Getting started with the Clash client: from subscription import to connection check

PathCopy the link in your provider dashboard→Client “Subscriptions” page→Paste and import

A subscription link is the credential between your client and your provider — the node list and rule configuration are both pulled through it. Log in to your provider's dashboard or order page, find the Clash subscription entry, and copy the address that starts with https://; some providers also offer a one-click import link that starts with clash://, which opens the installed client and shows an import prompt when tapped on your device, with no manual pasting needed. If you don't have a client yet, install one for your platform from the downloads page first, then come back to this page.

On desktop

Using Clash Verge Rev as an example: open the client, go to the Subscriptions page in the left sidebar, paste the link into the field at the top, and click Import. The client then fetches the subscription online; a few seconds later a new subscription card appears in the list below, showing the name, update time and traffic usage (traffic data depends on the subscription format, and some providers don't include it). In the desktop version of FlClash the entry point is the Configurations page and the steps are identical. Don't close the client during the import — an interrupted fetch leaves the card in place but the node list empty.

Mobile and iOS differences

On Android, using Clash Meta for Android as an example: open the Configurations page, tap the plus button in the bottom-right corner, choose Import from URL, paste the link and save. In FlClash the path is Configurations → Add → URL. On iOS (using Clash Plus as an example), the home or configuration page usually offers Import from clipboard — copy the link in your browser or notes app first, then return to the client to finish the import. What every client has in common: after pasting the full link you must confirm the save action; copying alone changes nothing.

Once the import finishes, open the Proxies page — you should see several proxy groups and nodes. If the node list is empty, go back to the subscription card and hit the refresh button once to retry; if it's still empty, first check that the link opens in a browser (it should return a block of YAML text), then check that you copied it in full — the parameters at the end of a subscription URL are often cut off while copying.

Keep subscriptions up to date

Subscription content changes as your provider makes adjustments, so turn on auto-update in the client settings (a common interval is 24 hours); you can also click the update button on the subscription card at any time. An update doesn't interrupt the current connection, and new nodes appear on the proxies page as soon as it finishes.

Path“Proxy mode” card on the home page→Select “Rule”→Expand a proxy group on the Proxies page→Click a node

The client offers three modes — Rule, Global and Direct — and for everyday use you only need to remember one thing: keep it on Rule. Rule mode matches traffic against the rule set from your subscription, line by line: requests that hit a direct rule bypass the nodes, and everything else goes to a proxy group. Global mode pushes every request through a proxy group and is usually only used temporarily while debugging rules. Direct mode bypasses the proxy entirely, which makes it handy for telling whether a problem lies with the website itself or with the proxy chain.

Where to switch

Clash Verge Rev has a Proxy mode card on the home page — open it and select Rule; the same setting is also available on the settings page. On mobile the mode switch usually sits at the top of the home screen or in the settings list, again labelled Rule / Global / Direct. The change takes effect immediately: no client restart and no node reconnection.

Pick a node

Open the Proxies page: nodes are arranged by group, and there are three common group types. Select groups let you click a specific node; url-test groups pick one automatically by latency; fallback groups switch over when the current node becomes unavailable. Expand a select group and click a node to select it — the selected entry is highlighted. If you're not sure which to pick, hit the latency test button in the group first and then choose one with low latency. url-test groups need no manual action — leave them to the client.

Wait for the rule files to download

Rule mode depends on rule files (rule-provider, geodata and the like). The client fetches them automatically on first launch or after a subscription update, and the progress is visible on the Logs page. If it sits on updating rules for a long time, first make sure your current network can reach the rule file addresses, then retry once. The origins of rule files, how they update, and the trade-offs of built-in rules are covered in full in the protocol handbook; for this step you only need to confirm the download finished.

When you need TUN mode

TUN mode lets the client take over all traffic on the device, including apps and command-line tools that ignore system proxy settings. Turning it on requires administrator rights, and the first launch installs a virtual network adapter. You don't need it if you only browse the web; enable it when every app has to go through the proxy. A comparison table of the two takeover methods and when each fits is in the protocol handbook.

