one real connection has been established successfully.
The request is definitely passing through the current Clash client.
Proxied and direct requests enter their intended strategies separately.
Work from the upstream configuration through to system routing. Change one item at a time so you can identify which step restores the connection.
Confirm that the current configuration still updates and that its proxy groups and node list are not empty. If the subscription URL itself is invalid, changing the system proxy or DNS will not create usable nodes.
Keep Rule mode unchanged, switch to another node in the main strategy group, and start a new connection. This helps rule out a temporarily unavailable route.
If Global works but Rule does not, the problem is more likely in rule matching or strategy-group references. Switch back to Rule after testing, then inspect the matched rule in the connection records.
Make sure an old client has not rewritten the system proxy and that no second VPN is running on the mobile device. On desktop, also check whether the client left old proxy settings behind after closing.
First disable the system proxy or VPN connection, then quit and reopen the client. Re-enable the current configuration and test again to prevent old connections, port conflicts, or temporary network state from interfering.
If these checks do not locate the problem, continue with the Complete Beginner-to-Advanced Guide for DNS, Fake-IP, TUN routing, rule overrides, and log analysis. That is where this guide ends—there is no need to turn a first setup into an archaeology project of obscure parameters.