Clash Subscription Import
and Basic Setup

Before You Start: Get a Subscription

Installing a Clash client does not provide proxy nodes. Before you begin, get a valid Clash-compatible subscription URL or a working YAML configuration file. The subscription provider is responsible for the service and its availability. This site provides client downloads and setup guides, not subscriptions. If you only have a single proxy URL or a long string of encoded text, first check whether your client supports that format. Don’t import it as a complete configuration without confirming.

For your first setup, keep the default settings. Note whether you already use another proxy, VPN, or browser proxy extension. During testing, use one clearly defined traffic-routing method at a time so it’s easy to see where requests are going. If your device is managed by your employer or school, proxy settings, network extensions, or service installation may be restricted. Follow your organization’s device policies rather than repeatedly trying to bypass them with elevated permissions.

A subscription URL may contain an account access token, so treat it like a password. Hide the full URL in screenshots, and remove URL parameters and node credentials before sharing logs. Don’t submit the link to an unfamiliar online converter. If terms like “core,” “profile,” and “node” are new to you, start with the glossary, then return to step one below.

Step 1: Import a Subscription and Enable the Profile

Open your Clash client and go to Profiles, Subscriptions, or a similar page. Look for Add, Import, or a text field for the subscription URL. Copy the full URL from your provider and paste it in. Check that there are no extra spaces, line breaks, or punctuation added by your messaging app at either end. Keep all query parameters intact; copying only the domain or path is not enough.

Click Import or Download and wait for the client to fetch and parse the profile. On success, you’ll usually see a profile card with its name; some clients also show when it was last updated. A profile card appearing does not mean the profile is enabled. Click the card or choose Enable or Use from its menu, then confirm it shows as selected. Open the Proxies page and check that the policy groups are visible.

If you have a local file, use Import from File or the client’s supported drag-and-drop option, and select the actual YAML file. Simply changing another file’s extension to .yaml does not change its contents. A complete configuration usually includes proxy nodes, policy groups, and rules. A short example containing only a few rules is not a substitute for the configuration from your subscription provider.

Troubleshoot Import Errors by Where They Occur

If the import keeps spinning or shows timeout or context deadline exceeded, the client likely couldn’t finish fetching the subscription in time. First check that your device has an internet connection, then confirm the subscription URL is reachable. On a first import, there’s no working proxy in the new profile to download the profile itself. Use your current network or ask your provider how to fetch the subscription.

For 401 or 403 responses, first check whether the URL has expired, any parameters are missing, or your account still has access. The response may also come from server-side access restrictions, so check your provider’s guidance. A yaml: unmarshal errors message or an error pointing to a specific line means the response doesn’t match the expected format. An error page, login page, or subscription for a different client may be mistaken for YAML.

Don’t create multiple copies of the same subscription after an error. Keep one entry, check its URL, and try updating it first. If you need to replace it, give the old and new profiles different names, then delete the old one after the new profile works. Subscription updates usually fetch fresh content from the server, so edits to the original subscription may be overwritten. Avoid changing rules during your first setup. For persistent local changes, see Local Overrides and Profile Management.

You’re ready for the next step when the profile list shows one clearly selected profile, its policy groups appear on the Proxies page, and the client is no longer reporting repeated load failures. Choose a proxy mode after that; there’s no need to enable every network option at once.

Step 2: Choose Rule Mode and a Proxy Policy

Open the “Proxies” page or the home screen’s “Mode” setting, then select “Rule” or Rule. Requests are matched against the active configuration’s rules and handled by the assigned policies. Rule mode suits everyday use, but whether a site uses the proxy or connects directly depends on your subscription—not just its region labels.

Next, check the policy groups. Common names include Proxy, Node Selection, and Auto Select, though your provider may use different names. Open the group that controls proxy traffic and select a known working node or an automatic selection group already in the configuration. If groups are nested, keep opening them until you confirm the final selection. Don’t stop at an outer group name without checking whether its inner group points to DIRECT or an unavailable old node.

The client’s connection or latency tests can help you choose a node, but a successful test only means its specific test target was reachable at that moment. It doesn’t guarantee that every site or app will work. For your first setup, pick one node and use it for the verification steps below. Don’t switch repeatedly while a page is still loading. After changing nodes, some apps may keep using an existing connection; reload the test page or close and reopen the app if needed.

Global mode does not mean every app on your device is being routed through Clash. It changes how requests are handled after they reach the core. Whether an app sends requests to Clash depends on the system proxy, TUN, or the app’s own proxy settings. Likewise, selecting Rule does not turn on the system proxy. These are separate steps; enable the connection method you need next.

If the Proxies page is empty, go back to step one and confirm that a profile is enabled. If you can see nodes but not a group shown in a guide, don’t create a group with the same name; use the groups that actually exist in your profile. Policy group types, rule order, and MATCH are advanced topics you can explore after your basic connection works in the Advanced Configuration Guide. For this step, just confirm that Rule mode is selected and the relevant proxy policy points to a working route.

