Clash Subscription Import and Proxy Connection

Before You Start: Check the Client, Subscription, and System Time

Before starting setup, confirm that the client is installed and opens normally. On first launch, Windows Firewall, the macOS network extension, the Android VPN connection, or the iOS VPN configuration may request permission. These permissions create the local proxy entry point; if you decline for now, the system proxy or VPN prompt will usually appear again later. Only handle network permissions explicitly shown by the operating system. You do not need to change ports, DNS, or routing parameters first.

Prepare a subscription URL that has not expired. It is usually a complete address beginning with https://, generated by your service provider. Copy every character; do not copy only a webpage title, and never paste the subscription address into a search engine or public page. Some services offer both one-click import and copy-subscription options. This guide uses the general method of copying the URL and importing it in the client, making each status easier to confirm.

Also check that the device date, time, and time zone are correct. Clock errors can affect HTTPS connections, causing subscription downloads, node handshakes, or webpage certificates to fail. Set system time to sync automatically, then close other software using the system proxy or a VPN tunnel. When multiple network tools handle traffic at once, Clash can be configured correctly yet still encounter connection loops, port conflicts, or a browser that continues using an old proxy.

Import the Subscription URL

After opening the client, go to the “Config,” “Subscription,” “Profiles,” or “Configuration” page. This page stores local configurations and remote subscriptions, and commonly includes options such as import from URL, add subscription, download configuration, or create configuration. Choose an option related to a URL rather than writing YAML manually. Manual editing is for users with existing configuration experience and is not required for a first connection.

Paste the complete subscription address you copied earlier into the input field. If a name is required, use a short, recognizable label such as “Daily configuration” or the service name. The name only distinguishes configurations inside the client and does not change the subscription contents. Click “Import,” “Download,” “Save,” or “Add” to request the configuration file from the subscription URL. Normally, a new configuration entry appears within a few seconds with an update time, update button, or configuration menu.

When the new entry appears, do not leave the page immediately. Select it or open its menu and choose “Use,” “Enable,” or “Set as active configuration.” Some clients switch automatically after a successful import, while others only add the file to the list. If nothing is explicitly selected, the proxy page may still use an empty or older configuration even though the new file was downloaded. To confirm that it loaded, open the proxy page and look for groups such as “Node Selection,” “Auto,” or “Global Direct.” Group names come from the subscription and vary between configurations.

If the import reports a format error, return to the subscription provider’s page and copy the address again. Make sure there are no leading or trailing spaces and that the link was not truncated by a messaging app. If you see a network error or loading never finishes, temporarily open the subscription domain’s homepage in a browser to check whether the current network can reach the server. Do not click update repeatedly in quick succession; frequent requests may trigger server limits. Wait and try again, or use a phone hotspot to rule out DNS and network-policy issues on the current Wi-Fi connection.

After importing, you can set an automatic update interval, but for the first setup it is best to run one manual update. Click the update button beside the configuration and proceed only after the update time changes or a success message appears. This confirms that the client saved the subscription URL and can later fetch new nodes and rules. Updating a subscription refreshes its contents; it does not establish a proxy connection automatically. You still need to choose the operating mode and proxy group.

Choose a Proxy Mode and Proxy Group

After loading the configuration, open the “Mode,” “Proxy Mode,” or “Mode” setting. Common choices include Rule, Global, and Direct. For first-time use, choose “Rule” or Rule. Rule mode matches the configuration’s routing rules from top to bottom: suitable requests connect directly, requests requiring a proxy go to a proxy group, and requests matching a blocking rule are rejected. It works well for everyday browsing and makes each request’s result visible in the connection logs.

Global mode sends most requests through one proxy group. It is useful for quickly checking whether a website works over the proxy path, but it should not be the only way to troubleshoot every issue. Direct mode bypasses the proxy and is useful for pausing proxying or comparing results with a normal connection. If the client also offers options such as Script or Mixed mode, keep the subscription default for now. For more detail, see the proxy mode categories in the glossary.

After selecting Rule mode, open the “Proxy” or “Proxies” page. It shows the proxy groups defined in the configuration, not the subscription file itself. Find the group responsible for most traffic, often named “Node Selection,” “Proxy,” “Proxy,” or a custom name from the service provider. Open the group and choose a specific node, or select a strategy group such as “Auto” or “Failover.” If you are unsure, start with the subscription’s automatic strategy; it selects an available option according to the configured checks.

Latency tests in the client only show whether a test request completed at that moment and its approximate round-trip time. They do not directly represent download speed or sustained stability. For the first setup, simply confirm that a candidate node does not consistently time out. Do not repeatedly test every node, as this creates many short connections and can skew results through concurrent requests. After choosing a node that completes the test, return to the proxy-group list and confirm that the main group shows the selected node or strategy.

Proxy groups can reference one another. For example, the “Node Selection” group may use “Auto,” while the rules ultimately point to “Node Selection.” Selecting a node only in a secondary group may therefore not change the main egress. Check the outermost primary group referenced directly by the rules and make sure it is not still set to DIRECT or REJECT. DIRECT means connect directly, while REJECT means refuse the connection; both are rule actions, not ordinary proxy nodes.

