Clash Subscription Import and Connection Steps

Import a Clash Subscription

After opening the client, find the configuration management screen. Desktop clients for Windows and macOS usually place it in the sidebar or top navigation under “Profiles,” “Config,” or “Subscription.” Android clients generally open “Config” from the home screen, followed by the add button in the upper-right corner. The page should offer options such as importing from a URL, importing a local file, or creating a configuration. Choose the URL or subscription import option this time, not a local YAML file.

Click “Import from URL,” “New Subscription,” or a similarly named button. If the interface asks for both a name and an address, enter a short, recognizable name such as “Daily Subscription,” then paste the complete subscription URL into the URL field. Some clients also show an automatic update interval. For the first setup, keep the client’s default value, complete one successful import, and adjust it later according to the subscription service’s update frequency.

After pasting, check both ends of the address. There should be no space before the URL, and the end should not contain a period, non-ASCII punctuation, or a line break. Then click “Save,” “Import,” or “Download.” The client will request the subscription and convert the response into a local configuration. Normally, a new configuration entry appears with its name and update time; some clients also show an update button. Select this configuration so it becomes active. If it is imported but not selected, the client may continue using the previous configuration.

As soon as the configuration appears, run one manual update. Desktop clients usually provide a refresh button beside the entry, while mobile clients may require a long press or an item menu. After the update, look for a clear success status and confirm that the update time has changed. Then open the proxy or policy group page and check whether policy group names and selectable proxy nodes are present. If they are visible, the subscription has been parsed and loaded into the client.

If no new configuration appears after importing, do not repeatedly create identical entries. Return to the address field, paste the URL again, and check whether the network allows the client to reach the subscription URL. A format error may indicate an incomplete URL, an expired subscription, or a server response the client cannot recognize. If the request times out, retry from a network that can reach the subscription service normally. For detailed troubleshooting of status codes, empty subscriptions, and update failures, see the relevant issue in the Help Center.

Choose a Proxy Mode and Policy Group

After the subscription loads, open the “Proxy,” “Proxies,” or “Mode” page. Common Clash modes include Rule, Global, and Direct. For an initial setup, choose Rule mode, usually labeled “Rule.” It uses the rules in the configuration to decide where requests go: connections that require a proxy are sent to policy groups, while local networks and explicitly direct destinations connect without a proxy.

Global mode sends most routable traffic through one proxy policy. It is useful for briefly checking whether a problem is caused by rule matching, but it is not a suitable permanent choice for every environment. Direct mode connects to destinations without a proxy and is useful for pausing the proxy path or running comparison tests. If the client has a mode switcher at the top, make sure “Rule” is highlighted. If the setting uses a dropdown, save it, return to the home screen, and confirm that the status bar also shows Rule.

After choosing the mode, do not enable the system proxy immediately. First configure the policy group on the proxy page. Subscriptions commonly include groups named “Node Selection,” “Proxy,” “Auto Select,” or something similar. Open the primary top-level policy group and choose an available node. If it contains regional or purpose-based groups, open each level until you select an actual node. The client indicates the active choice with a highlight, check mark, or radio button.

Some clients provide a latency test button. Run one test for the policy group to rule out nodes that cannot establish connections on the current network. The result reflects the response from your device to the test target at that moment; it does not represent the loading performance of every website. If a node fails, choose another and continue the guide. There is no need to change the test URL, health-check interval, or policy-group algorithm during the initial setup.

Auto select, failover, and load balancing are different policy-group behaviors. Auto select generally chooses a more responsive node based on health checks; failover switches when the current node becomes unavailable; load balancing distributes connections according to the configuration. If the subscription provides these groups, you can use them directly, but this guide recommends selecting one clearly identified node for the initial verification. That makes it easier to determine which path is being used when something goes wrong.

After making your selection, return to the client home screen and confirm two states: the running mode is Rule, and the primary policy group points to a specific node or a working automatic policy group. If the client supports policy-group persistence, future subscription updates will usually try to retain the current choice. If the choice resets after an update, reopen the policy group and check it. For explanations of policy-group types, rule-matching order, and the MATCH fallback rule, continue with policy-group fields and rule syntax.

