Before You Start: Get Your Subscription URL Ready

You’ll need two things: an installed client that opens normally, and a subscription link from your provider. The client reads the configuration, runs the core, and provides an entry point for traffic. The subscription supplies proxy nodes, groups, and related rules. Installing a client alone does not provide proxy service, and the examples on this page cannot replace an actual subscription.

On your provider’s subscription page, select a configuration format for Clash or mihomo, then choose “Copy subscription URL.” Don’t copy the account login page, purchase page, or a dashboard link from your browser’s address bar. Subscription URLs often contain access credentials, so keep yours on your own devices. Before sharing screenshots, asking for help, or posting logs, hide URL parameters, account details, and node passwords.

For your first setup, quit any other proxy or VPN apps that are routing network traffic, but keep your regular internet connection. Don’t import untrusted override scripts or change DNS and routing yet. That way, you can tell which setting caused a change at each step.

Step 1: Import a Subscription and Activate the Configuration

Open the client and select “Subscription” or “Configuration” in the sidebar. Find the field for a remote URL, paste the full link you copied, then choose “Import,” “Download,” or “Add.” If a dialog opens, select the remote subscription type and give it a short, recognizable name if needed. Leave the URL unchanged; don’t remove parameters or add spaces.

Wait for the client to download and parse the subscription. On success, a configuration card usually appears with a name, update time, or update action. The card means the configuration is saved, not necessarily in use. Select the card or choose “Use” or “Activate” from its menu. Check the selected indicator or current configuration name to confirm it’s active.

Next, open the “Proxy” screen. You should see the groups defined by the subscription; expand one to view its proxy options. If the screen is still empty, check that the configuration is selected, then review notifications or logs for parsing errors. Don’t enable the system proxy yet: without a loaded configuration, the connection steps can’t work.

Make Sure the Link Returns Configuration Data

If importing fails, first determine whether the download failed or the format is incompatible. Download failures are often caused by an incomplete URL, an expired subscription, or a network that can’t reach the server. A format error may mean you copied a format for another client or the server returned a login page. Go back to the subscription page and select the Clash format rather than editing unfamiliar configuration fields.

If your provider only supplies a local YAML file, use “Import file” or “Local configuration” to select and activate it. The key difference from a remote subscription is how updates work: local files usually don’t receive new content automatically when the server changes. With a remote subscription, choose “Update” on the configuration card to fetch the latest version.

Run One Manual Update First

After activating a remote subscription, choose “Update” from the configuration card menu to make sure the URL is still accessible. Keep the client’s default update interval for now, then adjust it later if your provider recommends a different one. Updates can change node and group names, and may overwrite manual edits to a remote configuration, so use the subscription as provided during initial setup.

If the link requires a proxy to download, follow your provider’s instructions to get a usable local configuration or another access method. Don’t submit a private subscription to an unfamiliar online converter. If you still can’t import it, follow the subscription checks in the Troubleshooting guide. Once the groups appear and the correct configuration is active, choose a proxy mode.

Step 2: Choose a Rule Mode and Proxy Group

Find “Proxy mode” on the client’s home screen or “Proxy” page, and select “Rule.” This controls how the core handles requests that reach it; it doesn’t route traffic from every app by itself. The next step covers how traffic gets to the client through the system proxy, VPN, or TUN.

Rule mode is a good place to start: each request follows the configuration’s rules to a direct connection or a proxy group. “Global” sends requests that reach the core through the global policy; it doesn’t route traffic from every app on your device. “Direct” is useful for a quick comparison or to bypass proxy routing. Don’t treat Global as a permanent fix just because one page won’t load.

Mode	How it works	Recommended for initial setup
Rule	Routes requests directly or through a proxy according to the configuration rules	Recommended; check which proxy groups the rules actually use
Global	Routes requests that reach the core through the global policy	Use for a quick comparison; you still need to select the global outbound
Direct	Routes requests that reach the core directly	Use to compare connection results; this does not turn off the system proxy

Choose an outbound in the group used by the rules

Keep Rule mode selected and expand the main proxy group. Group names are set by the subscription author and may be “Proxy,” “Select Node,” or something else. Choose a node you want to use. If your subscription includes an “Auto Select” group, you can choose it instead; don’t create an empty group just to match the name in this guide.

A proxy group can point to another group. If the main proxy group selects “Auto Select,” the nested group determines the actual node. If it selects “Direct,” requests handled by that group will connect directly, even if another group has a node selected. For your first setup, change only the main proxy group and leave other app-specific groups at their subscription defaults.

If the client offers a connectivity test, try the current option and rule out any that clearly fail. A successful test only shows that its test target is reachable; it doesn’t guarantee every website or app will work. Just confirm that your selection is available, then verify it with a real webpage and connection logs. There’s no need to make every test show the same result.

You don’t need to edit rule files or learn every strategy type yet. For explanations of select, url-test, and rule matching, look up the terms in the quick reference. Once you’ve chosen a mode and main outbound, move on to the next step: routing device traffic to the client.

