How to Import a Clash Subscription and Connect

1. Import a Subscription and Enable the Configuration

After opening the client, go to the “Configuration” or “Subscriptions” page. It may be empty on first launch; that's normal if you haven't added a configuration yet. Click “Add,” “Add subscription,” or a button with a plus sign, then choose the remote link option. Copy the full subscription URL from your service provider and paste it into the link field. Give the configuration a recognizable name, such as “Everyday setup,” then click “Save,” “Import,” or “Download.”

Check the beginning and end of the link after pasting to make sure it doesn't include spaces, line breaks, or explanatory text. Subscription URLs often contain credentials, so treat them like account information: don't post them in public comments or include the full link in a screenshot when asking for help. If your provider offers formats for different clients, choose a Clash or Mihomo configuration format explicitly supported by your client's core. Don't import an arbitrary node-sharing link as a complete subscription.

After saving, wait for the client to download and parse the configuration. If successful, you'll usually see a configuration card with the name you entered; some clients also show the last update time or an update button. A configuration card doesn't necessarily mean the configuration is enabled. Click the card or choose “Use” or “Enable” from its menu until a selected indicator appears. Then open the Proxies page and confirm that the configuration's proxy groups and available routes are listed before continuing.

Import a Local Configuration File

If you received a file, choose “Import from file” on the configuration page and select the YAML file from your service provider. Select and enable it after importing. Don't rely on the file extension alone to tell whether the contents are valid: a saved login page won't be recognized by the core, even if you rename it as a configuration file. If parsing fails, download the original file again. Don't delete lines near the error unless you understand the format.

Local files and remote subscriptions are maintained differently. You can usually refresh a remote subscription to download its latest contents, while a local file typically needs to be imported again or replaced manually. For your first setup, choose one known-good source. Adding the same configuration multiple times can lead you to select an older copy and think the new subscription isn't working.

If Import Fails, Check the Source First

If the client reports a download failure, return to your provider's site and check that the subscription is valid, whether you need to sign in, and whether you copied the correct client-specific URL. If it reports an unsupported format, distinguish between content that downloaded and content the client can parse. Switching to Global mode won't fix a format error, and there's no need to change system DNS right away. Get the configuration loaded first, then troubleshoot the connection.

This step is complete when the configuration page clearly shows the active configuration, the Proxies page lists its proxy groups, and there are no recurring parsing errors. Next, decide how requests should be routed and which route the proxy group should use.

2. Choose Rule Mode and a Proxy Policy

Open the Proxies page or find the mode selector on the home screen. Common options are “Rule,” “Global,” and “Direct.” Choose Rule mode for your first setup. It uses the configuration to decide whether requests go direct, through a proxy, or are rejected. It's suitable for everyday use and makes it easier to use connection records to see why a site took a particular route.

After choosing a mode, check the proxy group as well. The mode determines how routing decisions are made; the proxy group determines which route to use when a rule selects a proxy. Open the main proxy group in your configuration and check its current selection. Group names are set by the configuration author and might be “Proxy,” “Node Select,” or something else, so don't assume a group handles all requests based on its name alone. Check your service provider's configuration guide first.

If the main proxy group is set to DIRECT, first check whether that's intentional. DIRECT means a direct connection, not a proxy node. For destinations that need a proxy, choose an available route or an automatic selection group provided by the configuration. Manual selection is easier for initial troubleshooting because the route is clear. Automatic selection is useful once you've verified the configuration works; its behavior depends on the configuration.

Global Mode Doesn't Route Every App

Global mode only changes how traffic that has already reached the proxy core is routed. It won't automatically send apps that bypass the system proxy to the core. If your browser works through the proxy but a desktop app has no request records, switching between Rule and Global repeatedly is unlikely to help. Set up traffic routing in the next step, then decide whether you need TUN.

If the client has a speed test button, run it once for the selected proxy group. A successful test means the test destination was reachable through that route at that time; it doesn't guarantee that every site or app will work. A timeout may also be caused by the test URL. There's no need to chase the lowest number during initial setup. Start with a route that can load the pages you need.

Before finishing this step, note two current settings: the mode is “Rule,” and the route or automatic group selected in the main proxy group. These details will help you reproduce an issue later. For more on rule order, nested proxy groups, and automatic selection, see the system guide. You don't need to change any of them before your first connection.

3. Connect and Route System Traffic

Once you've chosen a configuration and policy, return to the home screen and start the connection. Some desktop clients start the core when the app launches; others require you to click “Start” or a power button. Make sure there are no core startup errors, then enable the system proxy. Keep in mind that “the core is running” and “app requests are reaching the core” are different: the first means the local service is ready; the second determines whether your browser can use the policy you selected.

