Clash Setup Guide: From Subscription Import to Connection Verification

Load the Active Configuration

Import the Subscription and Make It Active

After starting the client, find the “Subscription,” “Configuration,” or “Profiles” page. Some desktop clients show it in the left sidebar, while mobile apps usually place it at the top of the home screen or in a side menu. Choose “Add Subscription,” “New Configuration,” or a plus button. Enter a recognizable name, such as “Daily Configuration,” then paste the full subscription URL into the URL field.

After confirming there are no spaces around the URL, click “Import,” “Save,” or “Download.” The client will request and parse the remote configuration, so wait for the result instead of clicking repeatedly. Normally, the subscription list will show the name you entered and a last-updated time. Some clients add the configuration without selecting it, so click the item, enable it, or choose it from the active-configuration dropdown.

A successful import does not mean a connection has been established. It only means the configuration has been handed to the client; system traffic usually remains unchanged. First check that the configuration is usable: the proxy or policy-group page should show the policy groups defined in it, and the rules page should contain rule content. This step only confirms that the structure loaded; there is no need to study every proxy, policy group, or rule.

If the page reports a download failure, copy the subscription URL again and use a regular browser to confirm that the provider’s page is reachable. YAML parsing errors, invalid fields, or an empty configuration usually come from the subscription response rather than the system proxy switch. Try “Update Subscription” once; if it still fails, keep the error message and contact the configuration provider instead of deleting or editing the original configuration without understanding its fields.

After confirming the active configuration name and opening its policy groups, continue to the proxy-mode step. For configuration-file structure, field meanings, and override methods, see the complete configuration reference. This guide leaves the configuration unchanged for now to avoid adding variables before the first connection.

Send Application Traffic Through the Client

Enable the System Proxy; Use TUN Mode When Needed

The first two steps configure the client internally, but the operating system still needs to know where to send traffic. Return to the client’s home or Settings page and enable “System Proxy,” “Set as system proxy,” or an equivalent switch. Desktop clients usually write the current HTTP and HTTPS proxy settings automatically; if the client requests system permission, follow the operating system’s prompt.

After enabling it, wait a few seconds and check that the switch stays on. If it turns off immediately or the system reports insufficient permission, do not enable other features yet. On Windows, restart the client normally and check whether security policies are blocking it. macOS may require system credentials to change network settings. Mobile devices generally establish a local connection through the system VPN permission dialog, which you must approve.

For browsers, common desktop apps, and software that follows system proxy settings, the system proxy is usually enough. Some apps ignore it, while certain UDP traffic, command-line programs, and unusual network environments may bypass it. In those cases, consider TUN mode. TUN creates a virtual network device and captures a broader range of system traffic, but it requires additional permissions and is more likely to conflict with other VPNs, virtual adapters, enterprise security software, or network accelerators.

For the first setup, enable only the system proxy and complete the next verification step. If the browser works but a specific app still bypasses the client, return to Settings and enable TUN. When prompted to install a service, add a VPN configuration, or authorize a network extension, approve the required action. After enabling TUN, do not run another tool that takes over the default route. If the entire network stops working, disable TUN first, confirm that the system-proxy path still works, then investigate permissions and virtual-adapter issues separately.

“Allow LAN Connections” is not the same switch as establishing a local connection. It lets other devices on the same LAN access the proxy port on this device and is unnecessary for ordinary single-device use. Port numbers, bind addresses, authentication, and firewall rules are shared-connection settings. If you truly need cross-device access, read the common-field guidance in the complete configuration reference; do not widen the listening scope just to complete a local connection.

When the system proxy remains enabled, the client shows no errors, and rule mode is still selected, proceed to verification. Do not judge success only by the switch color. The real evidence is whether application requests enter the client and whether the expected policy handles them.