Import a Clash Subscription
and Configure Your Proxy

Step 1

Import and Enable a Subscription

Before you begin, make sure the client is installed and opens normally. You’ll also need a subscription URL from a provider that supports your Clash or mihomo core. The client reads the configuration and applies its proxy rules; installing the software does not provide proxy nodes. If you don’t have a subscription yet, ask your provider to confirm the URL format, account validity, and remaining data before proceeding. A subscription URL often contains account credentials, so protect it like a password. Don’t post it in public comments, screenshots, or online conversion tools.

Copy the Complete URL

Open your provider’s subscription management page, find an entry labeled Clash, Clash Meta, or mihomo, and use the page’s copy button. Don’t copy the account homepage URL from your browser’s address bar or use a node-sharing link in place of the full subscription URL. Check that no spaces, line breaks, or extra text from a chat app were copied with it. Keep all query parameters intact; deleting anything from the end of the URL can cause authentication to fail.

Next, open the client’s configuration page and choose “Add,” “Import,” or the plus-button option, then select something like “Import from URL.” Paste the link into the address field, give the profile a recognizable name such as “Daily subscription,” and click Download or Save. The name is only for local reference and won’t affect the connection. Once the import finishes, the new profile should appear in the list. Before enabling any other settings, check that the client didn’t report a download or parsing error.

Select the Imported Configuration

Some clients enable a profile as soon as it’s imported; others simply add it to the list. Select the profile and choose “Enable,” “Use,” or the equivalent to make it active. Then open the Proxies page and check that the provider’s proxy groups and nodes are listed. Group names depend on the subscription and might include “Proxy” or “Select Node.” They don’t have to match this guide exactly. Seeing the profile name without any proxy options doesn’t mean you’re ready to connect.

If the subscription download fails, first make sure your computer or phone can reach your provider’s website, then copy the URL again. A login page, regular webpage, or parsing error usually means the URL isn’t a subscription link, the subscription has expired, or the configuration uses fields unsupported by the current core. Toggling TUN won’t fix an import problem—the client hasn’t started capturing traffic yet. Check the specific error in the client and ask your provider whether they offer a format compatible with your core.

If you already have a local configuration file, choose “Import from file” and select the YAML file from your provider. File imports generally don’t receive remote subscription updates, so you may need to import the file again when nodes change. For your first setup, leave the configuration as is; don’t change the rules, ports, and DNS all at once. For more on YAML, subscriptions, and core compatibility, see the glossary. Once the configuration is enabled, move on to choosing how traffic is handled.

Step 2

Proxy Modes and Node Selection

Open the client’s Proxies or Settings page and find “Proxy Mode.” For your first setup, choose “Rule” so the configuration decides whether each request uses a proxy or connects directly. This setting controls how the core handles traffic; it doesn’t route system traffic into the client. You’ll still need to enable the system proxy or grant VPN permission in the next step before browser and app requests can reach the client.

Global mode doesn’t mean that every connection on your device is being captured. It only changes how requests that have already entered the core are routed. An app that doesn’t use the system proxy may still bypass the client. Direct mode doesn’t stop the core either: the client may still handle connections and resolve domains, but sends traffic directly. This distinction helps avoid assuming that games, terminal tools, and background services will all use a proxy just because “Global” is selected.

Choose an Available Node

Keep Rule mode selected and open the main proxy group in your configuration. If it has a manual node list, start with a node in the region you need that’s covered by your plan. If there’s an automatic selection group, you can use the provider’s preset. Different rules may use different proxy groups, so video, downloads, and the final matching rule may not share the same outbound route. For your first test, check the main proxy group and the group used by the matching rule; there’s no need to adjust every category right away.

Most clients have a latency test button. Its result shows how the current network reaches a specific test address through a node. Use it to spot nodes that may be unreachable, but don’t treat it as a measure of actual download speed. Test targets, network congestion, and node load all affect the result; a timeout may simply mean the test target is unavailable. Judge the result alongside a real website visit in the next step, rather than choosing the smallest number in the list.

Check the traffic multiplier and region shown in node names, too. Providers set the multiplier; a higher one may use up your plan’s data faster. The region usually describes the exit location, not the full route your connection takes. For the initial setup, choose a node in a commonly used region and verify that it works. If a service requires a specific region, set the relevant proxy group to use an appropriate node after verification. For more tips, see Proxy Node Latency, Multipliers, and Regions Compared.

Once you’ve chosen a node, note the current mode and the node used by the main proxy group. If something doesn’t work, change just one node or setting at a time and leave everything else alone. That makes it easier to tell whether the issue is a faulty node, an unsuitable rule, or traffic that isn’t reaching the client at all. Changing several settings at once makes the cause harder to identify.

Step 3

Connect and Grant System Permissions

Your configuration is enabled, and you’ve chosen a proxy mode and node. Now you can connect. First, check the client’s status: some desktop clients start the core when you open the app; others require you to click “Start” or “Connect.” If the core reports an error or stops running, resolve the configuration issue shown in the logs rather than relying on the system proxy toggle. The core handles requests, while the system proxy or VPN routes app traffic to it. Both need to work for the connection to succeed.

System Proxy on Windows and macOS

For your first desktop setup, enable “System Proxy” and leave TUN off for now. The client points the operating system’s proxy settings to a local listening port, so browsers and apps that follow those settings can access the network through the client. If the system asks for permission, make sure you’re approving the client you just installed, then follow the prompt. Don’t disable the firewall or widen local network access just to get connected.

