Clash Setup Guide: Four Steps From Subscription to Verification

Import the subscription

A subscription is a URL provided by your service that the client uses to download a full YAML profile containing your node list and routing rules. Before you start, find the "Copy subscription link" or "Clash subscription" button in your provider's dashboard and copy it to your clipboard — make sure you pick the one labeled Clash format, since other formats won't parse correctly.

Paste the link and download the profile

Open the client and switch to the Profiles page (some clients label it Profiles or Subscriptions). There's a URL input field at the top — paste the link you just copied and click Import or Download on the right. The client will send the request immediately, and within a few seconds a new profile card will appear in the list, showing the profile name, last update time, and traffic info (if the subscription includes it). If it stays stuck loading or shows a network error, first confirm the link opens fine on your machine, then check for extra spaces or a truncated URL.

Activate the profile

Downloading isn't the same as activating. Click the profile card to set it as the active one — most clients highlight the active card with a border or checkmark. After activating, switch to the Proxies page; if you see several node groups (common names include "Auto Select," "Fallback," and region-based groups), the subscription parsed successfully and you can move on. When your subscription updates later, just click the refresh button on the card to pull the latest nodes — no need to re-import.

If you want to understand what each field in this profile actually does, see Understanding the YAML Config Structure. We won't go into that here.

Choose a proxy mode

Once your profile is active, the next thing to decide is how traffic gets routed. On the main screen or at the top of the Proxies page you'll find a mode switch, usually three options side by side: Rule, Global, and Direct. The difference between them comes down to which traffic gets sent to the proxy:

Rule mode is the right choice for everyday use: the routing rules bundled in your subscription send the traffic that needs a proxy to a node while everything else stays direct, saving bandwidth without slowing down local sites. The mode switch takes effect immediately — no restart needed.

Once the mode is set to Rule, move on to step three to pick a specific node.

Connect to a node and enable the system proxy

Open the Proxies page, which lists all the nodes from your subscription grouped by category. Each group represents a selection strategy: "Auto Select"-type groups pick a node automatically based on latency results, while region-based groups are picked manually. On first use, it's worth running a latency test — click the lightning bolt or speed-test icon in the top-right corner of a group, and the client will probe every node in it, showing a millisecond value next to each one a few seconds later.

Pick a node

Lower numbers mean a faster connection — anything in the green range (roughly under 200ms) is a good pick. Nodes showing "timeout" aren't available right now, so skip them. Click a node to select it; the selected one gets a highlight marker. If you're unsure, just pick the "Auto Select" group and let the client handle it based on the test results. For more on reading latency numbers and batch-testing tricks, see Your First Connection, Start to Finish.

Turn on the system proxy

Picking a node doesn't automatically route your traffic — you still need to go back to the main screen and turn on the System Proxy toggle. Once enabled, the operating system directs traffic from apps that respect the system proxy (browsers, for example) to the local listening port (usually 7890 by default — check the client's home screen to confirm). Windows and macOS clients both put this toggle on the main panel; on Android, tapping the start button on the home screen opens a VPN tunnel, and the OS will prompt you to grant VPN permission the first time — just allow it.

Some terminal apps and command-line tools don't respect the system proxy setting and need the proxy environment variables set separately — we'll cover that in the verification step below. With the toggle on and a node selected, you're ready for the final step: confirming the whole chain is actually working.

Verify the proxy is working

The last step is confirming with hard evidence that traffic is actually going through the proxy, rather than just assuming things are working. We recommend cross-checking from three angles: exit IP, client logs, and a command-line request.

Check the exit IP in a browser

Open your browser and visit any IP lookup page to see your current public exit IP and its region. If the region matches your selected node, browser traffic is going through the proxy. If it still shows your local ISP's address, double-check that the system proxy toggle is on and the mode is set to Rule or Global.

Check the log panel for connection entries

Switch to the client's Logs or Connections page, keep it open, and refresh a webpage in your browser at the same time. Under normal conditions, new connection entries should scroll in live, showing the target domain, the matched rule, and which node handled it. Entries appearing means traffic really is passing through the client; no new entries at all means traffic isn't getting in, which points to a system proxy issue.

Command-line verification (optional)

Terminal tools don't read the system proxy by default, so you can use curl to explicitly point at the local proxy port for a side-by-side comparison:

# Request through the proxy (use the port shown in your client)
curl -x http://127.0.0.1:7890 -sI https://example.com

# Comparison: direct request, no proxy
curl -sI https://example.com

Both commands should return HTTP response headers when things work correctly. If the proxied one gets connection refused, it's usually the wrong port number or the client isn't running. To make a terminal session use the proxy consistently, set environment variables in your shell:

export http_proxy=http://127.0.0.1:7890
export https_proxy=http://127.0.0.1:7890

If the system proxy is on but no traffic is getting through, common causes include a browser extension overriding your proxy settings or a bypass rule mistakenly excluding the target domain. See System Proxy Not Working: A Troubleshooting Guide for the full checklist.