Enable the System Proxy and Connect

Once the configuration and proxy groups are ready, return to the “Overview,” “Home,” or “Settings” page and find “System Proxy,” “Set as system proxy,” or an equivalent switch. When enabled, the client points the system’s HTTP and HTTPS proxy to its local listening port. On Windows and macOS, most browsers and desktop apps that follow system proxy settings will use this entry immediately. Enabling the switch does not guarantee that every app uses the proxy: some ignore system proxy settings or use their own network stack.

On mobile devices, the connection is usually established through the system VPN interface rather than a traditional system proxy switch. The first time you enable it on Android or iOS, the system displays a VPN permission prompt, and a VPN indicator may appear in the status bar after approval. This local VPN interface sends device traffic to Clash for rule processing; it does not change the order in which you selected the configuration and proxy group. If another VPN is already connected, disconnect it first because mobile operating systems generally allow only one app to occupy the VPN tunnel.

If the target app does not follow the system proxy, or you need to handle more TCP, UDP, and command-line traffic, consider enabling TUN mode. TUN creates a virtual network interface with broader coverage than a standard system proxy, and may require administrator privileges, network-extension permission, or driver support. Do not switch the system proxy, TUN, DNS, and routing settings at the same time during first setup. Verify the browser with the system proxy first, then enable TUN separately if needed. This makes it easier to tell whether a problem comes from the basic configuration or the virtual adapter environment.

After enabling the switch, watch the client’s status area. A normal status may show “Running” or “Connected,” or simply remain enabled. The logs should not repeatedly report port conflicts, insufficient permissions, or configuration parsing failures. If the system proxy switch turns off immediately, fully quit other proxy clients and restart the current client. On Windows, try launching features that need drivers with administrator privileges. On macOS, confirm in System Settings that the network extension is allowed to run.

Do not change the node or configuration yet. Keep the current state and open a completely new browser window for verification. A new window reduces interference from old connections, browser cache, and background requests from existing pages. If the browser has a separate proxy extension configured, disable it temporarily so the browser follows the system proxy. Otherwise, requests may bypass Clash or pass through two proxy layers and create a loop.

Verify That the Proxy Works

Keep the client running. First open a website that normally works through a direct connection, then visit a target website that requires proxy rules. If both pages load, the basic routing path is working. Testing only one website can be misleading because of site outages, browser cache, or regional restrictions, so check at least two different domains. Do not rely only on the switch shown on the client’s home page; use the connection logs to confirm that traffic actually entered the client.

Open the “Connections” or “Logs” page, then refresh the test page in your browser. The connection list should show the domain, destination address, protocol, and rule result. If it shows a proxy group and the selected node, the request entered Clash and was forwarded according to the proxy rules. If it shows DIRECT, the request matched a direct-connection rule. If no related record appears, the browser is usually not using the system proxy, or the app’s traffic is not being handled by TUN.

If a connection record appears but the page still will not load, first identify where the failure occurs. If the record appears quickly and ends with a timeout or connection failure, try another proxy node. If multiple nodes fail, manually update the subscription once and reload the configuration. For DNS errors, restore the DNS settings supplied by the subscription and avoid stacking browser secure DNS, custom system DNS, and client overrides. If the rule result is REJECT, the configuration explicitly blocked the request; inspect the rule source instead of repeatedly switching the system proxy.

If a direct-connection website also fails, turn off the system proxy or disconnect the mobile VPN and check whether ordinary network access returns. If it does not, the issue is with the current network, router, or system DNS, so do not keep changing nodes in Clash. If access returns immediately, check the local port, running status, and active configuration in the client. The port specified by the system proxy must match the port the client is actually listening on. Normally the client sets this automatically, so manual entry is unnecessary.

After verification, test the app you actually plan to use. If the browser works but an app produces no connection records, it may not read system proxy settings and may require TUN mode or its own proxy configuration. If the app produces records but a specific feature fails, note the domain, matched rule, and failure time, then follow the symptoms in the complete troubleshooting guide. During deeper troubleshooting, change one variable at a time and retest after each change so you can identify what caused the result.

Next Steps: Update Configurations, Switch Nodes, and Stop the Connection

For everyday use, you do not need to import the subscription again each time. After starting the client, confirm that the current configuration is still selected, then enable the system proxy or mobile connection. When the service provider changes nodes or rules, return to the configuration page and click Update, then confirm that the updated configuration remains active. Some clients reload automatically after an update; others require you to click “Reload” or select the configuration again.

If one node becomes unstable, switch only the node in the main proxy group; do not delete the subscription or reinstall the client. After switching, close old webpage connections and refresh, then check the connection logs to see whether new requests use the new egress. To pause proxying, turn off the system proxy, VPN, or TUN switch. Simply closing the window may leave the program in the tray with the system proxy enabled, so confirm that both the client status and system network settings have returned to normal.

After completing the basic workflow, continue with concepts such as rule matching, proxy groups, Fake-IP, TUN, and DNS. Definitions are collected in the Clash glossary. For no internet access, node timeouts, subscription failures, or a system proxy that does not work, check the relevant symptom section in the troubleshooting documentation. If you need to revisit this guide, start with four checkpoints: did the import succeed, is the mode correct, is the connection enabled, and do records appear? These usually identify the failing layer quickly.