Clash Setup Guide: Four Steps from Subscription to Verified Connection

Before diving in, make sure of two things: you've installed a Clash client on your device, and you have a working subscription link. Subscription links are issued by your VPN/proxy provider after you sign up for a plan, usually found under "User Center" or "My Subscriptions" on their site — it looks like a long HTTPS URL. Treat this link like a password and never share it publicly.

The exact name of the subscription import screen varies by client. Use the table below to find it quickly:

Once you're set up, move on to step one. You won't need to write any config files by hand — if you want to understand the YAML structure behind subscriptions, check the "Configuration & Subscriptions" entries in the Glossary later.

1.1 Copy the subscription link

Log in to your provider's site and find the subscription section in your dashboard. Most providers list separate links for different client types — look for the one labeled "Clash" or "Clash Meta" and click the copy button next to it. The link typically looks something like this:

https://example.com/api/v1/client/subscribe?token=xxxx&flag=clash

If your provider only offers a single "universal" subscription link, most modern clients can still read it. If import fails with a format error, go back and grab the Clash-specific link instead. See the technical notes for a deeper breakdown of subscription format differences — we won't cover that here.

1.2 Paste and import

Open the client and navigate to the subscription screen listed in the table above. In Clash Verge Rev: click "Profiles" in the sidebar, paste the link into the input box at the top, and click "Import" on the right. The client will fetch the config from that URL, and once it succeeds, a new profile card appears showing the config name and last-updated time — some providers also display data usage and expiration date.

On Android, the path in Clash Meta for Android is "Profiles → New → URL" — paste the link, tap save, then tap the profile to fetch it. On iOS, tap "Add Subscription" on the Clash Plus home screen, paste and save, and it downloads automatically.

1.3 Confirm the node list shows up

A successful import means one thing: switch to the "Proxies" tab (some clients call it "Nodes" or "Proxy Groups") and you should see groups of nodes, usually named by region, organized under a few proxy groups. If you see the node list, this step is done — move on to step two.

If the import button spins and then throws an error, the usual causes are an incomplete copy of the link, an expired subscription, or network restrictions blocking the fetch. Step-by-step fixes are in the "Installation & Setup" section of the Help Center; for long-term subscription maintenance (auto-refresh, handling expiration), check the corresponding chapter in the full documentation.

proxy-groups: [ Auto Select, Manual Switch, DIRECT ] · Node list appears = import successful

Once your subscription is loaded, decide how traffic should be routed. Clash offers three proxy modes, and every client provides a one-tap switch: in Clash Verge Rev, it's the "Proxy Mode" section on the home screen; in Clash Meta for Android, it's in the profile details or the home screen toggle; in Clash Plus and FlClash, it's in the mode selector on the home screen.

• Rule mode: routes traffic automatically based on the rule set built into your config — local and LAN traffic goes direct, blocked sites go through the proxy, and anything matching a block rule gets rejected. This is the default choice for everyday use, balancing speed and reliability.
• Global mode: sends all traffic through the selected proxy node with no exceptions. Useful when a site isn't covered by the rules and you need to force it through the proxy temporarily — remember to switch back afterward.
• Direct mode: routes all traffic without using the proxy at all, effectively bypassing Clash. Mainly used to check whether an issue is caused by the proxy or by your local network.

For first-time setup, just set the mode to "Rule" — you won't need to change it often afterward. For a breakdown of how each mode routes traffic and how rules are matched, see the "Rules & Routing" section of the Glossary; for a fuller comparison, the technical notes cover this in more depth. Once your mode is set, move on to step three.

mode: rule · everyday default / global for temporary forcing / direct for troubleshooting only

With your mode set, there's one more step: getting apps on your device to actually route traffic through Clash. The mechanism differs by platform, so here's each one.

3.1 Desktop: turn on the system proxy

Once Clash starts, it opens a mixed proxy port on 127.0.0.1:7890 by default — but apps won't send traffic there automatically. On the Clash Verge Rev home screen, find the "System Proxy" toggle and turn it on; the client writes that port into your OS proxy settings, and browsers and most apps that respect system proxy settings connect right away. The toggle lighting up and the tray icon changing state confirms it's active.

Some command-line tools and certain apps ignore the system proxy. If you need to capture traffic from every app, switch to "TUN Mode" instead — it works at the network layer through a virtual network adapter, taking over all traffic. The first time you enable it, you'll be prompted for admin rights or to install a service component; just allow it. Enable either system proxy or TUN, not both at once — see the Glossary for how they differ under the hood.

3.2 Android: authorize the VPN

On the home screen of Clash Meta for Android or FlClash, tap the start button. The system will prompt a VPN connection request — tap "Allow." A key icon appearing in the status bar confirms it's connected. This VPN tunnel is only used for local traffic forwarding; routing behavior still follows the mode you chose in step two.

3.3 iOS: turn on the connection switch

Clash Plus has a connection switch on its home screen. The first time you turn it on, you'll be asked to confirm adding a VPN configuration in a system prompt. Once confirmed, the switch lights up and a VPN icon appears in the status bar, confirming you're connected. Since the client comes from the App Store, updates are handled through the Store as well.

At this point, the traffic path is set up. But a lit-up switch doesn't guarantee correct routing — the last step is to verify it.

mixed-port: 7890 · choose system proxy or TUN, not both · mobile uses a VPN tunnel

Verification comes down to three checks, moving from what the client shows internally to actual real-world access.

4.1 Check the connections panel

Open the "Connections" tab in the client (some call it "Logs" or "Traffic"), then browse to any webpage. New connection entries should stream in live, each showing the matched rule and outbound route (either DIRECT or a node name). Seeing entries scroll by confirms traffic is actually passing through Clash.

4.2 Test real-world access

Visit a site that was previously unreachable. If the page loads normally, the rule matched and the node works. If it doesn't load, go to the Proxies tab and run a latency test on the group's nodes first — tap the speed test button on a proxy group, each node will show its latency in milliseconds, then switch to one with lower latency and try again. On desktop, you can also verify the port directly from the command line:

curl -x http://127.0.0.1:7890 -I https://www.example.com

Getting back an HTTP status line means the proxy port is working correctly.

4.3 Confirm traffic is routed correctly

While in Rule mode, visit a local site and check the connections panel to confirm its outbound route is DIRECT. Once local sites go direct and international sites go through the proxy, your four-step setup is complete.

If anything doesn't match expectations, switch to Direct mode first to confirm your local network itself is working, then switch back to Rule mode and check each step again. Fixes for slow speeds, sites that won't load, subscription update failures, and similar issues are gathered in the "Troubleshooting" section of the Help Center; for platform-specific deep dives, check the full documentation.

Entries in connections panel + target site reachable + local sites go DIRECT = setup complete