Clash First-Time Setup: Subscription, Mode, Connection & Verification

Start by choosing a client from the Download Center that matches your operating system and device architecture. Windows users usually choose an x64 installer. On a Mac with Apple silicon, choose the Apple Silicon or ARM build; on an older Intel Mac, choose the Intel build. On Android, prefer a package suited to the device's architecture. If you are unsure, check About This Mac or Device Information first—do not install multiple builds just to guess.

After installation, launch the client. Desktop systems may ask for firewall, network access, or background-execution permission; mobile systems may request permission to create a VPN configuration on the first connection. This VPN configuration is the traffic-routing interface provided by the operating system, so allow it only after confirming that the request comes from the newly installed client. If you deny the permission, the client may appear to be running while other applications' requests never enter the proxy path, leaving no connection records for later verification.

Next, prepare the subscription URL. Your service provider usually generates it in the user dashboard as an HTTPS link. Copy the complete URL, including any trailing parameters. Do not mistake a webpage URL, purchase page, or QR-code image URL for a subscription URL. Because the link may contain account authorization information, paste it only into a trusted client and never share it in chat groups, screenshots, or public documents.

Before continuing, confirm that the client can reach the internet through your current direct connection. Temporarily disable other proxy apps, browser proxy extensions, and old VPN connections, leaving only the Clash client you are setting up. When multiple network tools modify the system proxy, they can overwrite each other's ports: one client may show Connected while another process receives the traffic. Once these checks are complete, open the configuration page and import the subscription.

Open the client's Configuration, Profiles, or Subscription Manager page and look for Add Subscription, Import from URL, or an entry with a link input field. Paste the complete subscription URL. If a name is required, use a short, recognizable label such as the service name or purpose; it only distinguishes the configuration locally and does not change its contents. Then click Import, Download, or Save and wait for the first fetch to finish.

After a successful import, a new record should appear in the configuration list. Common details include the configuration name, last update time, and an update button. Do not stop at a “Download complete” message: open or select the record and confirm that the client has parsed proxy nodes, policy groups, and rules. If the page shows only an empty record or the policy-group section is blank, the response may not be a Clash configuration, or the subscription may have failed during transfer.

Once the new configuration appears, make it the active configuration. Depending on the client, this may mean clicking a card, selecting a radio button, toggling an enable switch, or choosing Set as Active Configuration. The selected state is often shown by a highlight, checkmark, or Active label. Clash can store multiple configurations, but at runtime it builds policy groups and rules only from the active one. A successful import without activation is one of the easiest steps to overlook.

Now open the Proxy, Proxies, or policy-group page. You should normally see groups such as node selection, automatic selection, failover, or names defined by the service provider. Find the group responsible for primary proxy traffic and choose a regular node. For the first setup, leave the speed-test interval, load balancing, DNS, and rule providers unchanged; use the subscription defaults to establish a working connection. The relationship between policy groups, nodes, and rules is explained in the Glossary.

If the import reports a timeout, network error, or parsing failure, first use a browser to confirm that the current network can reach the subscription URL and check that the subscription is still active. Copy the URL again, remove any leading or trailing spaces, and retry. If every client fails to fetch the same URL, the issue is usually with the subscription service or current network. If the browser can access it but the client consistently fails, check the client's network permission and system clock. A more complete layered diagnosis is available in Advanced Configuration.

Configuration Page Checklist
1. The subscription record appears
2. The new configuration is active
3. Policy groups and the node list open normally
4. A node is selected in the selection group

Return to the client's main screen or settings and find Mode, Proxy Mode, or Run Mode. Common options are Rule, Global, and Direct. Rule mode is recommended for first-time use. It checks requests against the configuration rules from the top; after the first match, traffic is sent to the specified policy group. Common local services can connect directly, while domains that need a proxy enter the proxy group, so you do not have to toggle each website manually.

Global mode sends most routable traffic through the same proxy policy and is useful for temporarily testing whether a rule is causing an access problem, but it is not the best first step for diagnosing every issue. Direct mode bypasses proxy nodes and is mainly useful for quickly restoring local access or running a comparison test. If the target site still fails in Direct mode, the issue may be unrelated to Clash. If Global works but Rule mode does not, inspect the matched rule instead of repeatedly reinstalling the client.

After selecting Rule mode, return to the proxy page and confirm that the node in the primary policy group has not been reset. Some configuration updates restore default group selections, while some clients remember the previous choice. Keep “mode” and “policy group” distinct: the mode determines how rules are read, while the policy group determines which exit is used after a rule matches. Changing the mode does not modify the subscription file or switch every policy group to the same node.

For the first connection, keep the service provider's default rules. Only after the basic path has been verified should you consider changing DNS, TUN, Fake-IP, domain sniffing, or local overrides. Changing several fields at once removes the baseline needed for comparison. Review the Glossary for related concepts; when you need a systematic understanding of policy-group types, rule sets, and DNS configuration, read the Advanced Configuration Guide.

