Clash Quick Start

Before You Start: Client and Subscription

Choose a client for your operating system on the client downloads page, install it, and open the main screen. The client manages configurations, proxy selection, and connections; the subscription provides the proxy details and routing rules. Installing a client alone does not give you a working proxy. If you don't have a subscription yet, ask your provider whether it's valid and supported by your client.

Have a complete subscription URL or a YAML configuration file that your client can read. Subscription URLs often contain private account credentials. Don't post them on public forums or share them with untrusted online tools. Before setup, quit other proxy clients and keep your regular internet connection available. Change one type of setting at a time so you can tell whether a problem is with the configuration, policy, or traffic routing.

Step 1: Import a Subscription

Add a remote subscription and wait for it to load

Open the client's “Configuration” or “Subscription” page and look for “New,” “Add,” or “Import.” If prompted to choose a type, select a remote URL or subscription link, then paste the full URL from your provider into the address field. Use a short, recognizable name to identify the configuration; it won't affect how the proxy works. Before saving, check for spaces, line breaks, or punctuation added by your chat app. Keep all query parameters in the URL.

After you save or download the subscription, stay on the configuration page while the client fetches and parses it. On success, you'll usually see a new configuration card or list entry, along with an update time, enabled status, or configuration actions. Some clients save the URL first and require you to trigger an update manually. If nothing appears, check the entry's menu instead of adding the same subscription again. A format error may mean the URL returned a web page, login prompt, or unsupported content. Confirm with your provider that the subscription is compatible with your client.

Set the Active Configuration and Check Proxies

A successful import doesn't necessarily mean the configuration is enabled. Select the new entry and choose “Enable,” “Use,” or the equivalent to make it active. The client may briefly reload its core; wait for it to become ready, then open the Proxies page. You should see the configured proxy groups and, when expanded, the available proxies or nested policies. A name in the configuration list only confirms it was saved. Seeing the expected content on the Proxies page confirms it's loaded into the current session.

For a local file, choose the file import option on the same page, select the relevant .yaml or .yml file, and enable it. Local files generally don't update automatically; remote subscriptions are refreshed by fetching the URL again. For your first setup, use one method at a time to avoid confusing an old file with a new subscription. If you already have configurations, keep them until you've confirmed the new one works. There's no need to clear the whole list just to import a configuration.

At this stage, you should have a clearly identified active configuration on the configuration page and its proxy groups on the Proxies page. If the subscription download fails, first check whether your current network can reach the URL and whether the subscription has expired. Don't immediately change DNS settings or enable additional routing options. For format errors, failed updates, and handling sensitive URLs, see Troubleshooting. Once the configuration is loaded, choose a mode.

Step 2: Choose a Proxy Mode

Start with Rule Mode

Find the client's mode selector. It may be on the home screen, at the top of the Proxies page, or in settings. For your first setup, choose “Rule” or Rule mode. This mode applies the rules in the active configuration to connections reaching the core, directing them to direct access, a proxy group, or another action such as reject. After switching, confirm the interface shows the new mode. Some clients remember the last-used mode, so a mode: rule entry in the configuration alone doesn't confirm the runtime setting.

“Global” mode typically sends connections reaching the core through a global policy, while “Direct” mode connects them directly. Global mode does not route every app on the device, nor does it guarantee access to every site; it only changes how connections that reach the core are handled. Direct mode does not turn off the client either. Start with rule mode, and only switch temporarily to compare behavior if you find a specific issue during testing.

Choose an Outbound in the Proxy Group

Open the Proxies page and expand the main selectable proxy group. Group names come from your subscription and may include Proxy, “Proxy Selection,” or something else; don't rely on the name alone to determine its purpose. Review the options and select a proxy your provider has confirmed is available. Make sure the selection indicator moves to your chosen option. If the group contains other groups, check the next level too. When a top-level group selects another selectable group, the actual outbound depends on that nested group's current selection.

Some configurations use an automatic selection group that picks a proxy based on its test settings. These groups may not let you pin a specific proxy the way a manual selection group does, and the interface may show both types. For your first setup, keep the subscription's existing structure. Don't rename groups just to make their names consistent; rules may reference them. If there's a connection test button, you can run a test, but treat the result as a reference—not proof that your everyday sites and apps work.

Before moving on, confirm two things: rule mode is active, and the main selectable proxy group has a specific selection. Choosing a proxy does not enable the system proxy or connect your phone. The right mode also doesn't mean browser traffic has reached the client. So far, you've only set how the core handles connections; next you'll route device traffic into it. To learn how rules reference group names or what the MATCH fallback does, see Advanced Config. You don't need to edit these fields now.