Step 3: Enable the System Proxy or VPN Connection

Return to the client’s home screen and confirm that the right configuration is selected and the core hasn’t failed to start. Some desktop clients start the core automatically; others require you to click “Start” or a connect button. If the logs repeatedly show configuration errors, listener failures, or port conflicts, fix those first. Don’t pile on system proxy and TUN settings.

Desktop: Enable the System Proxy First

In your Windows, macOS, or Linux desktop client, find and enable “System Proxy.” Clash Verge Rev usually shows this toggle on the home screen, though it may also be under system-related settings. Once enabled, browsers and apps that respect system proxy settings send requests to the local proxy port, where the rules and strategy you selected handle them.

If your system asks to allow network access, verify the app name and where you installed it from before granting permission. The first launch may also require your device administrator password. Don’t enter a port number copied from another guide; use the local listening port shown by your client. Leave “Allow LAN” off for now; your local browser doesn’t need to expose the proxy to other devices.

Linux desktop environments vary in their support for system proxy settings, and some apps don’t use the desktop proxy configuration. First test the basic connection in a browser that respects proxy settings. A failed terminal command alone doesn’t mean the whole client is broken. If a browser extension also controls your proxy, disable it temporarily so it doesn’t override the system setting.

Mobile: Approve the System VPN Request

On Android, select a configuration and strategy, return to the home screen, and tap “Start” or the connect button. The first time, Android asks to set up a VPN connection; confirm the request comes from your client and tap Allow. On iOS, the client may ask to add a VPN configuration. Follow the system prompts, approve it, then return to the client and connect. If you dismiss the permission prompt, the subscription may still appear even though traffic isn’t routed yet.

After connecting, check the system VPN status and the client’s connection status. If another VPN or local VPN-based filtering app is running on your phone, stop it before connecting with this client. On Android, check that your test browser is included if per-app routing is enabled. For the first test, keep the default app scope and narrow the list after you’ve confirmed the connection works.

TUN Mode: Enable It After Basic Connectivity Works

TUN routes traffic from some apps that ignore system proxy settings, and often involves a virtual network adapter, routing, and DNS. If you need it on desktop, follow the client’s prompts to install or enable service mode, then turn on “TUN mode” and test again. Avoid changing the network stack, DNS mode, and routing parameters all at once; there’s no one-size-fits-all configuration.

If enabling TUN disrupts a connection that was working, turn TUN off and restore the connection method you already verified. Work through permission or virtual adapter issues in the Troubleshooting guide. A connected status only means the traffic entry point may be active; complete the final step to check that traffic is actually routed as expected.

Step 4: Verify Rules and Outbound Traffic

Open a new browser tab and visit a site that normally connects directly to confirm your internet still works. Then visit a site that should use the proxy under your current configuration. Use fresh requests where possible instead of refreshing cached pages. If the client has a “Connections” panel, open it before visiting the sites so you can match new requests to your browsing activity.

Find each request by domain in the connection list and expand its details. Look for fields such as “Matched rule,” “Strategy chain,” or “Outbound.” The labels vary by client, but check the same things: did the request reach the core, which rule matched, and did it use a direct or proxy outbound? In Rule mode, seeing DIRECT for a site that should connect directly is usually expected.

Use What You Can Observe to Decide What to Check Next

If the page loads and its request uses the expected strategy, the basic connection is working. A page loading without a connection log doesn’t prove that it went through the client; it may have connected directly, or logging may be disabled. If the client supports connection logs, make sure they’re working before testing. Don’t assume an empty list means the node is broken.

If a request that should use the proxy never appears in the list, first check the system proxy toggle, browser proxy extensions, and mobile per-app scope. If the request appears but uses a direct outbound, review Rule mode and the main proxy group. If it uses the proxy strategy but still fails, test another available option for comparison. Change one thing at a time so the results are meaningful.

If your browser works but terminal apps don’t, check the terminal’s own proxy settings before assuming the subscription has expired. Environment variables, app-specific proxy settings, and TUN are different ways to route traffic; you don’t need to configure them all for a first setup. See Troubleshooting browsers and terminals separately for the steps. For DNS, certificate, or client crash issues, use the systematic troubleshooting guide.

Compare the Connection On and Off

Save your work, then briefly turn off the system proxy or mobile connection and request the same site again. Restore the connection and retry. Comparing the results and client logs helps confirm the actual route. Don’t switch networks, nodes, and modes at the same time, or you won’t know what caused the change. Turning off the desktop system proxy won’t disable TUN, so include it in the check if it’s enabled.

Once the basic connection is verified, enable “Start on boot” and “Connect on startup” if you need them. These are usually separate settings: the first launches the app, while the second routes traffic after launch. After changing them, restart your device when convenient and check the active configuration, proxy mode, and system proxy status—not just whether the client icon appears in the system tray.

When you’re done for the day, turn off the desktop system proxy before choosing “Exit” from the client menu. If your browser can’t connect after an unexpected exit, check your system network settings for a leftover manual proxy pointing to your local machine. Its address should match the client’s actual running state. On mobile, disconnect from the client and confirm the system VPN is off.