Clash Tutorial: From Subscription Import to Connection Verification

Before You Start: Understand the Client, Core, and Configuration

Before you begin, prepare an installed Clash graphical client and either a working subscription URL or a local configuration file. The graphical client provides menus, switches, and connection logs; cores such as mihomo read the configuration and handle network traffic; subscription or YAML files store proxies, strategy groups, rules, and port settings. These components have different roles, so a running client does not necessarily mean the configuration is usable, and importing a configuration does not mean system traffic is connected.

A subscription URL is usually provided by the network service you use. This page does not provide public subscriptions, and configurations from unknown sources should not be imported directly onto everyday devices. Subscription links may contain account information, so protect them like passwords and do not post them in public forums, screenshots, or log attachments. If you received a file ending in .yaml or .yml, use the local-file import flow. If the subscription is provided as a web URL, use the subscription URL field in the client.

During the initial setup, temporarily close other proxy tools to prevent multiple programs from changing the system proxy or claiming the same port. You can leave the browser open, but test only after completing each step. This makes it easier to identify whether a problem occurred during import, mode selection, system connection, or verification instead of changing several settings at once.

Import a Subscription or Local Configuration File

After opening the Clash client, go to the Configuration page first. Some clients label it Subscription, Configuration Files, or Profiles. The page usually provides separate entries for remote subscriptions and local files. For a subscription URL, find the add-subscription button and paste the complete address into the input field. Use a recognizable name such as “Daily Configuration” rather than the subscription URL itself. Click Import, Save, or Download, then wait for the client to fetch and parse the configuration.

After a successful import, a new entry should appear in the profile list. Click it to make it the active configuration. Some clients select it automatically, while others only add the file to the list and require you to click Enable, Set as Current, or the profile card itself. To confirm that it is active, check the current profile name at the top of the page or open the Proxies page to see whether the configured strategy groups are present. If you can see a subscription entry but the Proxies page is still empty, the configuration is usually not active yet.

Use a Local YAML File

If the configuration is saved as a file on your device, choose Import from File or Local Configuration, then select the relevant YAML file. Set it as the active configuration after importing. If the client reports a parsing failure, do not enable the system proxy yet because the core has not received a complete configuration. Common causes include inconsistent YAML indentation, a missing space after a colon, incorrect list nesting, or fields unsupported by the current core. Try downloading the file again from its source before deleting fields whose meaning is unclear.

Some subscriptions require direct access to the service when updating. If the first import works but later updates fail, temporarily disable the system proxy and try updating again. Conversely, if the subscription service is reachable only through the existing proxy, enable Use Proxy for Updates in the client’s subscription settings. The label varies by client, but the purpose is the same: choose whether subscription requests use a direct connection or the current proxy.

Choose a Proxy Mode and Strategy Group

After the configuration loads, open the Proxies page. There are usually two levels of selection: the first is the operating mode, which determines whether the client uses rules, global routing, or direct connections; the second is the strategy group, which determines the actual outbound route after a rule matches that group. New users often configure only one level—for example, switching to Rule mode without selecting a value for Node Selection—so the client appears connected while the actual routing does not match expectations.

For first-time use, choose Rule mode. It evaluates the rules in the configuration from top to bottom; common rules include domain suffixes, keywords, GeoIP, GeoSite, and the final MATCH rule. After a match, traffic is sent to the strategy group named at the end of the rule, such as DOMAIN-SUFFIX,github.com,节点选择. This mode lets different destinations use direct access, rejection, or a proxy according to the configuration and is suitable for everyday use.

Global mode usually sends most traffic to GLOBAL or another designated global strategy. It is useful for temporarily checking whether rules affect a connection, but it is not ideal as a permanent setting when the configuration structure is unfamiliar. Direct mode bypasses proxy outbound selection and is mainly useful for restoring ordinary connectivity or running comparison tests. If a site fails in Rule mode but works in Global mode, the issue is usually in rule matching or strategy-group selection, not the client installation.

Select an Outbound Route for the Main Strategy Group

Keep Rule mode enabled and look for Node Selection, Proxy, PROXY, or the main strategy group defined by the configuration. If the group type is select, open it and choose an available item manually. With url-test, the client selects automatically according to the configured test URL and interval. With fallback, it tries other items in order when the current one is unavailable. Strategy-group names come from the configuration provider, so they may not exactly match this tutorial.

Automatic selection does not mean every website will use that group. The final result still depends on the rules. Ad-related traffic may go to REJECT, local-network and region-specific addresses may go to DIRECT, and other traffic may enter the main proxy group. To learn more about select, url-test, fallback, and rule order, see the Glossary; system-level details about protocols, cores, and configuration compatibility are covered in Protocol Reference. For this tutorial, simply confirm that the main strategy group has an explicit selection.

