Before you begin: Get a valid subscription
Installing the client doesn't give you a proxy outbound by itself. You'll also need a valid subscription URL or a YAML file with proxy and routing settings. Your service provider supplies the subscription; this site doesn't provide proxy nodes or subscription accounts. Open your provider's dashboard and look for a subscription option labeled Clash, Clash Meta, or Mihomo. Copy the full URL, but don't mistake the dashboard address in your browser for the subscription URL.
For your first setup, quit any other proxy clients or VPN apps that are routing traffic. Make sure your device can open regular websites without a proxy, and check that its date and time are correct. This makes it easier to tell whether a later failure comes from your network, the subscription download, or the new profile. On desktop, leave TUN off and don't change DNS yet. Start with the fewest settings needed to establish a testable connection.
A subscription URL may contain account-identifying information, so treat it like a password. Don't post the full link in public comments or submit it to an unfamiliar online converter. If you need help, share only the error text, client name, and steps you took. Hide subscription URLs and account details in screenshots first.
01 Import a Subscription and Enable the Profile
Open the client's Profiles or Subscriptions page and look for Import from URL, Add subscription, or a similar button. Paste the full subscription URL you copied. If there's a name field, enter a label that's easy for you to recognize. Check that you copied the entire URL without any surrounding instructions, spaces, or line breaks, then click Import, Download, or Save. The client will usually fetch and parse the proxies, policy groups, and rules.
When the download finishes, a profile card or file entry should appear, sometimes with a name and last-updated time. Importing a profile isn't enough—you still need to enable it: click the card or open its menu and choose Use or Activate. Check that the active-profile indicator moves to the new entry, then open the Proxies page. Seeing its policy groups and available choices means the core has loaded the profile. A file appearing in the list alone doesn't confirm that it's active.
Import an Existing YAML File
If your provider gave you a local file, choose Import from file on the same Profiles page and select the downloaded .yaml or .yml file. Then enable it as described above. Don't save a webpage and simply change its file extension—the result may still be a login page. A file import is usually a local copy, and whether it can update automatically depends on the client and the source. Don't assume it's a URL subscription that will keep itself up to date.
If Import Fails, Identify Where It Failed
If the client reports a download timeout or connection failure, first check whether your current network can reach the subscription service and whether the link has expired. Don't switch proxy modes yet—the profile may not have loaded. Errors such as yaml: unmarshal errors, invalid format, or parse failure mean you should check the response and make sure the client supports its format. The URL may return a webpage or an error message instead of a Clash configuration. Don't delete large sections of the profile just to dismiss an error you don't understand.
After updating a subscription, check which profile is active and make sure it's still the one you intended to use. Some providers change policy group names, which can make your previous outbound selection invalid. For the difference between YAML and other subscription formats, see Subscriptions and configuration files in the glossary. If downloads keep failing, follow the subscription troubleshooting steps in Troubleshooting. You're ready to move on when the profile is enabled and its policy groups appear on the Proxies page.
02 Choose Rule Mode and an Outbound
Once the profile has loaded, find the Rule / Global / Direct mode selector on the home, Proxies, or Settings page. For your first setup, choose Rule mode, corresponding to the config key mode: rule. This mode uses the rules in the active profile to choose an outbound for each request—for example, sending some requests directly and others through a policy group. The result depends on the profile's rules; the mode name alone can't determine how every site should be routed.
Next, open the Proxies page and find the main policy group referenced by the rules. It may be called Proxy or Node Selection, or have a custom name set by your provider. Use the group in your profile rather than looking for an exact match with this guide. Expand the group and choose an available proxy outbound. If it includes an Auto Select or Failover subgroup, you can use that if it matches the profile's design and contains available options.
Choosing a proxy mode and selecting a policy group outbound are two separate steps. Even in Rule mode, requests will go direct if the policy group referenced by a rule is set to DIRECT. Changing the outbound in a group that no rule uses may have no effect on the current page. For the first test, change only the main policy group and note its original selection. Don't change every group at once, or you'll lose a useful point of comparison.
When to Use Global or Direct Mode
Global mode sends requests handled by the core through the global policy group. Use it briefly for comparison: if a page fails in Rule mode but works in Global mode, check the matching rule or policy group selection. Global mode doesn't necessarily route every app on your device; that depends on whether traffic is captured through the system proxy, VPN, or TUN. After switching to Global, check which outbound the global policy group uses—changing the mode alone isn't enough.
Direct mode sends requests handled by the core through a direct outbound. It's useful for temporarily comparing results without a proxy, but it doesn't exit the client or necessarily turn off the system proxy. When the test is done, switch back to Rule mode and confirm the main policy group's selection. If you're still unsure how policy groups, rules, and outbounds relate, see the policy group guide. Everyday tips are in the FAQ; for now, continue setting up the connection.
03 Connect and Route Traffic Through the System
Return to the client's home screen or Settings and make sure the core is running. Some desktop clients start the core automatically; others require you to click Start first. If the client reports that the core failed to start, check the first related error in the logs before enabling anything else. The system proxy can only send app requests to the right place if the local proxy is listening. An enabled system-proxy toggle doesn't mean the core is running.
