Clash Tutorial

Before You Start: Client and Subscription

Initial setup usually takes just a few minutes. You’ll need an installed client and a working Clash subscription URL or configuration file. The client reads the configuration, runs the proxy core, and manages your device’s proxy settings; installing it alone doesn’t provide working nodes. Get the subscription URL from your provider’s account page. If you only have a username and password, check the provider’s setup instructions first—don’t paste a login page URL into the client.

On Windows, open Settings → System → About and check that your system type matches the installer architecture. Install using a standard user account, then launch the client and make sure its main window or taskbar tray icon appears. Don’t turn on every network option or run multiple tools that manage the system proxy at the same time. Keeping one clear connection path makes it easier to tell whether a problem is caused by the configuration, node, or system settings.

Follow the steps below in order for your first connection. Check the glossary if you come across an unfamiliar term; use the configuration reference when you need to edit YAML fields. This guide gets one connection working and verified—you don’t need to understand every configuration field first.

01 Import a Subscription
Downloading isn’t the same as activating

Find the Clash subscription option on your provider’s account page, copy the URL, and switch back to the client. In Clash for Windows, click Profiles in the left sidebar, paste the link into the address field at the top, and click Download. In other clients, look for New, Import, or a plus button on the Configuration page, choose import from URL, and paste the full address. Don’t remove anything after the question mark; it may contain information needed to access the profile.

After starting the import, wait for it to finish instead of creating several copies of the same subscription. When it succeeds, a profile card should appear, usually showing its name, source, or update time. Click the card to make it active; its selection mark, border, or current profile name should change. A profile appearing in the list and the core using it are two different states. If you imported a second subscription but didn’t switch to it, the proxy page may still show the original groups.

If you have a local YAML file, use the file import option in Profiles. In clients that support drag and drop, you can also drop the file onto the page. Select the imported profile to activate it. Local files don’t update automatically when their source changes, while remote subscriptions can usually be refreshed from the card’s menu. First make sure the profile loads; set an automatic update interval later so update issues don’t get mixed up with connection problems.

Make sure the proxy groups appear before continuing

Click Proxies in the left sidebar and check that the page shows proxy groups and candidate nodes. Group names vary between configurations—some are in Chinese, while others use service-specific names. Don’t look for one particular label. If the expected groups aren’t there, return to Profiles and confirm the imported card is selected. Then check for format errors, unsupported fields, or download failures.

If the download times out, first check that your computer is online and the subscription URL is still valid. A login page or provider error page can also cause YAML parsing to fail; changing the file extension to .yaml won’t fix it. Note the key error message and follow the subscription update troubleshooting steps in the FAQ. If you share a screenshot, hide the full URL—it may let others access the configuration linked to your account.

You’re ready to move on when the profile is selected and its proxy groups appear on the proxy page. You don’t need to enable the system proxy yet. First decide which connections should use a proxy and which node should handle them.

02 Choose a Proxy Mode
Rule mode and proxy groups

Open Proxies or the proxy page and find the mode selector. Clash for Windows commonly offers Rule, Global, Direct; Chinese-language clients usually label these as Rule, Global, and Direct in Chinese. Choose Rule for your first setup. It routes connections according to the rules in the active configuration, so different destinations can use a direct connection, a proxy, or another policy instead of sending everything through one exit.

With Rule mode selected, expand the main proxy groups provided by the configuration and choose a candidate node. Some groups let you choose manually; others use automatic testing or failover. The group name shown in the interface may not be the actual exit. If the selected item is another group, open it and check the final selection. In particular, make sure the active group hasn’t selected DIRECT—that means a direct connection, not a remote proxy node.

You don’t need to change every group to the same node. Rules may use separate groups for downloads, media, or everyday browsing, and changing unrelated groups won’t affect the site you’re testing. For your first setup, keep the subscription’s defaults and change only the main group that requires manual selection. If a connection doesn’t use that group, check its matched rule in Connections and update the relevant group. This is more reliable than changing groups at random.

Global mode doesn’t route every app through the proxy

Global means connections that reach the proxy core are handled by the global policy; you still need to choose an exit in the global group. It doesn’t automatically make every app on your computer use the system proxy. Direct sends connections that reach the core straight to their destinations; it doesn’t turn off the client. Use Rule mode for everyday browsing. Switch to Global briefly only to distinguish a rules issue from a node issue, then switch back.

If there’s a test button beside a node, run a latency test to see whether it responds. A timeout could mean the node is unavailable, or that the test address can’t be reached; a lower number doesn’t guarantee faster downloads. Choose a candidate that can establish a connection, then verify it by visiting a real site in the next step. There’s no need to keep testing until you get a particular number.

At this point, you should be able to confirm two things: Rule mode is selected, and the proxy group you plan to use has an active selection. Proxy mode controls how the core handles traffic; the system proxy controls how some apps send traffic to the core. Next, enable the system proxy.

