Clash Tutorial: From Importing a Subscription to Verifying It Works
Using Clash for the first time only involves four things: import subscription, choose proxy mode, connect, and verify. Below we walk through each step in order, explaining what to click and why. Following along takes about ten minutes and applies to mainstream Clash clients on Windows, macOS, Android, iOS, and Linux.
Know the client differences before you begin
Wording varies slightly across clients: it's called "Subscriptions" in Clash Verge Rev, "Profiles" in Clash Meta for Android, and "Profile" in Clash Plus — they all refer to the same page. The core flow (import subscription → choose mode → enable system proxy → verify) is identical across every client, so learning it once covers you everywhere. If you haven't installed a client yet, head to the download page and pick one for your platform first, then come back here.
Before you begin: get two things ready
First, an installed Clash client.For Windows and macOS, Clash Plus or Clash Verge Rev is recommended; on Android, Clash Meta for Android; on iOS, Clash Plus (searchable on the App Store); on Linux, Clash Verge Rev. Installers and system requirements for every platform are listed on the download page — no account sign-up is needed, just install and go.
Second, a valid subscription link.This is generated by your service provider, usually a long address like https://example.com/api/v1/client/subscribe?token=xxxx, copied from your provider's dashboard. Note: this link carries your account credentials and is as sensitive as a password — don't screenshot it into group chats or post it in public forums; if you suspect it's leaked, just reset it from your provider's dashboard.
Once you have both, start with step one.
Import subscription
About 2 minutesOpen the client and find the subscription page. In Clash Verge Rev it's the first icon in the left nav, called "Profiles"; in Clash Meta for Android it's the "Profiles" tab at the bottom; in Clash Plus it's the "Profile" page. This page has one job: manage every profile you've imported.
Click "New", "Add", or the plus icon in the corner, and choose type "Remote". Some clients read the clipboard and pop up a confirmation as soon as they detect a subscription link — just confirm it. Paste the full subscription link into the URL field, give it any recognizable name (like your provider's name), and save.
The moment you save, the client sends a request to that address and downloads a YAML config file locally. Success is obvious: a new entry appears in the list, with a card showing the node count, traffic info, and last-updated time. If it spins for a long time and then errors out, first check whether the link was copied completely — subscription links are usually very long, and manually selecting text often clips the tail; if the link is confirmed correct but it still fails, the network likely can't reach the subscription address — see the subscription update section in the setup reference for the troubleshooting order.
The last step is the easiest to miss: click the profile you just imported to make it the "active" one.The client can store many profiles at once, but only one is in effect at any given time. Plenty of beginners import a profile and rush to enable the proxy, only to find the client is still using the old one and the node list never looks right.
What's inside this config file
Open the downloaded file and you'll find three core sections:
mixed-port: 7890 # local listening port
proxies: # node list: one server per line
- name: "NodeA"
type: ss
server: example.com
port: 443
proxy-groups: # policy groups: organize nodes into switchable groups
- name: "PROXY"
type: select
proxies: ["NodeA", "DIRECT"]
rules: # routing rules: matched top to bottom
- GEOIP,CN,DIRECT
- MATCH,PROXYproxies is the node list, proxy-groups organizes nodes into switchable policy groups, and rules decides which traffic goes to which group. You never need to edit this for everyday use; but knowing what each section does makes reading logs and troubleshooting much easier later. Full field descriptions are covered in the setup reference, and any unfamiliar term can be looked up in the glossary.
A subscription isn't a one-time import
Providers add or remove nodes periodically, and the client automatically refreshes the subscription every so often (usually every 24 hours) by default. To get the latest nodes right away, click the "Update" button on the subscription card to pull manually. If an update fails, the client keeps using the old profile and won't suddenly drop your connection — just try updating again later.
Choose proxy mode
About 1 minuteClash has three proxy modes — first understand how each one decides what to do:
- Rule: the client checks each connection against the rule table in the config, one by one — direct-connecting what should be direct, and proxying what should be proxied.
- Global: ignores the rule table entirely; all traffic goes through the currently selected node.
- Direct: no proxying at all — the equivalent of not running the client.
For everyday use, stick with "Rule" mode.This is the default state the subscription profile is designed for: local sites connect directly (fast, and doesn't use node bandwidth), while sites outside mainland China route through the proxy automatically. The two kinds of traffic never interfere with each other, and there's no need to switch back and forth. Keep "Global" in reserve for troubleshooting: if a site fails under Rule mode, switch to Global and try again — if it works, the rules just don't cover that site, and the node itself is fine. "Direct" is mostly only useful for comparison testing.
Where to switch: on desktop, three buttons side by side at the top of the "Proxies" page; in Clash Meta for Android, in the menu at the top-right of the "Proxies" page; Clash Plus has a mode card right on the home page — tap it to cycle through.