Step 3: Connect and Choose How Traffic Is Routed

On desktop, find System Proxy on the home screen or in Settings and turn it on. This setting usually points the operating system’s proxy configuration to the client’s local listening address, allowing browsers and other apps that follow the system proxy to send requests to the core. Leave the client running. Closing its main window may only minimize it to the tray, while choosing Exit stops the local proxy service.

Don’t change the local port yet. Online examples often use mixed-port: 7890, but the actual port varies by client, so use the value shown in your settings. If the logs show address already in use or a port binding error, check whether another Clash client or program is already using that port. Close duplicate instances and try again; don’t guess a new port by entering one in your browser.

On Android and iOS, traffic routing is usually enabled with Connect or a start button. The first time you connect, the system may ask to add a VPN configuration or allow a VPN connection. Approve it only after confirming that the prompt comes from the client you just installed and opened. This VPN uses the operating system’s traffic-routing interface. A VPN icon in the status bar alone doesn’t prove the subscription nodes work; complete the real-world connection test in step four.

Try TUN Only After the System Proxy Works

If your browser works but an app ignores the system proxy, consider TUN mode. TUN routes traffic through a virtual network interface and may require administrator privileges, service mode, a network extension, or system VPN permission, depending on your platform and client. Follow the client’s instructions to install or authorize it. If the service fails to start, fix that error first rather than changing DNS settings at the same time.

For your first test, use one clearly defined traffic-routing method. To try TUN, you can turn off the system proxy before enabling TUN and testing. If your client explicitly requires both, follow its instructions. Other VPNs, virtual network adapters, and security software can affect routing, so avoid running multiple traffic-routing tools at once during testing. If you’re connected to a work network, note its current settings and make sure testing won’t disrupt anything you need.

At the end of this step, System Proxy should be on or TUN should be running as expected on desktop. On mobile, the client should show a connection status and have the required system permission. If the switch turns itself off as soon as you enable it, open Logs, find the error from startup, and check it against the Help Center. Repeatedly pressing Start usually won’t fix a permission or port conflict.

Step 4: Verify Access and Rule Matches

Open a browser and visit a site that normally connects directly to confirm your basic internet connection still works. Then visit a site that your rules are expected to proxy, such as one explicitly assigned to a proxy policy. Don’t rely on the client’s connection icon alone. Check whether the page loads fully, whether the request reaches the core, and which outbound route it uses to confirm your setup is working.

Next, open the Connections page in your Clash client, reload the test page, and look for its domain or app request. Some connections are short-lived and may disappear soon after the page loads; if so, check Logs and reload the page again. Look at the matched rule, policy group, and final node or DIRECT route. In Rule mode, it’s normal to see both direct and proxied requests. You don’t need to switch to Global just to make every entry use the same node.

If the page loads but you don’t see a related entry, first make sure reloading created a new request. Browser cache, another proxy extension, an app’s built-in proxy, or a different VPN can make the results differ from what you expect. Temporarily disable browser proxy extensions and reopen the test page. You can also use a private browsing window to reduce cache interference, but private browsing does not bypass the system proxy or change your network route.

Narrow Down Problems Based on What You See

If no new requests appear at all, first confirm that System Proxy or the mobile connection switch is actually on, then check whether the test app uses that routing method. If the logs show connection refused, use the destination address to work out whether the local listener failed to start or the remote server rejected the connection. Those two words alone don’t mean your subscription has expired.

If you can see the request and have selected a proxy node, but the page still times out, try another working node in the same policy group and test again. If the page works in Global mode but not Rule mode, check the rule and policy matched by that domain rather than repeatedly reinstalling the client. Switch back to Rule after comparing, and note the affected domain and its matched rule for further troubleshooting.

If the logs keep showing domain resolution failures or DNS query timeouts, first check your device’s network and active profile, then see the DNS Settings section. Don’t replace all your DNS servers, enable TUN, change rules, and switch nodes at the same time. Even if access returns, you won’t know what fixed it. Change one related setting at a time, test, and undo changes that don’t help.

Don’t dismiss browser certificate warnings. First check your system date and time, then see whether a traffic inspection tool’s certificate or other network filtering software is involved. A working proxy connection is not a reason to ignore certificate errors. For other common issues, such as connection failures after waking from sleep, failed subscription updates, or apps still connecting directly, see the Help Center troubleshooting guide.

When You’re Done and Next Time You Connect

Once access and rule matches look right, your basic setup is complete. Keep this working profile as it is for now instead of adding override scripts or combining multiple subscriptions. The next time you start the client, check that the profile is still selected and the policy group choice hasn’t changed, then enable the system proxy or connect on mobile. Start at login only controls whether the client launches; auto-connect and automatic system proxy setup may be separate options, so check each one.

When you’re finished, turn off the system proxy on desktop or disconnect on mobile. If you use TUN, turn it off before exiting the client. If the client crashes and your browser can no longer connect, check whether the operating system still has a manual proxy pointing to a local port, and disable any leftover setting. For rule sets, Fake-IP, or external control, see the Advanced Configuration Guide. Avoid experimenting with several settings at once in a basic setup you’ve already verified.