Clash Quickstart: From Subscription Import to Verified Connection

A subscription link is a URL that points to a config file, which contains the node list and routing rules. The client fetches the config through this link, and every subsequent subscription update refreshes it automatically — no manual file editing needed when nodes change. For how subscriptions, config files, and nodes relate to each other, see the "Config Files & Rules" category in the glossary; we won't go into detail here.

Order of operations: first copy the subscription link from your provider's user center, then open the client. In Clash Verge Rev, click "Subscription" in the left sidebar — there's an input box at the top of the page. Paste the link and click the "Import" button next to it. The client starts downloading the config, and within seconds a profile card appears showing the profile name; if the provider includes traffic and expiration info in the response headers, that shows up on the card too. The card may not be active yet — left-click it once, and a highlighted border means it's now selected, meaning all subsequent proxy behavior is based on it.

Entry points in other clients: Clash Plus has "Subscription" on the home page — click "Add Subscription," paste the link, and save; FlClash has a plus button in the bottom right of the "Profiles" page — choose "URL" and paste; Clash Nyanpasu has "New" on the "Proxy Config" page — choose Remote URL as the type. Regardless of the client, the standard for a successful import is the same: a new entry appears in the profile list and that entry is selected.

If you were given a .yaml file instead of a link, skip URL import and use the "Import File" or "Local" option on the same page to select the file. The downside of a local config is it won't auto-update — you'll need to re-import a new file whenever nodes change, so use a link whenever one is available.

The most common error during import is a network error or timeout: the subscription link itself must be directly reachable on your current network. If your network blocks access to it, try completing the first import over a mobile data hotspot instead. After a successful import, check the subscription entry's menu to confirm "Auto Update" is enabled — the typical interval is 24 hours or 1440 minutes, and the default is fine to keep.

Once the profile is selected, go to the "Proxies" page in the left sidebar. There's a row of mode switches at the top, typically three: Rule, Global, and Direct. This step decides how the client handles every connection passing through it, and it's the single most important decision for your overall experience — worth a minute to understand.

Rule mode is the standard choice for everyday use. The client checks each connection against the routing rules in the config file: traffic matching direct rules (like local sites and LAN addresses) passes straight through, while traffic matching proxy rules is forwarded through your selected node — the two never interfere with each other. Local sites stay at full speed while services outside your region go through the proxy, all without manually switching back and forth — this is the core value of a Clash-style setup. How rules are written and matched in order is a more advanced topic covered fully in the "Rule Groups & Routing" category of the glossary.

Global mode forces every connection through the proxy regardless of destination — use it briefly only when a specific app ignores the rules and needs to be force-proxied, then switch back to Rule mode, otherwise even local sites will be routed through a node and end up slower. Direct mode is the opposite — no traffic goes through the proxy at all, effectively disabling routing temporarily, occasionally useful for troubleshooting.

With mode set to Rule, scroll down on the same page to the list of proxy groups. Find the group named "Proxy Selector" or similar, and expand it to see all available nodes plus a few auto-selection groups. You can pick a specific node directly, or select an auto-test group (usually labeled with url-test or "Auto Select") so the client periodically tests latency and always uses the fastest one. Most proxy group interfaces include a lightning bolt or radar-shaped latency test button — tapping it batch-tests every node in the group; lower numbers are better, and nodes marked red or timed out should be avoided for now.

The differences between the three auto-group types — url-test, fallback, and load-balance — and their parameters aren't essential for getting started; leave those to the full documentation and related advanced articles. This step only needs one thing confirmed: your exit node is set.

The first two steps were just preparation — no traffic has actually gone through the client yet. Getting the proxy to actually take over traffic works differently on desktop versus mobile; here's each.

Windows and macOS: find the "System Proxy" switch — in Clash Verge Rev it's the first switch group on the "Settings" page in the left sidebar; in Clash Plus it's right on the home screen. Turning it on points the OS's HTTP and HTTPS proxy settings to the client's local listening port (Clash Verge Rev defaults to 7897; most legacy clients default to 7890 — check the settings page to confirm). From then on, browsers and most apps that respect the system proxy will route through the client first, then get routed according to the rules from step two. Once the switch is on, a client icon appears in the menu bar or system tray — a clear sign it's running.

The first time macOS enables the system proxy or TUN-related features, it may show a sequence of network extension authorization and keychain access prompts — these are standard system permission flows, just allow each one; if you accidentally deny one, you'll need to grant it manually in System Settings — the full path is covered in the macOS section of the full documentation, which walks through each prompt.

Android: open the client's main screen and tap the prominent connect button — the system shows a "Connection Request" dialog stating the app wants to set up a VPN connection, which is the standard way Android hands over traffic. Tap "OK" to allow. A key-shaped icon in the status bar confirms it worked. iOS: Clash Plus similarly requests to add a VPN configuration on first connection — allow it and verify with your passcode as prompted; every connection after that is a single tap.

Two optional features aren't needed for this walkthrough, but worth knowing about: first, TUN mode, used to capture traffic from apps that ignore the system proxy (command-line tools, some game clients) by working as a virtual network adapter — it needs extra services or permissions; see the concept in the glossary and setup steps in the full documentation. Second, launch on startup, available as a switch on every client's settings page — turn it on if you want it.

The switch being on doesn't guarantee the chain is actually working — spend two minutes confirming it. Three verification methods, ranging from quick to thorough; pick one, or do all three for extra confidence.

Method one: the connections panel. Go back to the client, open the "Connections" page in the sidebar, then visit any website in your browser. The connections page lists new active connections in real time, each row showing the target domain, the matched rule, and the actual exit used — local sites should show DIRECT or a similar direct-type policy, while sites outside your region should show the node name you chose in step two. If the matched rule and exit both look right, routing is working as expected.

Method two: the command line. Send a request directly through the local proxy port in a terminal, bypassing browser caching and other variables. Substitute the actual port your client uses — Clash Verge Rev defaults to 7897:

A response of HTTP/1.1 200 Connection established followed by a 204 status confirms the local port is listening and the node chain is reachable. A "connection refused" error means the port number is wrong or the client isn't running; a long hang usually points to a node issue.

Method three: logs. Set the log level to info on the client's "Logs" page to see the matching process for every connection — useful for confirming why a particular rule matched or didn't, and the most direct way to diagnose routing issues.

If verification fails — for example, every node times out on latency tests, or pages won't load at all — don't jump straight to reinstalling. The issue usually falls into one of five categories: subscription validity, local port conflicts, the system proxy switch, protocol/kernel mismatch, or DNS pollution. The configuration FAQ section of the full documentation gives a layer-by-layer checklist with fixes — following it in order usually locates the issue within ten minutes.