Once it’s enabled, use your usual browser for the next verification step. Some apps have their own proxy settings, some command-line tools need environment variables, and others ignore the system proxy; none of this necessarily means the client is broken. If you only need a browser for everyday browsing, first make sure the system proxy works before trying to capture more traffic. If another VPN or proxy app is running on your computer, disconnect it and check for leftover proxy settings to prevent both apps from changing the same system setting.

VPN Permission on Android and iOS

When you tap Connect on a phone, the system usually asks to establish a VPN connection or add a VPN configuration. Check that the app name is correct and approve the request; iOS may also ask for your device passcode or another form of authentication. Here, VPN is the system’s way of routing traffic to the client. The actual route out is still determined by the nodes and rules in the client’s configuration—it doesn’t mean you’re using a proxy service provided by the operating system.

After granting permission, return to the client and check its connection status. You can also look for a VPN indicator in the status bar or VPN settings. That indicator confirms the VPN tunnel is established, not that the selected node can reach your target site. If Android frequently disconnects after the screen turns off, finish the basic verification first, then check battery optimization, background activity, and auto-start permissions. Settings vary by device brand; see Android VPN Permissions and Battery Settings. Don’t change every background permission during the initial connection, or it may be harder to tell a connection issue from a battery setting issue.

TUN and App Exceptions

TUN captures traffic through a virtual network interface and can help with apps that don’t follow the system proxy, but it may require administrator permissions, service components, routing, and DNS configuration. It’s not required for your first setup. Once the browser works, if a particular app still ignores the system proxy, follow the client’s instructions to install any required service and enable TUN. Follow your platform guide if you see a permissions or driver prompt, and don’t stack multiple network tools without a clear reason.

Some Windows apps may be affected by UWP loopback restrictions. If your browser works but a Store app doesn’t, first check how that app handles network traffic, then see the UWP loopback guide rather than adding every app to the exceptions list. For details on TUN, the system proxy, DNS, and loopback, see the glossary. Platform-specific settings are covered in the guides for all platforms. Once you’ve connected and granted permissions on your platform, verify the result with a real request.

Step 4

Verify Access and Finish Setup

Open a new browser tab and visit a site you expect to access through the proxy. A new request is more reliable than checking a page that was already open, which may be cached or using an existing connection. If the page loads, that’s a good first check—but confirm the route in the client’s connection records too. A site that works over a direct connection doesn’t prove that the proxy is working.

Check the Request, Rule, and Outbound Route

Return to the client’s “Connections,” “Activity,” or “Logs” page and find the domain you just visited. Check the matching rule, proxy group, and final node. Clients display different fields, but you should at least be able to tell whether the request was proxied or connected directly. If it’s missing, refresh the page and check that log filters aren’t hiding it. Short-lived connections may disappear from the activity list quickly; check the logs instead. Don’t leave verbose debug logging enabled just to find a request.

Next, visit a familiar site that should connect directly according to your configuration, and make sure local services still work. If the proxy destination loads but the direct site doesn’t, check the rules or DNS before replacing the subscription. An IP lookup site can provide a useful clue about the route used for that request, but it can’t prove that every app follows the same path. Multiple outbound routes are normal in Rule mode; what matters is whether each request follows the expected route.

Troubleshooting: Check in This Order

If the site won’t load, first check the configuration list to make sure the newly imported profile is active. Then check that the main proxy group has an available node selected—not Direct or a reject policy. Change just one node and retry the same site. If several nodes fail, check that the core is running, the system proxy or mobile VPN is enabled, and the app doesn’t have its own proxy settings. A successful import only means the configuration can be read; it doesn’t confirm that your plan, server, or current network is working.

If the target request doesn’t appear in the connection records, check how traffic reaches the client first: does the browser use the system proxy, has another tool overridden the proxy settings, and is the mobile VPN still connected? If the request reaches the client through the expected node but keeps timing out, check the node and the provider’s service status. For a parsing error in the logs, keep the exact error message and continue with the common configuration issues section of the platform guide. Don’t keep reinstalling the client before you know what’s causing the problem.

To check whether a rule is the problem, briefly switch to Global mode, select the same node explicitly, and visit the same site again. If Global works but Rule doesn’t, check which policy the domain matches in Rule mode. If both fail, investigate the node, DNS resolution, or network route. Switch back to Rule mode when you’re done testing. Changing one thing at a time gives you clearer results than changing DNS, ports, and proxy mode all at once.

Update Your Subscription and Set Up Startup

Once the connection is verified, set a subscription update schedule on the configuration page, or click Update manually when your provider changes its nodes. After updating, make sure the active configuration is still enabled, especially if you’ve imported more than one subscription. Don’t set updates to run too often; follow your provider’s recommendation. If an update fails, check your account and the URL’s validity first. Never send the full subscription URL, which may contain credentials, to someone you don’t know.

If you want the desktop client to start automatically, enable that option in Settings, then check whether “Start client,” “Start core,” and “Restore system proxy” are separate settings. Starting the app at login doesn’t necessarily restore the system proxy, so do a quick connection check after restarting. Before quitting the client, use its disconnect or exit option and confirm the system proxy has been restored. When you no longer need the mobile connection, disconnect in the client and check the system VPN status.

That’s the basic setup: the subscription is enabled, the mode and node are selected, system traffic is routed to the client, and a real request has been verified. If something goes wrong later, revisit these four steps in order. For platform installation, TUN permissions, DNS, or local network sharing, see the installation and setup guides for all platforms. If you just need to understand a setting, start with the glossary—there’s no need to redo the entire setup for one unfamiliar term.