On Desktop, Start with the System Proxy

In common Windows and macOS desktop clients, open “Settings” or “Network settings,” find “System proxy,” and turn it on. Some clients also have the same option in the tray or menu bar context menu. This is all you need for a first test; browsers usually follow the system proxy setting. Linux desktop proxy settings vary by environment. If the client can't set them automatically, check its documentation rather than copying menu steps from another system.

If your browser has a proxy-switching extension installed, set it to use the system proxy or temporarily disable its separate proxy rules. If the browser has its own proxy address configured, restore it to match the system settings first. Otherwise, the client may show the system proxy as enabled while the browser connects to a different port, leaving you unable to open pages even though the subscription and route are correct.

You don't need to change the mixed port manually for your first connection. Only check the actual local address and port the client is listening on if the logs report a port conflict or another app requires you to enter a proxy address. Don't copy a port number from another guide and paste it into your browser; settings can vary between clients and installations.

On Mobile, Approve the Connection Prompt

In the Android or iOS client, tap “Connect” or the power button on the home screen. The first time you connect, the system will usually ask to establish a VPN connection or add a VPN configuration. Make sure the request comes from the client you just installed, then approve it. Return to the app and wait for the connection status to settle. A VPN indicator means the system tunnel is up, but you'll still need to test actual access to confirm the route works.

If the connection drops as soon as you tap Connect, check the in-app error and see whether another VPN is already using the connection. For your first test, use just one client to route network traffic so proxy tools don't interfere with each other. Don't keep tapping Connect while the status is still changing; that mixes start and stop events and makes troubleshooting harder.

When to Consider TUN Mode

Consider TUN only if your browser works but an app that ignores the system proxy still needs a proxy. TUN routes traffic through a virtual network interface and may require a service mode, administrator privileges, or system permission; follow your client's prompts for its specific requirements. TUN coverage still depends on routes, exclusions, and system limitations, so enabling it won't automatically fix every issue.

For your first test, don't add TUN to the mix; keep the number of variables down. If you need to enable it, note your current settings, grant permissions as directed by the client, and test again. If the whole device loses internet access, turn TUN off and restore the system proxy setup that worked before. Then read the system guide's section on routing system traffic. Don't change DNS and routes at the same time.

4. Verify Requests and Proxy Egress

Once the connection is stable, reopen your browser and visit a regular webpage that normally works without a proxy to confirm basic internet access. Then open a site you actually need to access through a proxy and check that it loads fully. Don't just refresh an old cached tab or check whether the page title appears. Loading the page content, images, and follow-up requests gives you a better picture of whether access is working.

Keep the target page open and switch to the client's “Connections” or “Logs” page. Refresh the webpage again and look for the new requests, matched rules, and final policies. Some clients remove connection records as soon as a request ends, so open the records page before refreshing or check recent logs instead. If you can't see any records, make sure the log filters aren't hiding the requests.

Check the Page and Routing Records Together

In Rule mode, some sites showing DIRECT is expected and doesn't mean the proxy has failed. Check whether the destination that should use a proxy matched the expected policy group, whether that group ultimately selected a proxy route, and whether the page loaded. If the main proxy group points to another group, check the full selection chain shown in the client rather than just the outer group name.

To check egress, you can compare your IP before and after connecting using a trusted IP lookup site. Keep in mind that the lookup request is also routed according to your rules. If it goes direct, the site will still show your local network's IP; that doesn't mean other sites aren't using the proxy. Compare the egress IP, request records, and actual page results rather than relying on just one.

If a Page Won't Load, Check These in Order

If the client has no record of the request, go back to step three and check that the system proxy is enabled, the browser uses the system settings, and no other proxy extension or VPN is interfering. Focus on getting the request into the client before changing subscriptions. If the request reached the core but failed to connect, check whether the wrong proxy group is selected, whether the route works, and whether the logs show a specific error.

If Rule mode fails, briefly switch to Global for comparison and make sure a working route is selected in the global policy too. If Global works but Rule doesn't, focus on rule matching or proxy group selection. If both modes fail, check the subscription, route, and local network. Switch back to Rule after testing so you don't leave the client in a temporary test mode.

If only one site or app fails, don't reset the entire configuration right away. Test other destinations first, then note when the issue occurred, the destination domain, the mode in use, and any relevant error summary. Hide subscription URLs, account details, and private browsing records when asking for help. For more detailed DNS, certificate, rule, and port troubleshooting, see the Clash system guide. Avoid changing too many settings at once during initial setup.

Keep a simple routine: update the configuration first if a subscription stops working; check the current policy first if access fails; and before closing the desktop client, make sure the system proxy is off or will be restored correctly by the client. If your internet stops working after you close the app, check your system network settings for a leftover proxy address pointing to your own machine. Next time, following the same four steps is usually more helpful than repeatedly reinstalling the client.