Step 3: Connect

On Desktop, Enable the System Proxy First

Return to the client's home or settings page. Make sure the core is running, then find and enable the “System Proxy” toggle. Some clients set it automatically when the core starts; others require a separate action. Check the toggle and status message to confirm. The system proxy directs apps that follow system proxy settings to the client's local listening port. For your first test, use a browser that follows those settings. There's no need to enable TUN, change terminal environment variables, or adjust routes at the same time.

If your browser immediately reports a proxy connection error, check whether the core stopped, the configuration failed to load, or the client reported a port conflict. Don't enter a port at random in system settings; the client's listening port must match the port used by the system proxy. If you've used another proxy tool, quit it and make sure it hasn't changed the system proxy settings before enabling this client again. When multiple tools route traffic, the interface may show the proxy as enabled even if the system settings say otherwise.

On Mobile, Approve the Connection

On mobile, after checking the configuration and proxy groups, start the connection with the home screen's connect button or main toggle. The first time, your device may ask to add a VPN configuration, allow a network extension, or approve the connection. Follow the system prompts, then return to the client and check its connection status. A VPN icon in the status bar or an active connection in settings confirms that the routing tunnel is up, but not that the proxy itself works. Verify access and check the connection log in the next step.

If another VPN or network-filtering app is running, check whether it conflicts with this connection. When testing a different app, don't just leave the old one in the background; confirm in its interface or in system settings that it's disconnected. Mobile operating systems handle background activity and battery settings differently. For the first test, keep the client running normally. If it works in the foreground but disconnects in the background, then check background permissions—you don't need to change every battery setting up front.

At this point, the desktop core should be running with the system proxy enabled. On mobile, permissions should be approved and the connection established. If the client reports an error, address it before repeatedly switching proxies. For TUN permissions, port conflicts, and connection problems, see Troubleshooting. Once the client is running normally, test it in a browser.

Step 4: Verify It Works

Visit a Site and Check the Connection Log

Open a new browser tab and visit a regular site that normally works to confirm your internet connection is still available. Then visit a site that should use the proxy under your current subscription rules. Make fresh requests rather than relying on pages that were already loaded. A site loading is a useful first check, but one successful visit doesn't prove that routing is correct: the site may be reachable directly or using an existing connection.

Return to the client's “Connections” or “Logs” page and find the entry for your test. If filters are available, search by the destination domain and check that the timestamp matches. Look at the destination, matched rule, proxy group, or final outbound; labels vary by client. A site expected to use the proxy should show the selected proxy policy, while a site expected to connect directly should show a direct route. Some clients don't list every connection in their general logs. Use the Connections page if available; no log entry doesn't necessarily mean no traffic.

Troubleshoot the Stage Where the Problem Occurs

If you can't find a connection for the site you visited, first check whether your browser follows system proxy settings, the client is still running, and a browser extension isn't using its own proxy. The issue is likely before traffic reaches the core; changing proxy groups repeatedly won't help. If you do see a connection using the selected proxy but the request times out, check that the proxy is available and the service is running. Try another known-working proxy in the group for comparison, changing one option at a time.

If the log shows a direct route for a site that should use the proxy, check that rule mode is still active, the right configuration is enabled, and which rule matched the destination. Rules are usually evaluated in order; a proxy fallback at the end of the file doesn't mean earlier rules won't affect the result. You don't need to rewrite the entire ruleset to get started. Note the matched rule and destination domain, then see Advanced Config for the relevant fields or follow the Troubleshooting guide.

Next, test one or two everyday apps. If the browser works but an app doesn't, that doesn't mean the client is broken. The app may ignore system proxy settings, use its own network configuration, or need a different routing method. Quit and reopen the app, then check the Connections page for its new requests. If you need TUN, follow your client's permission prompts and verify the traffic path again. Don't skip the access test just because the interface shows an enabled status.

Keep Your Working Settings and Know How to Disconnect

Your first setup is complete when both a regular site and a site expected to use the proxy load, and the connection log matches your routing expectations. Note the active configuration, proxy mode, and main proxy group selection so you have a baseline for future changes. Subscription updates can alter group names, available proxies, or rules. Run a brief access test after an update; it's easier to maintain than changing many advanced options at once.

Finally, know how to disconnect. On desktop, turn off the system proxy set by the client before quitting, or use the client's exit option if it restores the proxy settings correctly. On mobile, disconnect using the connection toggle and check the system status. Configure startup behavior, terminal proxies, and advanced DNS settings later, one at a time, after your first test succeeds. Keep the process simple: verify the configuration, check the policy, route the traffic, then confirm results using both site access and connection logs.