To understand the order in which the rule table is matched, and why some sites proxy automatically while others don't, the blog post on comparing the three proxy modes has a full walkthrough with diagrams; the "Rules & Routing" category on the glossary page covers the related terms.
Establish a connection
About 3 minutesPick a node first
Go to the "Proxies" page and find the group named PROXY or "Node Selection" — don't flip the switch just yet. Click the lightning icon next to the group to run a latency test: the client pings every node in turn, and a millisecond value appears next to each name after a few seconds. Pick a node with low latency that didn't time out. The number is just a reference point — what actually matters is whether pages load smoothly; if things feel slow after a few days, come back, retest, and switch nodes.
Then turn on system proxy (desktop)
Once a node is selected, go back to the home or settings page and enable "System Proxy". It's worth understanding why this works: after launching, the client keeps listening on a local port (default 7890); turning on system proxy registers a rule with the OS saying "send browser traffic to 127.0.0.1:7890 first". After that, requests from the browser go through the client, which decides — based on the rule table — whether to connect directly or hand it off to a node, then returns the result. Turning the switch off immediately removes that rule and restores the system to normal — so it's completely safe to toggle at any time.
Mobile uses a VPN tunnel instead
Android doesn't use system proxy: turn on the master switch in Clash Meta for Android, the system will pop up a VPN authorization dialog, tap "Allow", a key icon appears in the notification bar, and all app traffic is now handled by the client. Clash Plus on iOS works the same way — the first launch asks you to add a VPN profile, and after granting permission, just flip the switch.
Two situations you might run into
Port already in use.If enabling system proxy throws a port-in-use error, it means 7890 is already taken by another program (often another proxy tool). Two fixes: quit the program using it, or change the port in the client settings to something free, like 7897. No need to touch the browser side — the system proxy setting syncs automatically with the client. More detail on ports is covered in a dedicated section of the setup reference.
Some apps don't use the proxy.Games, command-line tools, and some desktop apps ignore the system proxy — this is when TUN mode is needed. It creates a virtual network adapter that intercepts all traffic and hands it to the client. TUN is an advanced feature — skip it for now on your first run; when you actually need it, the setup reference has step-by-step instructions per platform, and the concept is explained in the glossary.
Verify it works
About 2 minutesHaving every switch turned on doesn't guarantee the proxy is actually working. Spending a minute verifying now saves much more time than discovering a problem halfway through something else. Two methods, pick either one, or do both.
Method one: check your IP
Search "IP" on a search engine, or visit an IP lookup page like ip.sb. Success looks like: the IP location shown matches the node's country or region, not your local ISP. Then open a site in mainland China and confirm it loads at normal speed — that confirms the direct-connect part of Rule mode is also working.
Method two: check the Connections panel
The client has a "Connections" panel. Keep it open, refresh a few random pages in your browser, and connection records will pop up in real time: the target domain, the matched rule, and the node it actually went through — all laid out clearly. If visiting sites outside mainland China shows PROXY along with the node you selected, and visiting local sites shows DIRECT, routing is working as expected. The log panel shows the same info — just set the log level to info.
If verification fails, check in this order
- IP hasn't changedThe system proxy switch isn't actually taking effect. First confirm the toggle is really on; if you have a browser proxy extension like SwitchyOmega installed, switch it to "system proxy" mode or disable it temporarily — such extensions override the system setting.
- IP changed but pages won't loadThe current node isn't working. Go back to the "Proxies" page, retest speed, and try a different node.
- Still failing after switching nodesThe subscription may have expired or run out of data. Go to the subscription page and click "Update" — if that doesn't help, contact your provider to check your account status.
For more complex errors, the blog posts on reading Clash logs and the troubleshooting chapter of the setup reference offer a more complete diagnostic path; more detail on the first connection is also covered in the first connection guide.
Final checks: three optional touches
With the four steps done, everyday use is already set up. Three optional extras remain — set them up if you want, skip them if you don't:
- Launch on startup.Client settings usually offer "Launch at startup" and "Silent startup" options; enable both so the proxy is ready right after a reboot with no popups.
- Auto-update subscription.Just confirm the update interval isn't set to "Never" and leave it at the default 24 hours — the client will keep node lists in sync on its own.
- Enable system proxy on launch.Some clients can auto-enable system proxy after starting up — turn this on and you won't need to flip the switch manually every time you boot.
At this point, everyday Clash usage is complete: import subscription, Rule mode, a good node selected, system proxy on. Once you're comfortable and want to go deeper — changing ports, writing your own routing rules, enabling TUN, updating the GeoIP database — the setup reference covers all of it in detail, organized by platform; whenever a term doesn't make sense, the glossary is there to check.
NEXT / What to read next