Clash Setup Guide: From Subscription Import to a Working Connection

A Clash client ships with no servers of its own — every usable node comes from a subscription profile, so importing the subscription is always the first step. The link is generated by your provider and looks like https://sub.example.com/api/v1/client/subscribe?token=xxxx. One link returns a complete YAML file containing three parts: proxies, proxy groups and routing rules. Copy the link in full before importing: most import failures aren't the client's fault — the link got truncated in a chat app or email, the token parameter at the end lost a few characters, and the client receives an invalid response.

Here's where each client imports a subscription:

• Clash Verge Rev (Windows / macOS / Linux): click "Profiles" in the left sidebar, paste the link into the field at the top, then press Enter or click "Import". The client immediately sends a request to the subscription URL.
• Clash Plus (Windows / macOS / Android / iOS): open the "Subscription" group on the main screen, click "Add subscription" in the top right, paste the link and confirm. On mobile the app asks for network permission the first time; the profile only downloads after you allow it.
• Clash Meta for Android: open the left drawer and go to "Profiles", tap the plus button in the bottom right and choose "Import from URL", then paste the link and give the profile a name you'll recognize.
• ClashX Meta (macOS): click the menu bar icon → "Config" → "Remote Config" → "Manage", click Add in the dialog, paste the link into the URL field, confirm, then select that profile from the menu.

A successful import shows three signs: a new entry appears in the profile list; expanding it reveals proxies or proxy groups; and no parse error pops up. If all three hold, move on to the next step. If you see "profile parse failed" or the list stays empty, open the subscription link directly in a browser first — YAML text means the link itself is fine and the problem is an outdated client; a string of base64 characters or a web page means the provider serves a generic format or the link has expired, so switch the format to Clash in the provider's dashboard and copy a fresh link.

Once the import is done, turn on auto-update while you're there. Nodes in a subscription get replaced from time to time, and a profile that never updates can end up with every node timing out within days. In Clash Verge Rev you set the update interval from the profile's right-click menu; in Clash Plus it's on the subscription details page. 24 hours is a good value. Manual updates live in the same right-click menu or details page — when a large batch of nodes stops working, update the subscription once before troubleshooting anything else.

After the profile is imported, three things exist side by side in the client: proxies, proxy groups and rules. The switch that decides how traffic flows is the proxy mode, and mainstream clients offer four choices:

• Rule mode (rule): the default, and the mode you should stay in day to day. The client matches traffic against the rules section from top to bottom; whichever rule matches hands the connection to the policy group it points at, and anything unmatched falls through to the MATCH rule at the end. This is what sends sites in mainland China direct while overseas sites go through a proxy.
• Global mode (global): all traffic goes through the currently selected policy group and rules are ignored entirely. Use it in two situations only: testing whether a single node works, and checking whether a site is being sent direct because a rule misclassified it.
• Direct mode (direct): no traffic goes through a proxy. Switch to it when you need local networking back for a moment without quitting the client — faster than closing and reopening the app.
• Script mode (script): uses a JavaScript snippet to rewrite policy selection dynamically. Only some cores support it, and everyday use never needs it.

Where to find the setting depends on the client: Clash Verge Rev has a mode dropdown at the top of the "Proxies" page; Clash Plus has a mode switch at the top of the main screen; Clash Meta for Android puts it in the top right of the "Proxies" tab in the bottom navigation; ClashX Meta keeps it in the "Outbound Mode" submenu of the menu bar icon.

Beyond modes, you need to understand policy groups. On the proxies page each group is a card listing the available nodes or sub-groups, with the current selection shown at the top. When rule mode matches a rule, the actual exit is decided by whichever node is selected in the policy group that rule points to. That makes "rule mode + auto-select group" the most hands-off combination for daily use: rules decide whether a connection is proxied, the auto-select group decides which node carries it. Clicking a specific node in a group overrides auto-select, and you'll have to switch back manually the next time that node dies.

The corresponding fields in the config file look like this:

mode: rule
log-level: info
mixed-port: 7890
allow-lan: false
external-controller: 127.0.0.1:9090

Switching modes in the client interface takes effect immediately — no core restart needed. If you edit config.yaml directly and have the client load it, you'll need to reload the profile or restart the core before the new value is picked up. After switching modes, go back to the "Connections" page and watch a few entries to confirm traffic flows the way you expect before continuing.

