Clash Setup Guide: From Subscription Import to Verified Connection

Start by copying the full subscription link from your provider's dashboard. Use the "copy" button rather than selecting the text manually — links often end with a token parameter, and missing even one character will make the server return a 404, which the client will only report as "download failed" with no further detail.

1. Clash Verge Rev (Windows / macOS / Linux)

   Open the client and click "Profiles" in the left sidebar to reach the profile management page. There's an input field at the top — paste the subscription link into it and click the "Import" button next to it. The client downloads the content immediately, and within seconds a card named after the subscription appears below, showing data usage and last-update time. Click that card so its border is highlighted — that marks it as the active profile. Skipping this step is a common reason the node list stays empty after importing.

2. Clash Plus (Windows / macOS / iOS / Android)

   Go to the "Profiles" tab (at the bottom or in the sidebar), tap the "+" in the top right, choose "Download from URL" in the dialog, paste the link, and confirm. Once downloaded, the new profile appears in the list — tap the radio marker next to it to enable it. On iOS, the first time you enable a profile, the system prompts an "Add VPN Configuration" authorization request — tap "Allow" and confirm once with your passcode or Face ID; this is a standard iOS requirement for any proxy-type app.

3. FlClash (Windows / macOS / Linux / Android)

   Switch to the "Profiles" tab, tap the round "+" button in the bottom right, choose the "URL" option, paste the link, and save. FlClash shows a download progress indicator and automatically sets the new profile as active once it finishes — no extra tap needed.

4. Clash Meta for Android / ClashX Meta (macOS)

   Clash Meta for Android: from the main screen tap "Profiles" → "+" in the top right → "Import from URL," paste the link, tap the save icon, then select the profile in the list to check it. ClashX Meta: click the cat-shaped icon in the macOS menu bar → "Config" → "Remote Config" → "Manage" → "Add," paste the link and confirm, then check it in the "Config" submenu.

The success criteria are the same across clients: a new entry appears in the profile list, and the "Proxies" page shows a long list of node groups and node names. To inspect the profile's raw content, open it with the client's "edit" feature — a normal Clash profile starts out looking roughly like this:

mixed-port: 7890
mode: rule
log-level: info

proxies:
  - name: "HK-01"
    type: ss
    server: example-server.net
    port: 8443

Clash has three running modes, which decide "what traffic goes through the proxy and what connects directly." Where to switch: Clash Verge Rev has three tabs at the top of the "Proxies" page in the left sidebar; Clash Plus and FlClash have a mode selector on the main screen; ClashX Meta has it under the menu-bar icon → "Outbound Mode"; Clash Meta for Android has a switcher at the top after tapping the "Proxies" card on the main screen. Here's what each mode does:

Mode corresponds to the mode field in the profile — toggling it in the interface is equivalent to editing this line directly:

mode: rule   # options: rule / global / direct

Once mode is set to "rule," this step is done. How rules are actually written, and what rule types like GEOIP and MATCH each match, is more advanced material this page won't cover — the rule syntax chapter of the YAML reference breaks it down line by line. Some clients also offer a TUN mode toggle; it isn't a fourth running mode but a different way of intercepting traffic, and you don't need to touch it for a first-time setup — see Concepts for the definition.

After importing the subscription and picking a mode, Clash is already listening locally on 127.0.0.1:7890 — but system traffic hasn't been handed to it yet. This is the most common reason for "everything's configured but it's still going direct." You need to turn on the system proxy switch:

1. Desktop: turn on the system proxy switch

   In Clash Verge Rev, go to the "Settings" page in the left sidebar and turn on "System Proxy"; in Clash Plus and FlClash, the switch sits in a prominent spot on the main screen. Once enabled, the client points the system's HTTP/HTTPS proxy settings at the local listening port. To confirm it took effect: on Windows, open "Settings → Network & Internet → Proxy" and you should see manual proxy enabled with address 127.0.0.1 and port 7890; on macOS, check "System Settings → Network → Details → Proxies" for the same entry. In ClashX Meta, click the menu-bar icon and check "Set as System Proxy" — the first time, it will ask to install a helper tool and prompt for your system password once.

2. Android / iOS: start the VPN tunnel

   Mobile clients don't have a "system proxy" switch — they take over traffic through the system's VPN interface instead. Both Clash Meta for Android and the Android version of Clash Plus have a prominent start button on the main screen; the first time, a "Connection request" system dialog appears — tap "OK," and a key-shaped icon in the status bar confirms the takeover succeeded. Clash Plus on iOS works the same way: once the toggle is on, the VPN status in "Settings" shows as connected.

3. Select a node

   Go back to the "Proxies" page and expand the default node group (usually named something like "Proxy Select" or similar). Tap the lightning bolt or speed-test icon in the group's top-right corner to run a latency test; once the numbers turn green, select a node with latency under 300 ms. In rule mode, the selected node only carries traffic that matches proxy rules — traffic inside mainland China is unaffected. What the latency numbers mean and their limitations is covered separately in the tips section of the FAQ.

The most direct check: open a browser and visit a site outside China that normally fails to load directly. If it loads fine, the whole "system proxy → Clash → node" chain is working end to end. To rule out caching, try a private/incognito window or force a hard refresh.

A second confirmation: go back to the client's "Connections" page — in the left sidebar for Clash Verge Rev and FlClash, or in a card on the main screen for Clash Meta for Android. Keep that page open, switch back to the browser and open a few pages, and the connection list should scroll with new entries in real time, each showing the destination domain, the matched rule, and the outbound route. If entries for sites outside China show the node name you just selected at the end, routing is working as expected; if every entry shows DIRECT, the system proxy isn't actually engaged — go back and recheck the switch in Step 3.

If you're comfortable with the command line, you can also send a request from a terminal with the local proxy port explicitly specified, so the check doesn't depend on the browser's own proxy behavior:

curl -x http://127.0.0.1:7890 -I https://www.google.com

An HTTP/2 200 response, or any 3xx status, means success. A Connection refused error means Clash isn't listening on that port (check whether the client is running and whether the port was changed). A timeout after a long wait usually means the current node is down — go back to the proxies page and try another one.

If verification fails: switch to "global mode" and try again first — if it works in global mode, the issue is in the rules; if it still doesn't, the issue is with the node or the connection chain. Next, check whether your system clock is accurate (an offset of more than a minute causes widespread handshake failures), whether the subscription has expired, and whether a firewall is blocking the client. A more complete troubleshooting tree is available in the FAQ's troubleshooting category, and browser certificate errors specifically are covered in a dedicated technical note.