Enable the System Proxy and Establish a Connection

After choosing the mode and strategy, return to the Overview or Settings page and enable the System Proxy switch. This writes the proxy address to the operating system’s network settings, allowing browsers and most desktop apps that follow those settings to send traffic through Clash. Do not close the client immediately after enabling it: the system proxy only tells other applications where to connect, while the core must continue running to process traffic.

Windows and macOS may request system permission the first time network settings are changed. Confirm that the request comes from the installed client, then follow the system prompts. A macOS client using a network extension may also open the Network or Privacy section of System Settings. Android typically asks for VPN connection permission and then shows a VPN indicator in the status bar. iOS also asks to add a VPN configuration. These prompts are part of establishing the local network channel; if permission is denied, the client interface may remain usable, but other applications will not be connected.

When Do You Need TUN Mode?

The system proxy mainly covers applications that actively read the operating system’s proxy settings. Some games, command-line tools, virtual machines, and applications with their own networking stack ignore those settings, so TUN mode may help. TUN creates a virtual network interface that sends a broader range of traffic to the core. For a first setup, do not enable both the system proxy and TUN while trying to guess the cause of each result. Start with the system proxy and verify the browser; enable TUN later if a specific application clearly ignores the system proxy, then run a second round of tests.

Enabling TUN may require administrator permission and may trigger firewall, network-extension, or driver authorization. If the entire device loses connectivity after enabling it, turn TUN off first and confirm that normal networking returns, then check the client logs for permission, routing, or DNS messages. Details about TUN, DNS, and routing belong in Advanced configuration; continue with the Protocols and Core Technical Reference.

Terminal Applications Need Separate Configuration

A working browser alongside failed terminal commands does not mean Clash is broken. Many terminal tools do not use the system proxy by default. Set HTTP_PROXY, HTTPS_PROXY, or ALL_PROXY in the current shell and point it to the mixed or SOCKS port shown by the client. Use the port configured in the current client; do not overwrite existing settings based only on a tutorial example. If you only need to verify the browser connection initially, skip terminal configuration and handle it separately after the basic route works.

Verify That the Proxy Is Actually Working

Verify the connection in three layers instead of relying only on the switch color. First, check ordinary connectivity: refresh a website that normally loads directly and confirm that enabling the system proxy has not interrupted basic access. If every site fails, return to the client and check whether the core is running, whether a port is already in use, and whether the current configuration is still active. Frequently changing strategies at this point only adds more variables.

Second, check the target site: open a destination that should use the main proxy strategy under the current configuration. If it loads normally, return to Clash’s Connections page. The connection list usually shows the destination domain, network type, matched rule, and strategy chain. Find the entry created by the visit, confirm that the domain and timestamp match, and check whether it used the expected strategy. Connection records are more reliable than a page merely loading because the browser may have served cached content or the request may have used DIRECT.

Third, check the logs. Leave the log level at info or the client default, then refresh the target page. Normally, new entries will include the domain, rule, or connection details. If no new log entries appear, the request likely never reached Clash; check the system proxy, the browser’s independent proxy settings, or terminal environment variables. If a request appears with a DIRECT match, inspect the rules. If it matches the expected strategy but still fails, check the available items in the strategy group and the local network.

Check Browsers, Terminals, and Other Apps Separately

A browser may use the system proxy or an independent proxy extension. During troubleshooting, disable browser extensions that rewrite proxy routing and confirm that the browser is not manually set to another port. Terminal tools usually need environment variables; with Git, curl, and package managers, also check for proxy settings stored by the tools themselves. Mobile apps do not all use the same networking implementation, so test two different apps separately instead of treating one webpage as representative of the entire device.

If the browser still tries to connect to a local proxy port after Clash is closed, the system proxy may not have been restored correctly. Restart the client, enable and then disable the system proxy so the client performs a complete toggle; if the issue persists, inspect the proxy settings in the operating system. For symptom-based troubleshooting, see FAQ and Troubleshooting, covering subscription update failures, port conflicts, ineffective system proxy settings, and TUN startup failures.

Everyday Use and Safe Shutdown

When starting Clash later, open the client first and wait until the core is ready, then enable the system proxy or TUN. You usually do not need to reimport the subscription every day; update the active configuration at the interval recommended by your service provider. If the strategy groups change after an update, review the main group selection because the provider may have changed group names, rules, or defaults.

When exiting, disable the system proxy or TUN before closing the client. This lets the operating system stop sending traffic to the local port before the core shuts down. If you force-quit the process, some systems may temporarily retain the proxy settings, leaving the client stopped while the browser cannot connect. If that happens, reopen the client and close the corresponding switch normally.

Rule mode can remain enabled for everyday use. Switch briefly to Global or Direct only when diagnosing a specific issue, then restore the original mode after testing. You do not need to learn every configuration option—rules, DNS, sniffing, TUN routing, and protocol parameters—during your first setup. Stabilize the core flow of “configuration loads, strategy selected, system connected, request recorded,” then read the Protocol Reference and Glossary as needed to understand each setting.