The mode only decides how traffic is routed; you still need to hand system traffic to the client. Clash clients offer two ways to take it over — pick one.

System proxy: writes an HTTP/HTTPS proxy record into the operating system that points at the client's local listening port. It's quick to enable, needs no extra permissions, and covers browsers and most desktop apps; it does not cover programs that ignore the system proxy setting, such as some command-line tools, games, store apps and containers. Where to turn it on: Clash Verge Rev has a "System Proxy" switch on the "Settings" page; Clash Plus has one at the bottom of the main screen; ClashX Meta has "Set as system proxy" in the menu bar icon.

TUN mode: the client creates a virtual network adapter and takes over the whole machine's traffic at the IP layer, so every program is covered. The trade-off is that it needs administrator rights — on Windows the first launch installs and starts a system service, on macOS you have to authorize a network extension — and DNS has to be configured properly, or you'll see resolution errors and some domains failing to load. Where to turn it on: Clash Verge Rev has a "TUN Mode" switch on the "Settings" page and walks you through installing the service the first time; Clash Meta for Android has it under "Settings" → "Network" → "TUN"; ClashX Meta calls it "Enhanced Mode" in the menu bar icon.

Don't enable both at once. When the system proxy record and the virtual adapter are active together, the traffic paths overlap: some requests work, others time out, and tracking down the cause takes forever. Use the system proxy day to day and switch to TUN when a specific program won't cooperate.

Port settings: the client listens on several local ports by default — 7890 (mixed HTTP and SOCKS5), 7891 (SOCKS5), 7892 (Redir) and 9090 (external controller API). If another program already holds a port, the client fails to start or the system proxy switch won't turn on. Commands to find what's using a port:

# Windows
netstat -ano | findstr :7890

# macOS / Linux
lsof -i :7890

Once you've confirmed the conflict, change mixed-port in the config to a free port such as 7897, reload the profile, then toggle the system proxy off and on again — the proxy record in the OS doesn't follow the port change by itself, and only a fresh toggle writes the new port.

LAN sharing: with allow-lan: true, other devices on the same subnet can use this machine as a proxy, together with firewall rules and the bind-address setting. If only one device needs to get online, leave it at false.

Once the connection is up, don't just look at the switch color — confirm these four things in order.

1. The connections page shows live entries. Open the client's "Connections" page and refresh any web page; matching entries should appear in the list. Each entry shows the rule that matched, the policy group used, the exit node and the bytes up and down. A list that stays empty means traffic never reached the client — the problem is whether the system proxy or TUN actually took effect, not the nodes.
2. The exit address changes. Visit any IP lookup site in a browser; the location shown should match the node you selected, not your local ISP. This confirms traffic really goes through a remote server.
3. Routing behaves as expected. Back on the "Connections" page, check which rule each domain matched: sites in mainland China should hit direct-type rules and overseas sites should hit a proxy group. If mainland China sites are mostly proxied, the rule set didn't load or the GEOIP data is missing — updating the subscription usually fixes it. If overseas sites go direct instead, check the rule order for an overly broad rule matching too early.
4. The log isn't full of repeated errors. Set the log level to info or debug and watch for a while. A healthy log shows connections opening and closing; repeated DNS resolution failures, connection refused errors or TLS handshake timeouts mean the nodes or the DNS configuration have a problem, and you should go back to node selection or DNS settings.

Command-line check (optional):

curl -s -x http://127.0.0.1:7890 https://api.ipify.org

The address returned should be the node's exit address. If curl times out while the browser works fine, that terminal simply didn't inherit the system proxy — which is normal. Command-line programs need an explicit proxy flag, or you can switch to TUN mode.

Once verification passes, day-to-day use rarely requires touching the client again. What's left is keeping the subscription updated, switching to another node in a policy group when one dies, and glancing at the log now and then. Deeper settings — how DNS and Fake-IP work, rule syntax and priority, the structure of rule-providers, choosing a TUN stack — go beyond a ten-minute setup and are covered in the "Beginner to Advanced" long read, which you can work through chapter by chapter.