03 Enable the System Proxy
Connect your browser first

Return to the General page in Clash for Windows, find System Proxy, and turn it on. In Chinese-language clients, this option is usually called System Proxy and appears on the home or settings page. Some clients use a master switch that starts the core and configures the proxy together. Afterward, make sure the client is still running, the switch remains on, and there are no errors about occupied ports or failed configuration loading. For your first test, check the settings page and error messages rather than relying on the tray icon color.

Port in General is the local listening port. A common value is 7890, but use the value shown in your client; there’s no need to change it just to match this guide. Normally, the system proxy switch adds the required address and port to Windows settings, so you don’t need to enter them manually. If the port is already in use, close any other proxy tool and try again. If the conflict persists, follow the port settings reference to change the listening port, then enable the system proxy again.

You don’t need to enable Allow LAN for your first connection. It lets other devices on your local network use this computer’s proxy; it isn’t required for this computer to access the internet. Start with Windows only controls whether the client launches at startup, and can wait until after you’ve verified the connection. Change as few settings as possible so you can trace any problems to the steps you just took.

Set up TUN after the basic connection works

Browsers usually follow the system proxy, so use one for your first test. Some games, command-line tools, and standalone apps don’t use system proxy settings. If a browser works but those apps don’t, that doesn’t necessarily mean the node is down. Check the app’s own proxy settings first. If you need a virtual interface to route their traffic, consider the client’s TUN mode. TUN may also require a service, permissions, and DNS settings, so don’t mix those steps into your first connection test.

In older versions of Clash for Windows, Service Mode is a service-related option; turning it on doesn’t necessarily enable TUN. Requirements vary by version and may include additional configuration, while newer clients have their own service installation steps. If you need to route apps that don’t follow the system proxy, read the TUN and DNS section of the configuration reference. Don’t copy fields from a different core. First confirm that the browser works through the standard proxy path; that gives you a baseline for troubleshooting the virtual interface later.

Android and iOS work a little differently: after choosing a profile and policy, tap the client’s Connect button and approve the system VPN prompt the first time. Seeing the VPN indicator only confirms that the tunnel is up—you still need to verify access below. On macOS, follow the client’s prompts for network extension or system proxy permissions. You don’t need to match Windows toggle names exactly on other platforms.

04 Verify the Connection
Compare access with connection logs

Keep the client running and open a new browser tab. First visit a site that normally works to make sure your basic connection hasn’t been interrupted. Then visit a destination that should use your selected proxy. Test with a new request rather than relying on an old page: it may be cached, and existing connections may not immediately use a changed policy. If you just switched nodes, close the test tab and open it again.

Return to the client and open Connections while refreshing the page. Clients that support connection details may show the destination, matched rule, or policy chain. Check whether the request used DIRECT or went through the expected proxy group and node. A page loading successfully alongside a connection log showing the expected route is stronger evidence than an “on” switch alone.

In Rule mode, it’s normal for some sites to connect directly and others to use a proxy. You don’t need to switch to Global just to make every log entry show a proxy. If a destination matched the wrong rule, note the rule name and proxy group, then change that group on the proxy page. Edit rule order in the configuration reference only when you actually need to change how traffic is matched. Don’t delete all your rules at the start; it makes before-and-after comparisons much harder.

Troubleshoot the symptoms; don’t toggle everything at once

If the browser can’t open the page and Connections shows no matching request, check that the system proxy is still enabled and that no browser extension or app-specific proxy setting is overriding it. Some connections are brief, so try refreshing the test page a few times or check for errors in Logs. Logs and connection details may reveal destinations or configuration sources; include only the necessary information in troubleshooting screenshots.

If the request reaches the core but then times out, switch to another node in the proxy group actually used by the rule and retry the same destination. If only one site fails while others work, check the rule for that destination, the remote service, or whether the node can reach it—don’t reinstall the client right away. If the profile showed a configuration error during import, return to the first step and fix the active profile instead of trying more network switches.

An exit IP lookup can help, but it only shows which exit handled that particular request. By itself, it doesn’t prove that every app is routed through the proxy or that DNS is behaving as expected. If the browser works but other apps don’t, review the difference between the system proxy and TUN in the previous section. If enabling the proxy breaks all network access, turn it off and check your basic connection, then follow the relevant steps in the FAQ. Don’t change the port, mode, and DNS all at once.

Everyday Use and How to Disconnect

After your first successful test, remember the active profile name, mode, and proxy group. Next time you start the client, check that the same profile is active before connecting. A subscription update may change node names or group contents. If your previous manual selection is no longer available, choose another node on the proxy page and verify the connection again using step four. Similar node names don’t guarantee the same exit after an update.

When you’re done using the desktop client, turn off the system proxy before quitting. If you end the process directly, Windows may keep proxy settings that point to a local port the client is no longer listening on, leaving your browser offline. If that happens, open Windows Settings → Network & Internet → Proxy and check whether Use a proxy server is still enabled from this session. On a work- or school-managed device, check the existing settings first; don’t overwrite your organization’s configuration.

If you need more advanced app routing, rule routing, or DNS settings, change one thing at a time and keep a copy of the original configuration. Start with the configuration reference for further reading. To understand terms such as Rule, proxy group, and system proxy, see the glossary. Once the basic connection works, there’s no need to add complexity just to enable more options.