Quick start · A 10-minute setup
Import a Clash subscription
and connect through a proxy
Set up Clash in four steps: import a subscription, choose a proxy mode, connect, and verify. First, confirm that a browser request takes the expected route; then explore TUN, DNS, or rule overrides.
Choose a Client to InstallStep 01 · Profiles / Profile Setup
Import a subscription and activate the profile
Before you start, install a client and get a Clash-compatible subscription URL or local YAML profile from your service provider. The client does not include a proxy service, and installing it alone does not give you access to one. Subscription URLs often contain personal credentials: paste them only into a trusted client, never post them publicly, and don't run them through unfamiliar conversion websites.
Paste the Subscription URL and Download the Profile
In Clash for Windows, open Profiles in the sidebar. Paste the subscription URL into the field at the top, check for stray spaces or line breaks at either end, then click Download. This field is for a profile URL—not your provider's login page or payment history. In other clients, choose a remote subscription or URL when adding a profile, then paste the same address.
Wait for the download to finish. A new profile card should appear in the list. Click it to make it the active profile; a successful download does not necessarily activate it. Then open Proxies and check that policy groups and their options are listed. The profile is ready when it is selected and its policy groups can be expanded—not simply when the URL field is empty.
If no new profile appears, start with the error shown by the client. A timeout may mean your current network can't reach the subscription server. For authentication failures, expired subscriptions, or responses that aren't YAML, check with your provider. Switching TUN modes won't fix an invalid subscription URL: how traffic is routed and whether the URL works are separate issues.
Use a Local File or Update an Existing Subscription
If you already have a profile file, use Import in Profiles to select it. Some clients also let you drag a file onto the profiles page. Make sure it's a text-based configuration, not an HTML page saved from a website, and don't just change the file extension. After importing, select the profile and check its contents in Proxies. If you see unsupported fields or a parsing error, ask the provider for a version compatible with your client's core rather than deleting every field that causes an error.
To update a subscription later, use the update action on its existing profile card. After updating, check that the profile is still selected and its policies are still there. Edits to a file generated from a remote subscription may be overwritten at the next update. For your first setup, use the provider's configuration as is; see the Platform Guides for adding rules and configuration overrides.
You don't need to enable any connection switches yet. The profile provides proxy nodes, policy groups, and routing rules. Next, choose a mode and decide which policy should handle each request.
Step 02 · Proxies / Proxy Settings
Choose Rule mode and a proxy policy
Open Proxies and find the mode selector. You'll usually see Rule, Global, and Direct. For everyday use, start with Rule: requests are checked against the profile's rules in order, and the matching rule determines whether traffic connects directly, uses a proxy, or is handled another way. Routing isn't simply split by a site's country; it depends on the active profile, so results may change when you switch subscriptions.
Choose the Mode and Proxy Separately
After selecting Rule, expand the manual selection policy group in your profile. It might be called Proxy Selection, Node Selection, or something else—the name is up to the profile author, so don't look for a group with one specific name. Choose a proxy node or an automatic selection group configured by your provider. The selected option is usually highlighted or marked; check that the indicator is on the option you intended.
If the group has DIRECT selected, its requests connect directly. REJECT blocks requests. These are policy options, not remote proxy nodes. Some groups refer to another group; check that group's current selection too, so changing the outer group name doesn't leave the actual route unchanged.
If your client offers a connectivity test, try it on the current group before choosing a responsive option. A successful test only shows that the test address was reachable at that moment; it doesn't guarantee access to every site. A failed test may be due to the test target or network conditions. For initial troubleshooting, pick one specific node so you can reproduce the result; there's no need to adjust automatic selection settings at the same time.
When to Use Global or Direct
Global usually sends requests that reach the core through a global policy. It can help troubleshoot routing temporarily, but check which node the global group has selected. Global mode doesn't automatically route every app through the client: programs that ignore system proxy settings may bypass it. To handle those apps, consider TUN in the next step.
Direct sends requests that reach the core directly, which can be useful for temporarily comparing network behavior. It doesn't disable System Proxy or quit the client. To stop proxying altogether, turn off traffic interception rather than switching to Direct. When you're done testing, switch back to Rule so you don't forget the test setting next time you open the client.
At this point, two things should be true: the mode is set to Rule, and each policy group that should use a proxy has an option selected. Now enable System Proxy or VPN to route app traffic through the client. Otherwise, even with the right node selected, your browser may still use its original route.
Step 03 · General / Connect
Enable System Proxy; use TUN if needed
For your first desktop connection, start with System Proxy so you can observe the results. Open General in Clash for Windows. Check that the client hasn't reported a port conflict or core startup failure, then enable System Proxy. Apps that follow the operating system's proxy settings will send requests to the local proxy port, where the client handles them according to the mode and policy you chose above.