PathDesktop: “System proxy” switch on the home page→Turn on→Mobile: start button on the main screen→Allow VPN permission

On desktop, using Clash Verge Rev as an example: go back to the home page and turn on the System proxy switch. Once it's on, the client points the operating system's proxy settings at a local port, and apps that read the system proxy — browsers, for instance — start going through the proxy right away; the switch state and tray icon change together, and the same applies when you turn it off. The equivalent switch in the desktop version of FlClash is on the home page, labelled either System proxy or Virtual network adapter.

Ports and conflicts

The client uses 7890 as its mixed port by default (shared by HTTP and SOCKS; some clients default to 7897) — check the settings page for the actual number. If another program on your machine already occupies that port, the client reports a conflict; change the port to 7891 or another free value and restart the core. Software that needs the proxy entered by hand (some developer tools and terminal commands) uses 127.0.0.1 plus this port number.

On mobile: one VPN authorization

Clients on both Android and iOS work through the system VPN interface. Tap the start button on the main screen and the system shows a VPN permission request; once you allow it, a VPN icon appears in the status bar and traffic starts passing through the client. On iOS you can also turn on On-Demand Connection in the settings so the client starts automatically on certain networks; on Android some clients offer launch on boot. Mobile systems apply battery-saving policies, so a client left in the background for a long time may be reclaimed — just open it again to restore the connection.

Launch at startup

On desktop you can turn on Launch at startup and Start core automatically on the settings page, which suits long-term use; with both enabled, the client is ready as soon as you reach the desktop, with no manual steps each time.

PathCheck live records on the Connections page→Visit a test site→Check the exit IP→Compare rule matches

The quickest check is to open a website that requires a proxy: if it loads, the proxy chain works. But that only proves traffic can go through the proxy, not that routing is correct, so run the three methods below in order before calling the setup done.

Method 1: read the connection log

Open the client's Connections page — the list shows every request in real time: destination domain, matched rule, proxy group used, node name and traffic size. Refresh a web page and a new entry appears immediately; records that hit a direct rule show DIRECT, while proxied ones show the name of the proxy group. Sites in mainland China showing DIRECT and sites outside China showing a proxy group name means rule-based routing is working as expected.

Method 2: check the exit IP

Visit any IP lookup site in your browser and the page shows your current exit IP and its location. If the location matches the selected node, the request really did go through the node; if it shows your local ISP, it went direct. Go back to the Connections page, find that entry, see which rule it matched, and decide whether the rule intended this or the mode setting is wrong.

Method 3: cross-check

Visit a site in mainland China and a site outside China at the same time, then compare the two entries on the Connections page: the mainland site should hit DIRECT and the overseas one a proxy group. If both match, the setup is complete. Later, when a site won't open, check in the same order: first whether the Connections page has an entry for it, then which rule it matched, and only then suspect the node.

When something looks off

If the connection is up but pages won't load, it's usually DNS resolution — see the DNS entry in the FAQ for the troubleshooting order. If some apps bypass the proxy, that's the coverage limit of the system proxy; TUN mode solves it. If latency is high or speeds disappoint, switch nodes first and consider switching protocols second — the protocol handbook compares speed and resource use across protocols. For unfamiliar terms, look them up by category in the glossary.

With the four steps done, the client is ready to use. In everyday use only three things are worth watching: keep subscription auto-update on so the node list keeps up with your provider's changes; turn on launch at startup on desktop so you don't have to start it by hand; and when something goes wrong, read the connection log first before deciding whether to change any settings. Reinstalling the client or swapping subscriptions over and over rarely fixes anything — it just leaves you without a baseline for troubleshooting.

When you need to go deeper, pick by purpose: for choosing a protocol type or telling the cores apart, see the protocol handbook; for terms you don't recognise, check the glossary; for the troubleshooting order on specific failures, the FAQ collects them.