Clash Subscription Import and Connection Guide
This page breaks the process into four steps in the order you'll actually perform them: Import subscription → Choose proxy mode → Enable connection → Verify it works. Each step tells you where to click, what to expect, and what comes next — follow along and you'll have your first setup done. If you haven't installed a client yet, head to the download page and grab one for your platform first; to understand configuration fields line by line, see the config reference instead — this page sticks to the core setup path.
Naming varies slightly across clients: Clash Verge Rev calls the subscription entry "Profiles" (some versions label it as such), Clash Plus calls it "Profile," FlClash calls it "Config Files," and ClashX Meta keeps it under the "Config" submenu in the menu bar. This guide uses generic terms — button locations may differ by a click or two, but the workflow is identical across clients. See the download page for where to get each client and how to pick one.
Import subscription
Before you start, make sure of two things: the client is installed and opens normally; and you have a subscription link on hand — usually a single URL starting with https:// provided in your provider's user panel. A subscription link is essentially the address of a remote configuration file; the client downloads a YAML config containing nodes and routing rules from that address. Be sure to select the entire line when copying — links often carry a long token parameter, and missing a trailing character is the most common cause of import failure.
Steps: copy the subscription link in full to your clipboard, then open the subscription/profile page in the client's sidebar (or bottom navigation), click "New" or "Import." A dialog box pops up — paste the link in and confirm the download. Within one to three seconds, a new profile card appears in the list showing the profile name and update time; some clients also show remaining subscription traffic and expiration date. Seeing the card means the download succeeded; next, tap the card to set it as the active profile — active status is usually shown by a highlighted card, a colored border, or a checkmark.
Clipboard import vs. file import
Besides pasting a link, most clients also support importing from a local file: if you have a .yaml config file rather than a link, choose "Import from file" in the same import dialog and select the file. The difference between the two: link-based profiles can be set to auto-update (setting the update interval to 1440 minutes — once daily — means you don't need to manually re-import when nodes change), while file-based profiles are static and need to be re-imported whenever the provider updates nodes.
What to do if the subscription download fails
If you get a network error or timeout after clicking download, try two checks first: paste the link into your system browser's address bar — if it triggers a file download, the link itself is valid and the issue lies in the client's network environment; also check whether the link was truncated or escaped by a chat app, especially the parameters after &. Some providers also validate the request's User-Agent and only allow specific clients to fetch it. For more import error scenarios, see the installation/configuration section of the FAQ — not covered in detail here.
Once the profile is active, the client has all nodes and rules, but hasn't yet decided how traffic should be routed — that's the next step: choosing a proxy mode.
Choose a proxy mode
Proxy mode determines how the client handles every connection. The switch is usually found at the top of the main screen or the Proxies page, offering three options. Here's how each behaves:
| Mode | Core value | Behavior | Use case |
|---|---|---|---|
| Rule mode | rule | Matches each connection against the routing rules in the config; direct-rule matches go direct, proxy-rule matches go through a node | Default choice for daily use |
| Global mode | global | All traffic goes through the selected node without exception | Temporary check when suspecting a rule issue |
| Direct mode | direct | All traffic bypasses the proxy entirely, equivalent to a temporary disable | Comparing against your local network |
Stick with Rule mode for everyday use: the rule set bundled with your subscription already covers routing decisions for the vast majority of sites — local traffic goes direct, traffic that needs a proxy goes through a node, and neither side sacrifices speed. Global mode sends every request, including local sites, through the node, and is only useful for temporarily verifying a suspected rule issue; Direct mode is commonly used to check "what does it look like with the proxy off."
Once the mode is set, switch to the Proxies page to see several policy groups — each is a set of selectable nodes plus a selection strategy. Manual-select groups require you to pick a node yourself; groups marked url-test automatically ping latency and switch to the fastest node on their own, so you can leave those alone. For how the mode maps to the mode field in the config file, policy group types, and rule-matching priority, the config reference covers each section in detail — worth a read later if you want to go deeper.
