10-Minute Basic Setup
This workflow is for anyone opening a Clash GUI client for the first time. Import a subscription, choose a proxy mode, establish a connection, and verify the result in order—no need to understand the entire YAML file first.
Check Before You Start
Get the essentials ready before opening the client. This avoids switching between pages repeatedly or mistaking a subscription issue for a client problem.
Desktop users should choose a graphical client that is still maintained; mobile users should use the download section for their operating system. After installation, launch it once and confirm that pages such as Configuration, Proxy, Connection, or Settings are available. If the system asks for network, VPN, or administrator access, review why it is needed and grant it when a later step requires it.
A subscription URL is usually generated by a network service provider and is not part of the client installer. Copy the complete link without dropping trailing parameters, and never post it on a public page. If the provider offers a one-click import button, use it when possible; for manual import, make sure you copied the subscription link rather than the website login URL.
Whenever possible, let only one proxy client handle system traffic at a time. An older client, browser proxy extension, another VPN tool, or a manually configured fixed proxy port can make verification confusing. After completing this guide, decide whether to keep other tools based on your needs.
Step 1 · Profiles
After opening the client, go to the “Configuration,” “Subscription,” or “Profiles” page. This is where profiles are stored and where you later update nodes, policy groups, and rules. Find “Add subscription,” “New profile,” or the plus button, choose import from URL, and paste the copied subscription URL into the field. Use the provider name or purpose as the profile name, such as “Daily network,” so multiple profiles are easy to distinguish.
After confirming that the URL is complete, click “Save,” “Import,” or “Download.” The client will fetch the remote configuration and show a new profile when successful. Normally, the entry includes a name, update time, and update button; some clients also activate it immediately. If it appears but is not selected, click it once more to make it the active profile.
Active profile
Fetch proxies and rules again
Next, run “Update profile” once manually. This matters because saving only confirms that the client accepted the URL; it does not guarantee that the remote content was fully read. After a successful update, open the “Proxy” page and look for policy groups such as Auto, Node selection, or DIRECT. Names depend on the subscription and vary by provider. Once the proxy page is no longer empty and shows selectable policy groups, continue to step two.
If the update reports a network error, timeout, or configuration parse failure, return to the subscription field and check for extra spaces, line breaks, or missing characters. Then confirm that the system time is correct and the current network can reach the subscription service. Do not click update repeatedly in quick succession, as this may trigger temporary access limits from the provider. If it still fails, see installation and configuration issues for common subscription update problems; deeper issues such as YAML structure errors are covered in the configuration reference.
The profile is selected, the latest update succeeded, and the proxy page shows at least one policy group.
Step 2 · Proxies
After the subscription imports successfully, open the “Proxy” or “Proxies” page. The top of the page usually offers “Rule,” “Global,” and “Direct” modes. For a first setup, choose “Rule.” Rule mode uses the configuration’s rules to decide whether each request should use a proxy, connect directly, or go through a policy group. It covers common use cases and makes each request’s handling easier to inspect in the connection log.
“Global” sends most traffic through one proxy policy and can help briefly test whether rules are matching, but it is not recommended as a long-term choice before you understand the configuration. “Direct” bypasses the proxy and can temporarily restore ordinary network access. Learn more about the three modes in rules and policy terminology; for this setup, simply keep Rule mode enabled.
The configuration rules decide where requests go, making this the best everyday default.
After choosing the mode, scroll down to the policy groups. Common names include “Node selection,” “Proxy,” “Auto,” or a custom label. Open the main policy group to see options such as Auto, DIRECT, and individual nodes. For a first setup, choose “Auto”; if the provider does not offer an automatic policy, choose a node marked available. You are selecting the policy group’s current choice, not editing every policy group individually.
Do not judge connection quality by node names alone. Client speed tests depend on the test endpoint, current network, and node load, so short-term results can fluctuate. At this stage, the goal is to confirm that the configuration path works; selecting one node that connects normally is enough. If a website later opens but a particular app does not, use the connection log to determine whether the cause is rules, DNS, or traffic capture scope.
After making your selection, stay in the client and confirm that Rule mode remains selected and the main policy group shows the option you just chose. The client now knows how traffic should be handled, but the operating system may not yet be sending traffic to it. The next step is to enable system proxy or TUN mode.
The top mode is “Rule,” the main policy group uses Auto or an available node, and no obvious configuration error is shown.
Step 3 · Connection
Return to the client’s home or settings page and find the “System Proxy” switch. On Windows and macOS, enabling it points the system proxy to the local port used by the running client. Most browsers and desktop apps that follow system network settings will use it immediately. For a first connection, start with system proxy: the path is straightforward, permissions are limited, and recovery is easier if something goes wrong.
