Clash Tutorial: From Subscription Import to Connection Verification

Step 1

Import a Clash Subscription URL

After opening the client, look for a “Subscription,” “Configuration,” “Profiles,” or “Config” page. Desktop clients usually place it in the left navigation bar, while mobile clients often put it in the configuration area on the home screen. Choose New from URL, Add Subscription, or Import Remote Configuration. Do not choose local file import, because you are preparing an online subscription URL.

Paste the complete URL into the address field. Some clients also ask for a configuration name; use a short, recognizable name such as the service source or intended use. This name is only for your local list and does not change the subscription. After confirming the address, click Download, Import, Save, or Update. The client will fetch the remote configuration and save its proxy nodes, policy groups, rules, and DNS settings as a local configuration.

When the import finishes, the configuration list usually gains a new entry and shows its latest update time. One easy-to-miss step remains: click the entry and make it the active configuration. Some clients show a checkmark, highlight color, or “Current” label beside the selected item; others require an Enable button. Only after the active configuration is loaded can the policy groups and node list be generated from this subscription.

How to confirm this step is complete

Leave the configuration page and open “Proxy,” “Proxies,” or the policy-group page. If you can see policy groups such as Auto Select, Node Select, or Failover, with selectable nodes after expanding them, the configuration has been read by the kernel. If the page is still empty, do not enable the system proxy yet: without an active configuration, the client cannot determine where to send traffic. For more subscription update issues, see the installation and configuration section of the FAQ.

Once nodes and policy groups appear, do not rush to switch between them. First determine the proxy mode, because it controls whether rules participate in matching and what results you should expect during verification.

Step 3

Choose a Node and Connect

Open the Proxy or policy-group page and open the main policy group that provides the default exit. If the list contains both individual nodes and sub-policies such as “Auto Select” or “Failover,” choose a specific node for the first test so you can identify the exact route being used. After verification, switch to an automatic policy if that better suits the configuration.

Clients usually provide a latency-test button. After testing, a node that returns a result has at least connected to the test target; a timed-out node is not a good candidate for first verification. Latency reflects the response from one test address at that moment and does not represent the actual speed of every website. Choose a node that returns results consistently; there is no need to keep testing just to find the lowest number.

After selecting a node, return to the client home or settings page and turn on “System Proxy.” On desktop systems, browsers and applications that follow system proxy settings will normally send traffic to Clash's local listening port. Windows may show a firewall permission dialog, while macOS may ask you to approve a system settings change. Follow the operating system prompts, then confirm that the switch remains enabled rather than immediately turning itself off.

Mobile connection methods

Android and iOS clients usually capture traffic through the system VPN interface. After you tap Start, Connect, or the main switch, the system displays a VPN permission prompt. Confirm it; a VPN indicator should appear in the status bar and the client should show a connected state. The VPN interface passes device traffic to the local proxy kernel, while the current Clash configuration still determines how requests are handled through its mode, rules, and policy groups.

When to consider TUN mode

On desktop, enabling only the system proxy is usually enough for browsers, but some games, command-line tools, and applications that ignore system proxy settings may remain direct. Consider TUN mode when you have a specific need to capture that traffic. TUN operates at a lower level and may require administrator access, network-extension permission, or virtual network adapter installation. Do not enable multiple capture switches before basic browser verification is complete, or it will be difficult to tell which path handled the request.

Check whether the client is receiving connections

After enabling traffic capture, open a new browser tab and visit a regular webpage, then return to the client's connections or logs page. Normally you should see records containing the domain, destination, matched rule, and policy used. Ongoing log entries show that browser requests have reached the kernel. If no new entries appear at all, the system proxy may not be active, the browser may use its own proxy settings, or another network tool may still be capturing traffic.

The connection path is now in place, but an enabled switch alone does not prove that the outbound route changed. The final step is to check both the external outbound details and the client's internal records.