Enable the system proxy on desktop
On Windows, macOS, and other desktop systems, enable the system proxy first and leave TUN off for now. The system proxy usually directs browsers and apps that follow system settings to a local listening address. Keep the client running after you enable it—if the process exits while the system proxy still points to a local port, your browser may lose its connection. Proxy support varies across Linux desktop environments, and some apps need their own proxy settings. The toggle alone can't confirm that every app is routed.
If your browser has a separate proxy-switching extension, set it to use system settings or disable it temporarily so it doesn't override the address set by the client. Also disconnect other proxy apps and VPNs. Start with just one client routing traffic; once the connection works, decide whether you need a more complex setup. Don't change the profile, port, and mode all at once, or it will be hard to tell what caused a failure.
Approve the system VPN prompt on mobile
On Android and iOS, tapping Connect or Start usually brings up a system VPN permission prompt. Make sure the prompt comes from the client you just installed and are currently using, then allow the connection. Return to the app and check its connection status, then confirm the VPN is active in system settings. The VPN indicator shows how traffic is routed; it doesn't mean every outbound in your subscription is available. Verify with a webpage and the connection log next.
If the system says another VPN is already active, disconnect the other app and try connecting again. If an Android connection often drops in the background, check battery optimization and background limits after the first successful test. On iOS, check the active VPN configuration in system settings. Don't confuse background activity issues with subscription import problems. For app-specific steps, see mobile troubleshooting.
Check Local Ports Before Changing Them
On desktop, a common mixed port setting is mixed-port: 7890, which accepts both HTTP and SOCKS proxy connections. Your profile may use a different port, so check which one is actually listening. If you configure an app manually, the address is usually 127.0.0.1; use the mixed port shown by the client. external-controller: 127.0.0.1:9090 is the control interface, not the proxy port for browsing. Don't use it by mistake.
If the logs show address already in use, first quit another client that's using the port, then try starting again. If you really need to change the mixed port, note the original value, save the new one, and reload as required by the client. Then update the system proxy and any apps configured manually to use the new port. You don't need to enable Allow LAN for initial testing; it lets other devices access your computer and isn't related to whether this device can connect.
04 Verify Websites and Request Routing
Open a new browser tab and visit one site that should use a proxy under your current profile, then another that should connect directly. Choose sites you know usually work instead of relying on a single unfamiliar test site. Refresh the pages to create new requests if needed. Cached pages and existing connections may retain their previous state, so checking an old page immediately after changing settings can make it look like nothing changed.
Next, open the client's Connections page and refresh the sites you just visited. Find the new request for each domain and check which rule matched, which policy group was used, and which outbound handled it. Some clients show these details in the connection view or request chain. A page loading successfully and its request following the expected route is a more reliable check than the connection indicator on the home screen. A DIRECT result isn't necessarily a problem—first check whether that site is supposed to connect directly.
A Website Loads, but No Connection Is Listed
First make sure the page sent a new request rather than showing cached content, then check whether the browser uses the system proxy. If only one app has no connection record, it may have its own proxy settings or ignore the system proxy. Don't replace the subscription yet. First work out whether traffic isn't reaching the client or is reaching it but failing on the outbound. If you need to route more traffic, consider TUN or configure the proxy in the app's own settings.
The Request Reaches the Client, but the Page Fails
Open the Logs page. The info level is usually enough for a first check. Reload the failing page once and look for errors logged at that time. i/o timeout means an operation timed out; check the destination and connection stage for context. no such host points to a DNS lookup failure, while connection refused means the connection was rejected. Don't diagnose from the last word alone. Keep the timestamp with the related request for more accurate troubleshooting.
Choose a different outbound in the main policy group and retry the same page to see whether anything changes. If it still fails, briefly switch to Global mode and confirm the global outbound to check whether routing rules are involved, then return to Rule mode. For persistent timeouts, follow node timeout troubleshooting. If the rules rely on geographic matching or a loaded database, see GeoIP troubleshooting. There's no need to keep reinstalling blindly—you now have enough information to investigate the specific cause.
After Verification, Keep a Reproducible Setup
Once both test pages behave as expected, keep the current profile, Rule mode, and verified main policy group selection. To update a subscription, use Update on the Profiles page and check that the profile is still active when the update finishes. Don't delete a profile that's in use just because a new entry appeared. Before editing rules manually, save a restorable copy and check whether the client supports overrides or merges, so the next subscription update won't overwrite your changes.
Finally, test disconnecting normally. On desktop, turn off the system proxy before quitting the client using its Exit option. On mobile, tap Disconnect or Stop. Check that regular websites still load, then reconnect to confirm the steps are repeatable. If you want Clash to connect at startup, read the Clash startup guide and note the difference between launching the client, starting the core, and enabling the system proxy. That's all you need for the initial setup; add TUN, LAN sharing, or custom DNS only when you have a specific need.