Clash Quickstart: Subscription Import and Connection in Four Steps

1.1 Copy the full subscription link

Log in to your provider's dashboard and find the "Subscription Link," "Clash Subscription," or "Copy Subscription" button — clicking it puts the link on your clipboard. Two things to watch for: first, copy the link itself, not the dashboard's web address — subscription links are usually long and end with a token= parameter; second, if the provider offers multiple formats, pick the one labeled Clash or "Universal." A typical subscription link looks like this (values below are placeholders):

https://example.com/api/v1/client/subscribe?token=xxxx

1.2 Open the subscription entry in the client

The entry point varies slightly by client: in Clash Verge Rev, click "Profiles" in the sidebar and use the input box at the top; in Clash Plus, go to the "Profiles" page at the bottom or in the sidebar and click the plus icon in the top-right corner; in FlClash, go to the "Profiles" page and click the "+" in the bottom-right corner, then choose "Import from URL"; in Clash Meta for Android, go to "Profiles" on the home screen, tap the "+" in the bottom-right corner, then "Import from URL." Whichever client you use, you're looking for a place to paste a URL.

1.3 Paste the link and wait for it to download

Paste the subscription link into the input box. You can leave the name field blank — most clients will pull the name your provider set — then click "Import" or "Download." The client will request the subscription URL in the background and fetch a YAML config file, usually within seconds. Success looks like this: a profile card appears on the subscription/profiles page showing the node count, and most providers' subscriptions also include used traffic and expiration date.

1.4 Activate the profile

Some clients don't automatically enable a newly imported profile — you may need to tap the card so it becomes highlighted or checked, indicating it's "currently active." If there are multiple cards on the subscription page, make sure the highlighted one is the one you just imported, otherwise you won't see the expected node list when picking nodes later.

If the import fails, check three things first: whether the link was copied in full (not truncated), whether your current network can reach the subscription URL directly, and whether you accidentally pasted the dashboard's web address instead of the subscription link. For more specific import errors and fixes, see the installation & setup category in Troubleshooting.

Before flipping any switches, there are two levels of "mode" in Clash worth confirming once — they determine how traffic gets routed and how it gets intercepted. This step only takes two clicks, but understanding it will save a lot of confusion later.

2.1 Outbound mode: choose "Rule"

Find the "Outbound Mode" / "Mode" option on the client's home page (or settings page). There are usually three choices:

• Rule: each connection is routed to either the proxy or a direct connection based on the rules in the config file — local sites go direct, target sites go through the proxy, with no interference between the two. This is the recommended mode for everyday use.
• Global: all traffic is forced through the currently selected node, even traffic to local sites, which then gets routed abroad unnecessarily. Generally used only temporarily for troubleshooting.
• Direct: no traffic goes through the proxy at all — effectively disables routing, useful for debugging scenarios.

Just set the outbound mode to "Rule." The rules bundled in your subscription profile are preset by your provider, so there's nothing to change on first use. To understand how rules match and how to maintain rule sets yourself, read the routing rules chapter in the Advanced Config manual later on.

2.2 Takeover method: use System Proxy for your first setup

Clients typically take over traffic in one of two ways. System Proxy sets an HTTP/SOCKS proxy address at the operating system level (defaulting to the local 127.0.0.1:7890); browsers and most apps that respect system proxy settings will route through it automatically — it's simple to enable and requires few permissions. TUN mode, on the other hand, intercepts all traffic on the device through a virtual network adapter, including command-line tools and game clients that ignore system proxy settings, but it requires administrator privileges or a system service to be installed.

For your first setup, use System Proxy to get the whole flow working, then look into TUN mode later if you need it. The requirements for enabling TUN mode, how it pairs with Fake-IP, and common pitfalls are covered in a dedicated chapter of the Advanced Config manual — not covered here.

3.1 Turn on the system proxy switch

Go back to the client's home page and find the "System Proxy" switch (some clients call it "Set as System Proxy"), then turn it on. The first-time system prompt varies by platform — here's how to handle each:

• Windows: usually takes effect immediately. If security software pops up a "This program is modifying proxy settings" warning, choose to allow it; once enabled, you can confirm the manual proxy address has been set under Settings → Network & Internet → Proxy.
• macOS: the first time you enable it, you may see a dialog asking for your account password to authorize changes to network settings — enter it and confirm; you won't be asked again after that.
• Android: the Android client intercepts traffic via VpnService. After tapping connect, the system will show a "XX wants to set up a VPN connection" prompt — you must tap Allow. A key icon appearing in the status bar confirms success. Some manufacturers' battery-saving policies kill the client after the screen turns off, causing disconnects — see the troubleshooting category in Troubleshooting for fixes.

3.2 Go to the proxies page and test node latency

Once the switch is on, traffic is already flowing through the client, but it's using whatever node is currently selected in the policy group — not necessarily the fastest one. Switch to the "Proxies" page and you'll see one or more policy groups (e.g. "Proxy Select," "Auto Select"), which expand to show all the nodes in your subscription. Click the lightning bolt / speed test icon on the page, and the client will run a latency test against every node in the group. After a few seconds, each node shows a millisecond value on the right: low green numbers mean a clean connection, higher numbers suggest a longer or congested route, and nodes showing a timeout are currently unavailable.

3.3 Select a node

In a manual policy group like "Proxy Select," clicking a node with low latency selects it, switching your active outbound to that node. If your subscription includes an "Auto Select" group (url-test type), you can also point the manual group to it and let the client periodically test and auto-pick the fastest node — the logic and parameter differences between the three automatic policy group types (url-test / fallback / load-balance) are advanced topics covered in the policy group chapter of the Advanced Config manual. Besides latency, also pay attention to the region and traffic multiplier noted in node names — these tips are summarized in the usage tips category of Troubleshooting.

4.1 Visit the target site directly

Open your browser and visit a target site that was previously unreachable. If it loads, that confirms the "System Proxy → Client → Node" chain is working. It's also worth opening a commonly used local site to confirm speed is normal — under Rule mode it should connect directly, and if it's noticeably slower, the rule matching may be off. Try switching nodes first; if the issue persists, work through the troubleshooting category in Troubleshooting step by step.

4.2 Check the connections panel to confirm rule matching

A more reliable check than "it loads" is looking at the client's "Connections" panel (some clients put it under "Logs" or "Overview"). Keep the panel open, refresh the page you just visited, and new connection entries will scroll in live, each showing the target domain, the matched rule, and the node actually used. If the target site's connection shows your selected node and local sites show as direct, rule-based routing is working as expected.

4.3 Double-check from the command line (optional)

If you're comfortable with a terminal, you can explicitly target the local proxy port to bypass any browser caching. The default mixed port is 7890 (check your client's settings page for the actual port):

curl -x http://127.0.0.1:7890 -I https://www.google.com

A response header like HTTP/2 200 or 301 means the proxy chain is working; Connection refused means the port is wrong or the client isn't running; a long timeout usually means the current node has an issue — go back and pick a different one.

4.4 If it's not working

Check these in order of likelihood: whether the system proxy switch is actually on (it can get disabled if another proxy tool takes over), whether the selected node is timing out on latency tests, whether the outbound mode was accidentally set to "Direct," and whether your browser has an extension that manages its own proxy. If none of that resolves it, look up the specific error in Troubleshooting. For deeper causes like DNS pollution or Fake-IP issues, the DNS chapter of the Advanced Config manual walks through the full diagnostic process.