Do not quit the client after enabling the switch. The GUI and proxy core must keep running so the local port configured for system proxy has a process to handle traffic. If the client offers options such as “Allow LAN,” “Launch at startup,” or “Start silently,” leave their defaults for now. They are not needed for this basic check.
Best for browsers and apps that read system proxy settings. It is easy to enable and disable, making it the preferred first choice on desktop.
Use the client’s local proxy port
Uses a virtual network interface to capture a wider range of IP traffic. It is useful for apps that ignore system proxy settings, some command-line tools, and certain gaming environments.
May require administrator or VPN permission
If the target app still does not appear in the connection log after system proxy is enabled, it may ignore system proxy settings. Consider TUN mode instead. Open Settings, enable “TUN mode,” and follow the operating system prompts to grant administrator or VPN access or install the virtual network component. These prompts are normal when the system creates a virtual network interface; without permission, TUN usually cannot start.
Depending on the client, system proxy and TUN mode may be used separately or enabled together. For a first setup, avoid switching back and forth repeatedly: verify the subscription and policies with system proxy first, then disable the test page, enable TUN, and test again only if the target program cannot be captured. This clearly separates an unusable configuration from insufficient traffic coverage.
Android and iOS clients usually connect through the system VPN interface. After tapping the start button on the home screen, the system asks you to confirm the VPN configuration. Allow it, and a VPN indicator should appear in the status bar while the client shows a running state. Mobile interfaces may not use the words “System Proxy,” but the purpose is the same: route device traffic through the client. Linux desktop support for system proxy varies; if an app ignores desktop proxy settings, use TUN as documented by the client. Server and router deployments are outside this guide; see the configuration reference.
The client is running, system proxy is enabled on desktop or VPN permission has been granted on mobile, and the interface shows no proxy-core startup failure.
Step 4 · Verify
After enabling the connection, open a new browser window or tab and visit a website that normally requires a proxy. Use a new page rather than refreshing an old cached page. A page loading is only the first check; return to the client’s “Connection” or “Logs” page and confirm that the domain used the expected policy.
Find the domain you just visited in the connection list. A normal entry may show the destination domain, connection status, matched rule, or policy group. Fields vary by client, but if the request appears and its policy is not unexpectedly DIRECT, system traffic has reached the client and Rule mode has processed it. Then open one or two ordinary websites to make sure direct browsing still works normally.
The basic configuration is working. Continue testing the browsers and apps you use regularly to confirm they behave as expected.
Traffic has reached the client. Focus on the selected node, policy group, DNS, and matched rule.
System proxy may not be active, TUN may not have started, the app may bypass the proxy, or another tool may have changed the network settings.
If the page does not load but connection entries keep appearing, return to the proxy page, switch to another node in the main policy group, and try again. If several nodes fail, update the subscription and check for configuration or DNS errors. Do not immediately change many advanced fields; first confirm the service status, subscription validity, and network stability. Leave the log level at the default “information” or “info,” which is usually enough for basic troubleshooting.
If the page does not load and no new connection entries appear at all, the problem is more likely traffic capture. On desktop, turn system proxy off and on again and confirm that the operating system points to the current client. On mobile, confirm that the system VPN indicator remains present. With TUN, check that the virtual network interface started successfully. A browser proxy extension configured with its own port may also bypass system settings; disable it temporarily and test again.
Another possibility is that the page loads but the request actually used DIRECT. The request reached the client, but the rules classified it as direct. Confirm that the current mode is “Rule,” not “Direct,” and inspect the matched rule name. Rule priority, domain matching, and custom rule syntax are advanced topics; after the basic connection is stable, read the rule syntax chapter in the configuration reference instead of changing several settings at once.
After setup
Once the basic connection is stable, add features such as automatic updates, startup launch, and TUN one at a time. Changing only one setting per test makes the source of any problem easier to identify.
Subscriptions may change their nodes, policies, and rules. If the client supports automatic updates, use the interval recommended by the provider; update manually when nodes become unavailable or the configuration changes. After updating, check that the current policy group selection still meets your needs.
System proxy is usually enough for browsers and standard desktop apps. Enable TUN only when a program clearly ignores system proxy settings. For differences in traffic layers, permissions, and troubleshooting, read TUN Mode vs. System Proxy.
Before trying custom rules or overrides, keep a copy of the profile that currently connects normally. If a change causes a parse error or unexpected rule behavior, you can quickly switch back instead of starting over with a subscription import.
When a problem occurs, note the time, destination domain, current mode, and error message, then check in this order: subscription, policy, traffic capture, and logs. Look up common symptoms in the FAQ and terminology in the glossary.
The basic setup is complete. DNS, rule syntax, policy group fields, overrides, and merges are covered together in the configuration reference for problem-focused reading.