CL-05 · TUTORIAL SECTION · CLASH LIBRARY
How to Set Up Clash: Import Subscription & Configure System Proxy
This is a quick-start guide covering four steps: import the subscription, choose a mode, connect, and verify. Follow them in order — it takes about 10 minutes. Protocol theory, core differences, and systematic troubleshooting are covered separately in the Protocol Handbook.
CL-05.0Before You Start: Two Things You'll Need
Without either of these, you can't move forward. Check them off first.
First, an installed client. Clients for Windows, macOS, Android, iOS, and Linux are all listed by platform in the Download Center, with Clash Plus as the top pick. If you're not sure which one to choose, check the comparison table in the Client Selection Guide. Installation works like any other app, so we won't cover that here.
Second, a subscription link. This comes from your proxy provider, usually found in your account dashboard, labeled something like "Subscription Link," "Clash Subscription," or "Subscription URL" — a long address starting with https://. Use the copy button next to it rather than typing it out by hand.
Worth clarifying: a subscription link is a URL that the client uses to fetch a full config file containing all nodes and rules, whereas a single-node share link (starting with ss://, vmess://, etc.) describes just one server — the two aren't interchangeable. This guide follows the subscription link workflow. For the full relationship between subscriptions, config files, and nodes, see the Protocol Handbook — for now, just remember: subscription link in, config file out.
CL-05.1Step 1: Import the Subscription and Generate a Config
Goal: turn your subscription link into a selected config card in the client's list.
Desktop (Windows / macOS / Linux)
- Launch the client and find the "Profiles" page in the sidebar (some clients label it "Subscriptions"). At the top of the page there's a text field with an "Import" or "Download" button next to it.
- Paste the subscription link you copied into the field. Double-check it: it should start with
https://, have no trailing spaces, and stay on a single line with no breaks. A stray line break from the clipboard is the most common cause of import failure. - Click "Import." The client will fetch the link and download the config, usually within a few seconds. On success, a new config card appears below the input field, showing the profile name, traffic info (if provided), and last update time.
- Click the card to select it. A selected profile is usually shown with a highlighted border or checkmark, meaning the client will now use its nodes and rules. If you have multiple profiles, only one can be active at a time.
If import fails, check these three things in order: first, go back to your provider's page and copy the link again to make sure it's complete; second, confirm your network connection itself is working — importing uses a direct connection, so it won't work if you're offline; third, wait a minute or two and try again, since subscription servers sometimes have brief hiccups. If all three check out and it still fails, the subscription itself is likely expired or invalid — contact your provider to check your account status.
Mobile (Android / iOS)
Clash Meta for Android: open the app, tap "Profiles" on the home screen, tap "+" in the top right, choose "Import from URL," paste the subscription link, name it, and save. Back on the profile list, tap the new entry to select it. FlClash works the same way, with the add button on the Profiles page.
Clash Plus on iOS: from the profiles or subscriptions section, choose to add a subscription, paste the link, save it, then tap it in the list to activate. When pasting on mobile, watch out for long links getting auto-broken by some keyboards.
One more thing: subscription content updates on the provider's end, but node changes won't sync to your local config automatically. Every config card has an "Update" button — it's worth tapping every few days. Most clients also support setting an auto-update interval, found on the subscription's edit page.
CL-05.2Step 2: Choose Rule Mode and Pick a Working Node
Goal: set the mode to Rule, and select a node with normal latency in the main proxy group.
Three Modes — Stick with Rule
The client offers three proxy modes, switchable from the main screen or settings on desktop, and from the home screen or settings on Android:
- Rule: routes traffic based on the rules in your config — local sites go direct, everything else that needs a proxy gets one. This is what you should use day to day; it's the fastest and most efficient option.
- Global: skips rule matching entirely and sends all traffic through the currently selected node. Only useful briefly, if you suspect a rule is misfiring and want to test.
- Direct: sends all traffic straight out with no proxy at all — effectively pausing the proxy. Handy as a baseline when troubleshooting.
Make sure the mode is set to Rule. If it's stuck on Direct, browsing will behave exactly as if nothing were turned on, even after a successful connection — this trips up a lot of newcomers.
