Before You Start: Client and Subscription

Choose a client for your operating system and processor architecture from the download center, install it, and open it once. On Windows, match the installer to your device's architecture. On macOS, choose the Apple Silicon or Intel version. If a security warning appears on first launch, check the download source and read the warning before following the relevant installation instructions. Don't disable system security features just to proceed.

A client provides configuration management and proxy controls; it doesn't include a working remote proxy service. Before you start, get a subscription link from your service provider or a configuration file compatible with your core. An account page or payment page that opens in a browser isn't the same as a subscription URL. Look for “Copy subscription” or a similar option on your provider's site, and copy the full link.

If you have another proxy or VPN client on your computer, turn off its system proxy and connection features first. Use only one client for this test. Otherwise, your browser may still use a different proxy, making it hard to tell whether the current configuration works. For your first setup, keep TUN disabled and start with the easier-to-check system proxy.

Step 1: Import a Subscription and Enable the Configuration

Open the Configuration or Subscription page in the sidebar and find the subscription URL field. Some clients require you to click “New” or the plus button first, then choose “Remote configuration.” Paste the link you copied into the field. Check that the beginning and end are intact, with no quotation marks, spaces, or line breaks copied from a message. If asked for a name, choose something easy to recognize. It labels the configuration in the list and doesn't change its contents.

Click “Import,” “Download,” or “Save,” then wait for the client to finish the network request. On success, a configuration card or entry usually appears with details such as its name and update time. Don't assume the import worked just because the URL field is now empty. If nothing appears in the list, or you see a network or parsing error, fix that first rather than repeatedly toggling the system proxy.

After importing, click “Enable” or “Use” on the configuration, or use its card menu to set it as active. In some clients, selecting the card is enough; others show the active state with a border, check mark, or “Current” label. Make sure the configuration is loaded by the core, not just saved in the list. Then open the Proxies page. You should see the policy groups defined in that configuration.

Importing a Local File

If you have a YAML configuration file, choose “Local file” or “Import file” on the Configuration page, select the relevant .yaml or .yml file, and enable it. Don't rename a saved HTML webpage to make it look like a configuration, or paste a subscription URL into an empty file and import it. The file needs a complete set of fields, including servers, protocols, and rules, that the client can parse.

Remote subscriptions and local files are updated differently. You can usually fetch a remote configuration again from the card's “Update” menu. Whether a local file reloads after an external change depends on the client. For your first setup, keep the imported contents unchanged until the connection works. That gives you a known-good state to return to if something goes wrong.

If Import Fails, Check the Error

For a timeout or connection failure, check that your network can reach the subscription provider and that the link is still valid. For YAML, field, or protocol errors, note the reported location and check that the format is supported by the client. A page that displays content in a browser isn't necessarily a valid configuration; it could be a login or error page. See FAQ troubleshooting for more help. Subscription links may contain credentials, so don't share the full URL when asking for help.

At this point, you should have an enabled configuration and see its policy groups on the Proxies page. Next, adjust only the mode and main policy. Leave rules, DNS, and ports unchanged for now.

Step 2: Choose Rule Mode and a Proxy Policy

Open the Proxies page or find the “Mode” control on the home screen. Common options are “Rule,” “Global,” and “Direct.” Choose “Rule” for your first setup. Rule mode routes requests according to the rules in your configuration, so it's normal for some connections to use a proxy and others to connect directly. That doesn't mean the proxy toggle failed.

The mode and policy group are two separate settings. The mode determines how rules are applied; the policy group determines which outbound route a matching rule uses. Names such as “Auto Select” and “Proxy Selection” come from your configuration and may differ from this guide. First, find the main selection group described by your provider and choose an available proxy. If your configuration includes an auto-select group, you can choose that instead and let the core select according to its settings.

After making a selection, check that the highlight or current item has changed. Make sure the main policy isn't set to DIRECT or REJECT by mistake. DIRECT connects without a proxy; REJECT typically blocks the request. Both are valid policies, but neither is the expected route for this proxy connectivity test. Don't set every group to the same proxy: some groups are meant for direct connections, blocking, or specific types of traffic.

When to Use Each of the Three Modes

Global mode usually sends requests entering the core through the global policy, but you still need to select an outbound route in the corresponding global group. Use it temporarily to compare the effect of rules when there's a clear reason to do so. It doesn't automatically capture traffic from every app or fix an invalid subscription. Direct mode sends requests entering the core directly; it doesn't close the client or restore the operating system's proxy settings.

You don't need custom rules or to change every service group for your first setup. Keep the subscription's original structure and verify the connection first. If a domain takes an unexpected route, check its matched rule and troubleshoot from there. For details on policy group types and rule order, see the rules section of Advanced Configuration. Avoid changing too many things at once before your first connection.

Once the mode is set to Rule and a main policy is selected, the proxy route is ready. Regular apps may not be sending traffic to the client yet, so you'll need to enable the traffic entry point in the next step.