On a desktop client, first confirm that the core is running. The control may be labeled Service, Core, Run, or Start. The core reads the configuration, listens on local proxy ports, and applies rules. If it is not running, the system proxy may point to an address with no process listening for requests. Some clients start the core automatically; others require one manual click. Once you see Running, Connected, or a green active status, configure the system proxy.

Find and enable System Proxy. This points the operating system's HTTP and HTTPS proxy to Clash's local listening port. Browsers and desktop apps that follow system proxy settings will then send requests to the client. Do not change the port immediately after enabling it; subscription configurations usually do not control the local port, and the client default is sufficient for a first connection. If the system requests administrator permission, approve it through the normal system prompt.

Android and iOS usually route traffic through the system VPN interface. After you tap Connect, the system displays a network-connection permission prompt; once approved, a VPN indicator usually appears in the status bar. It is normal for mobile clients not to have a separate System Proxy switch because the system VPN configuration provides the traffic entry point. Keep the client in the foreground for a few seconds while policy groups and DNS initialize, then test in a browser.

Whether a Linux desktop can write the system proxy automatically depends on the distribution and desktop components. If the client offers System Proxy, enable it first. Otherwise, enter the local HTTP or SOCKS port shown by the client in the desktop network settings. Command-line programs may not read the desktop proxy, so do not judge the entire client by one failed terminal test. Server and router deployments fall under core deployment and should be covered in Advanced Configuration.

TUN mode routes traffic from applications that do not follow the system proxy, including some UDP traffic. For the first setup, verify the browser path with the regular system proxy. Consider TUN only if the browser works but the target application still does not appear in the connection list. Enabling TUN may trigger additional network-extension, virtual-adapter, or administrator-permission requests. Change one switch at a time and retest immediately so you can identify which layer made a difference.

If every node times out after connection, do not immediately switch back and forth between the system proxy, DNS, and TUN. First determine whether only one node or all nodes time out. For an individual timeout, try another node in the same policy group. For a total timeout, check the subscription status, current direct connection, system clock, and client permissions in that order. A fixed sequence finds problems faster than random setting changes.

A lit connection icon only means that the client is running; it does not prove that every application's traffic is using the expected node. For verification, open a new browser window and visit a site that normally works directly, followed by the target site that requires a proxy. This checks that direct and proxied rules do not interfere with each other. If the browser was already open, quit and relaunch it once to avoid old connections and cached results affecting the test.

Then open the client's Connections, connection log, or Logs page and refresh the sites you just visited. You should normally see the domain, destination port, matched rule, and policy group used. A request record shows that application traffic reached Clash; a policy-group name shows that rule matching completed; a specific node name shows that an exit was selected. During troubleshooting, identify which layer the record reaches instead of checking only whether the webpage opens.

If the browser fails and no new record appears in the connection list, first check the system proxy switch, mobile VPN status, and the browser's own proxy settings. Some browser extensions override the system proxy, so disable them temporarily and test again. If a record appears but times out, the request reached the client; check the node and upstream route next. If the request matched DIRECT when it should have used a proxy, verify the mode and active configuration.

You can also visit a trusted IP lookup page and compare the exit address before and after enabling the proxy. This confirms only that the exit changed, not that every domain is being routed as expected, so use it together with connection records. Do not treat a latency number shown on a webpage as a substitute for client-side troubleshooting: page speed is also affected by the destination server, international routing, DNS cache, and local network quality.

Finish with a recovery test: disable the system proxy or disconnect on mobile and confirm that ordinary sites still connect directly; then enable it again and confirm that the target site becomes accessible. This comparison can reveal stale proxy settings and port conflicts. If no webpages work after closing the client, the system proxy may not have been restored correctly. Reopen the client, disable the system proxy, and exit normally. If access is still unavailable, remove the manual proxy in the operating system's network settings.

AFTER SETUP

Everyday Maintenance After Setup

You do not need to re-import the subscription for everyday use. The configuration page usually provides an update button or automatic update interval. After updating, check that the active configuration is still enabled and that the primary policy group retains a suitable node. A subscription update fetches new configuration content but does not guarantee that every node works; if access fails, test other nodes in the same group before deciding whether to update the subscription.

After switching networks, such as moving from home Wi-Fi to a mobile hotspot, existing connections may continue using the old network path. Wait a few seconds, then disable and re-enable the system proxy or mobile connection if needed. If a computer cannot connect after waking from sleep, restart the core connection first rather than deleting the configuration. Deleting it also removes your current policy selections and turns a simple recovery into a full reconfiguration.

When you need to understand terms such as DOMAIN-SUFFIX, GEOIP, MATCH, policy groups, Fake-IP, or TUN, look them up individually in the Glossary. Before changing policy-group types, DNS, rule-set subscriptions, local overrides, or combining multiple subscriptions, open Advanced Configuration. This first-time guide only requires one verifiable basic path; make deeper changes one at a time after that path is stable.