Picking a Node in the Proxy Group
Switch to the "Proxies" page in the sidebar. Nodes are organized into proxy groups, with names defined by your subscription's config — common ones include "Proxy Selector," "Auto Select," or groups named by use case. Inside each group is a list of selectable nodes. Proxy groups are essentially routing destinations set up by whoever built the config — once a rule matches a piece of traffic, it hands it off to the matching group. For the full concept, see the rules and proxy groups section of the Protocol Handbook; for now, just click a node in the topmost main group.
Run a latency test before picking. There's usually a lightning bolt or waveform icon in the top corner of the Proxies page or next to each group's title — click it and the client tests every node in the group, showing a millisecond value next to each after a few seconds. Lower is better, and anything under three digits is generally fine. Skip any node showing timeout or staying blank for too long. Clicking a node highlights its name, meaning that group will now route through it.
CL-05.3Step 3: Connect and Hand Off System Traffic
Goal: enable the system proxy switch on desktop, or complete VPN authorization on mobile.
Desktop: the System Proxy Switch
The first two steps were just setup — at this point, system traffic still isn't going through the client. Head back to the main screen and turn on the "System Proxy" switch (in Settings for Clash Verge Rev, or on the main screen for Clash Plus). Once enabled, the OS's HTTP proxy is pointed at a local listening port (typically 127.0.0.1:7890 or 7897 — no need to enter this manually), and traffic from your browser and most apps now routes through the client. The switch turning an active color, along with a tray or menu bar icon change, confirms it's on.
The first time you enable this on macOS, a prompt may ask for your password to allow network setting changes; some clients also request a network extension. This is a standard system permission step — allow it, or the system proxy won't take effect. Windows usually doesn't need extra authorization; if the browser still isn't using the proxy after enabling it, check whether another proxy tool is running at the same time and competing for the system proxy settings — close it and try again.
Mobile: VPN Authorization
Android (Clash Meta for Android / FlClash): tap the connect button or switch on the home screen. The first time, the system shows a "Connection request" dialog asking to set up a VPN connection — tap "OK" to allow it. Once authorized, the switch shows a connected state and a key icon appears in the status bar, confirming traffic is now routed through the client. This VPN prompt is just Android's standard mechanism for this type of app, not a separate service.
iOS (Clash Plus): turn on the connect switch on the main screen. The first time, it will ask to add a VPN configuration — confirm with your passcode or Face ID, after which a VPN badge appears in system settings. Keeping the switch on means you're connected.
One more note: system proxy only covers apps that respect the OS proxy settings — command-line tools and some other programs aren't affected. To capture that traffic too, you'll need TUN mode, which is more advanced. Its mechanics and setup are covered in the Protocol Handbook; feel free to skip it for now.
CL-05.4Step 4: Verify It Works, and What to Check If It Doesn't
Goal: confirm traffic is actually going through the client, and the exit location is what you expect.
Three Things to Check
- Check the connection log. Switch to the client's "Connections" page, then open a few websites. If the proxy is working, this page should keep showing active connection entries in real time, listing domains, matched rules, and the node used. A steady stream of entries confirms traffic is flowing through the client.
- Test a target site. Open a new browser tab and visit a site that's normally hard to reach directly but should be routed through the proxy per your rules. If it loads fine, rule-based routing is working.
- Check the exit location. Visit any IP lookup site — the location shown should match the node you selected in Step 2. Note that in Rule mode, only addresses matched to the proxy will show that node's location; for a stronger check, switch to Global mode briefly, check, then switch back to Rule.
Still Not Working? Try These in Order
If any of the three checks above fail, work through the following in order, retesting after each one — most issues are solved by the first two:
- Switch nodes: go back to the Proxies page, rerun the latency test, and pick the lowest-latency node. A single bad node is the most common cause.
- Check the mode: make sure the proxy mode isn't set to Direct, and the main proxy group isn't stuck on an unavailable node.
- Update the subscription: go to the Profiles page and tap Update. Expired subscriptions or bulk node changes can break the whole local config — updating brings everything back in sync.
- Toggle the switch: turn the system proxy (or mobile connection) off and back on to force the OS to reapply the settings; on desktop, also try restarting the client.
If all four steps still leave you with timeouts across the board, the problem is likely not in how you're using the client, but in your network environment, protocol settings, or DNS setup. That kind of systematic troubleshooting goes beyond this quick-start guide — head over to the Protocol Handbook, which walks through a full diagnostic path from the most likely causes to the least.
CL-05.9All Done: Where to Go Next
Setup's complete. Here are two more things worth checking out.