Step 3: Enable the System Proxy and Connect

Return to the home screen or open Settings, and check that the core is running. Some clients start it automatically; others require you to click “Start” or “Connect.” If the core fails to start, check the first related error in the logs. An open client window doesn't mean the service is running. Once the core is up, enable the “System proxy” toggle. The same option in the tray menu usually controls the same setting.

The system proxy directs requests from apps that follow the operating system's proxy settings to the local proxy. Once it's enabled, leave the client running and open a new browser tab to make a request. Closing the window may only minimize the client to the tray, not exit it. Conversely, exiting the client may stop the local proxy. Check the tray icon, toggle, and core status to confirm what's running.

Many clients use 7890 as the mixed port, but check the actual value in your client's settings. For a first setup, you usually don't need to enter a port manually in Windows or macOS network settings; the system proxy toggle handles it. If another app is already using the same port, the logs may show a bind or listen error. Close the conflicting app or change the port as described by the client, then re-enable the system proxy.

Keep TUN and Allow LAN Disabled for Now

For your first connection test, leave “TUN mode” and “Allow LAN” disabled. TUN involves a virtual network adapter, routing, and permissions. Allow LAN lets other devices on the same local network use your proxy, which usually isn't needed on a single computer. Leaving both off until the basic connection works reduces possible causes of problems and avoids exposing the proxy to more devices than necessary.

The system proxy may not cover games, command-line tools, or apps that manage their own network connections. If the browser works but an app still connects directly, first check whether the app supports the system proxy or has its own proxy settings. Consider TUN only after that. To enable TUN, follow the client's prompts to install its service or grant administrator permissions. Implementations vary by operating system; see TUN and Fake-IP configuration for details.

Mobile Setup

On Android and iOS, clients usually connect from the home screen after you import a configuration and choose a policy. The first time you connect, the system will ask for VPN permission or to add a VPN configuration. Confirm only after checking that the request comes from the client you're using. A VPN indicator means the network extension or tunnel has started; it doesn't prove the remote proxy is working. Check an actual request in the next step.

At this point, the desktop client should be running with an enabled configuration, Rule mode selected, and the system proxy on. Next, verify the route with a browser request you can observe rather than relying on the toggle's appearance.

Step 4: Test the Connection and Check Where Traffic Goes

Open the client's Connections page and leave it visible. In a new browser tab, visit a site that's accessible on your network and that your configuration is expected to route through a proxy. Reload the page or open a path you haven't visited before to avoid seeing cached content. Check whether a new connection appears for the site's domain. Field names vary by client; common ones include destination, rule, policy, and proxy chain.

If the record shows the domain matching a rule and going through the policy group and proxy you selected, and the page loads correctly, that's stronger evidence than an enabled toggle alone. Then visit a site that your configuration should route directly and compare the two records. In Rule mode, different routes are usually expected. You don't need to switch to Global just to make every connection show a proxy.

If the expected request doesn't appear in the connection list, don't replace the subscription right away. Check whether your browser has its own proxy settings or proxy extension, and whether another VPN is still running. You can also fully quit and reopen the browser before trying again. Short-lived connections may disappear quickly, so check the history or logs. Compare the time and domain for the same request; don't mistake background traffic from another app for your test.

Narrow Down the Cause Based on What You See

If the request appears in the client but the logs show a remote connection timeout, the traffic entry point may be working. Next, check the selected proxy, service status, and current network. If the error says the domain couldn't be resolved, note the domain and time, then see the DNS guidance in FAQ troubleshooting. Don't change DNS, rules, and TUN all at once during your first test, or you won't know which change fixed the problem.

If only one site won't load while others using the same proxy policy work, check the site's status, account requirements, and the rule matched for that domain. An exit IP lookup can provide extra information, but it can't prove that all apps or DNS requests use the same route. For DNS leak checks, domain sniffing, or more detailed routing behavior, see DNS configuration tuning. This getting-started guide covers only the basic connection path.

Restore the System Proxy Before Quitting

When testing is done or you no longer need the proxy, turn off “System proxy” in the client before quitting normally from the tray menu. Open a regular webpage to confirm your connection is back to its usual route. If your browser can't connect after the client exits unexpectedly, check whether the operating system's manual proxy settings still point to a local address. Turn off only the setting you can confirm was added by this client. Work or school devices may require a fixed proxy, so don't remove all proxy settings.

To use the proxy again, reopen the client and check that the current configuration and policy are still selected, then enable the system proxy. For future subscription updates, use the Update option on the configuration card. If an update fails, keep the working configuration instead of deleting and recreating it right away. The four steps—import, select a route, enable the traffic entry point, and verify—are now complete. For everyday use, check the subscription status, switch policies as needed, and restore the system proxy before quitting.

Clash Setup Guide: Subscriptions and Connections