Enable the Connection and Traffic Routing

Once the mode and node are ready, confirm that the client core is running. Desktop clients usually provide a “Start,” “Service Mode,” “Core Status,” or tray switch on the home screen; Android and iOS clients show a connection button. After you click Start, the client should enter a running state. If the system asks for firewall, network access, or VPN permission, allow the client to create its local proxy service on the current device. Otherwise, apps may not send traffic into Clash even when the switch appears enabled.

Next, choose how traffic should be routed. Browsers, system components, and most desktop apps that follow the operating system’s proxy settings can start with the system proxy. Windows and macOS clients usually provide a “System Proxy” switch that writes the local proxy address and port into the system settings. You do not need to install a browser extension or enter a second proxy port in the browser at the same time.

Android and iOS generally route traffic through the system VPN interface. The first time you tap Connect, the system displays a VPN configuration confirmation. After you allow it, a VPN indicator appears in the status bar. This local connection passes app traffic to the client for processing and does not change the Rule mode or policy-group choices made earlier. If the system refuses to create the connection, check whether another VPN app is running, then restart the client and try again.

TUN mode routes programs that ignore the system proxy, command-line tools, some games, or other traffic that needs broader coverage. On desktop clients, enabling TUN may require administrator privileges, a service component, or a virtual network adapter. If you are only testing browser access, leave TUN off and enable the system proxy first; this makes the path easier to inspect. After the basic connection works, enable TUN as needed.

Some clients can use the system proxy and TUN together, but whether both should be enabled depends on the client implementation and network environment. Do not turn on every switch at once just to expand coverage. The recommended order is: start the core, enable the system proxy, and test the browser. If a specific app still bypasses the proxy, close it, enable TUN, and reopen the app. Change only one setting at a time so the connection log remains useful for troubleshooting.

If the client reports that a port is already in use, close other proxy applications and restart the core. If the conflict remains, check whether the HTTP, SOCKS, or Mixed port in the client settings duplicates another local service. Do not casually change multiple port fields in the subscription; for basic use, the client only needs one unused local port. See the general field reference for port relationships and the purpose of the external control port.

Verify That the Proxy Works

Once the connection switch looks normal, fully close and reopen the browser. Restarting it lets the browser read the latest system proxy settings and reduces ambiguity caused by reused connections. Open a page that normally loads to confirm that basic network access still works, then visit a destination that should use the proxy policy. The key is not the color of a switch, but whether the request actually reaches the client and follows the expected policy.

Return to the Clash client and open “Connections,” “Connection,” or the log page. Refresh the target page and look for a new domain connection entry. The entry typically shows the destination domain, matched rule, policy group, and final node. If it corresponds to the page you just visited and the policy chain points to the node selected earlier, browser traffic has entered Clash.

If the page opens but the connection log shows DIRECT, first inspect the matched rule. In Rule mode, some destinations are meant to connect directly; that is a configuration result. If the destination should use a proxy, temporarily switch to Global mode for comparison. If it works in Global but not Rule mode, the issue is usually rule matching or policy-group selection. If neither mode works, continue checking the node, network, and DNS. Return to Rule mode after the comparison.

If the browser cannot load any page and the client shows many failed entries, switch to a node that has already passed a connection test and retry the same page. If it works afterward, the original node is currently unavailable. If every node fails, check whether the subscription was updated successfully, and whether the device time, network permissions, and DNS are working normally. Do not switch through several modes, DNS settings, and nodes in succession, or it will be difficult to identify which change mattered.

If the browser appears in the connection log but an app that ignores the system proxy does not, the system proxy does not cover that app. Close the app, enable TUN mode, and restart it for another test. After enabling TUN, also check whether the system created a virtual network adapter, whether the client has the required permissions, and whether DNS requests enter the client. TUN routing, permissions, and DNS have many combinations; see the TUN troubleshooting section in the Help Center for details instead of rewriting the entire configuration during the basic setup.

Finish with one disconnect comparison. Record a page and connection entry that currently work, then turn off the system proxy, VPN connection, or TUN switch and refresh the same page. Requests that require a proxy should stop passing through Clash; after you turn it back on, the connection entry should return. This comparison helps rule out browser cache, existing long-lived connections, or another proxy application.