At this point, nodes and policies are ready, but system traffic isn't actually flowing through the client yet — you still need to flip the connection switch.
Enable the connection
On desktop (Windows / macOS / Linux), find the "System Proxy" switch on the main screen or settings page and turn it on. Two changes should follow: the switch itself turns highlighted; and the HTTP/HTTPS proxy in your OS network settings now points to 127.0.0.1:7890 (7890 is the default mixed port — use whatever value you've configured if you changed it). From here, any app that respects the system proxy setting — browsers and most chat or office apps fall into this category — will have its traffic routed through the client according to your rules. If the switch bounces back immediately or shows a port-in-use error, something else is occupying 7890; see the troubleshooting section of the FAQ for how to resolve it.
System proxy vs. TUN mode
System proxy only affects apps that actively read the system proxy setting — browsers and most chat/office software fall into this bucket — while command-line tools, some games, and background services ignore the system proxy entirely, and their traffic bypasses the client. If you need to capture that kind of traffic, turn on "TUN mode" in the client: it creates a virtual network adapter to intercept all traffic at the network layer, and the first time you enable it, you'll be asked for administrator privileges or to install a system service — just authorize once when prompted. For light everyday use, system proxy alone is enough; a fuller explanation of how the two differ is in the FAQ.
Connecting on mobile
On Android, tap the launch switch on the main screen — the first time, a system-level VPN connection request pops up; tap "Allow," and a key icon in the status bar confirms it's active. iOS (Clash Plus) works the same way: on first launch the system will ask to add a VPN configuration — confirm in the prompt and complete verification as instructed, and every start/stop after that is a single tap. Mobile platforms don't distinguish between "system proxy" and "TUN" — everything goes through the VPN tunnel, capturing all app traffic.
Picking a node and checking latency
With the connection enabled, go back to the Proxies page and tap the latency-test icon (a lightning bolt or waveform) in the top-right of a policy group; each node will then display a number in milliseconds — the round-trip time of an HTTP request through that node from your machine. Lower is faster, and nodes showing a timeout are currently unavailable. In a manual-select group, tap a low-latency node — the choice takes effect immediately, no need to restart the connection.
A lit-up switch doesn't guarantee everything's working — spend one more minute running a full verification.
Verify it works
Verify at three levels, checking the whole chain from the inside out:
- V-01Client level: open the Connections panel and visit any web page — you should see new connection entries appear in real time, each labeled with the matched rule and the policy group used. Entries showing up confirm traffic is actually flowing through the client.
- V-02Browser level: visit any IP-check page — the exit IP and location it shows should match the region of the node you selected. Switching nodes and refreshing should change the IP accordingly.
- V-03Command-line level: send a request with curl explicitly pointed at the local proxy port — a successful response confirms the proxy port itself is serving requests correctly, and this step also rules out interference from browser extensions and the like.
You can run this command directly for command-line verification (works in macOS/Linux terminals and Windows PowerShell alike):
curl -x http://127.0.0.1:7890 -sS https://www.cloudflare.com/cdn-cgi/trace
In the returned text, the ip= line is your current exit IP, and loc= is the exit region code — both should match your selected node. If the command reports a connection refused error, first confirm the client is running and the port number matches your configuration.
If all three checks pass, your first setup is complete. If any of them fails, check against these common causes: mode was accidentally switched to Direct; port 7890 is occupied by another process; the browser has a separate proxy-switcher extension overriding the system proxy; or Windows Store apps are blocked by loopback restrictions from using the local proxy. Step-by-step diagnosis and fixes are grouped in the troubleshooting section of the FAQ — search by the symptom you're seeing.
If the browser shows an HTTPS certificate error after enabling the proxy, first check whether your system clock is accurate; if the error persists with correct time, switch to a different node before retrying — don't click "Proceed anyway." See the FAQ for a breakdown of causes.