Connect on Desktop with System Proxy First
Port in General is the local listening port. Many configurations use 7890, but use the value shown in your client rather than changing it just to match this guide. System Proxy usually updates the relevant operating system settings automatically. Don't enter a second port in system settings or use a remote node's port as your local proxy port.
Leave the client running after enabling System Proxy, then test in a browser. Closing the main window may minimize the client to the system tray or quit it, depending on its settings; check that it is still running in the tray or menu bar. Temporarily stop other proxy or VPN apps too, as they can overwrite the system proxy settings and send requests somewhere else even when the switch appears to be on.
If you're only using this computer, you can leave Allow LAN off. It allows devices on your local network to access the client's listening service; it isn't required for a proxy connection. Start with Windows only controls startup at boot and doesn't replace System Proxy. For your initial setup, leave these options alone to limit the number of variables.
Before Using TUN, Set Up the Service and Permissions
If your browser works but an app ignores system proxy settings, consider TUN Mode. On Windows, Clash for Windows usually requires the relevant service to be installed and running first; other clients may require service mode or administrator permissions. Follow the client's instructions to set up the service and confirm it's running before enabling TUN. If the switch turns itself off or reports a permissions error, don't assume you're connected.
TUN involves a virtual network adapter, routing, and DNS. You don't need to copy a full configuration from the internet for your first setup, and it's best not to change several network settings at once. If the service is ready but TUN still won't start, note the client error and consult the Platform installation and configuration guides. To restore your connection, turn off TUN and return to the verified System Proxy setup so you can troubleshoot each issue separately.
On Mobile, Connect Through the System VPN Prompt
Android and iOS clients usually have a Connect button on the home screen. Select a subscription and policy first, then tap Connect and approve the system prompt to establish a VPN connection. Android typically uses VpnService, while iOS uses its built-in VPN capability. A VPN indicator means the system has established a tunnel; it doesn't guarantee that every node in your subscription can reach every destination.
If your device reports that another VPN is active, stop that connection and try again. During your first Android test, keep the app in the foreground. Once the connection works, configure battery and background permissions as needed. Don't rely on the status bar icon alone: use an actual request to confirm how traffic is routed.
Step 04 · Connections / Logs
Verify the proxy is working and restore your network when done
First visit a site that normally connects directly to confirm your basic internet connection still works. Then open a site that should use a proxy under your current rules. Open a fresh page and reload it so cached content isn't mistaken for a live connection. If the page loads, check the client's connection records to confirm the route matches what you expected.
Check New Requests in Connections and Logs
Open Connections and look for a new connection to the relevant domain as you reload the page. Check the matched rule, policy group, or proxy chain shown by your client. If the final route is DIRECT, the rule may be allowing a direct connection; don't assume the client has failed just because no proxy node was used. Compare the result with how the active profile is supposed to handle that domain.
If no connection appears, check Logs for new requests or errors. Short-lived connections may disappear from the list quickly, so not seeing a single entry isn't enough to draw a conclusion. If browser requests never reach the client, first check that System Proxy is still enabled and that no browser extension is controlling the proxy separately. With TUN, check the service status and which traffic it captures.
If the logs show a proxy was selected but the connection timed out, choose another node in the same policy group and try the same destination without changing anything else. If only certain domains fail, the cause may be a rule, DNS, or a restriction on the destination site; don't reinstall the client right away. Note the error and the steps that led to it, then use the Platform Guides to investigate. This is more useful than changing ports, modes, and DNS all at once.
An external IP lookup can be useful as a secondary check, but rules may route the lookup site directly, so its result may not reflect how other requests are routed. Don't treat a site loading in Global mode as a long-term fix. It usually means you should check the original rule or policy group selection, then switch back to Rule for everyday use.
Stop the Connection and Confirm Your Network Is Restored
When testing is complete, turn off System Proxy before exiting the desktop client. If you used TUN, disable it too and wait for the virtual connection to stop. On mobile, tap Disconnect and check the system VPN status. Then open a direct-connection site to confirm regular internet access is back, giving you a clear baseline for future troubleshooting.
If the client crashes and no sites load, Windows users can go to Settings → Network & Internet → Proxy and check for a manual proxy still pointing to a local port. On a personal computer, disable it only after confirming the client left the setting behind. Don't change existing proxy settings on a work- or school-managed device. Switching to Direct in the client won't remove a leftover system proxy address.
Note the active profile name, proxy mode, and policy group selection. Keep the subscription source, but don't share screenshots that reveal the full subscription URL. For everyday use, you usually only need to update the existing subscription, confirm its profile is selected, connect, and run a quick check. Repeat these four steps when switching clients or devices. For platform permissions, DNS, rules, and configuration overrides, see the Platform Guides.