Clash Meta Tutorial
Import a Subscription and Verify Your Connection
Complete your first setup: import a subscription → choose a proxy mode → connect → verify. First confirm that one browser request works, then move on to TUN, DNS, and custom rules.
Before You Start: Client and Subscription
This tutorial covers a roughly 10-minute first-time setup. You’ll need a client already installed and a working subscription link or complete config file. A Clash client reads the config, applies its rules, and connects; installing it does not automatically provide a working proxy. Get your subscription from your service provider. If you only have an account sign-in page, look in the provider’s dashboard for a clearly labeled Clash or mihomo config option.
If another proxy app is running, disconnect it and restore your system proxy settings first to avoid two apps changing your network settings at once. Back up your existing config, and skip override scripts and custom DNS for now. Each step below includes a success check. If you don’t see it, fix that step before moving on; there’s no need to keep reinstalling the client. For questions about how things work, see Troubleshooting. If you’re seeing a specific error, go to Troubleshooting.
01 Import a Subscription and Activate the Config
Success check: A config is selected in the config list, and its proxy groups appear on the Proxy page.
Add a Remote Subscription
Open “Profiles” or “Subscriptions” in the client's sidebar or bottom navigation. Look for “New,” “Add Profile,” or a plus button. Choose the remote URL option, give the config a recognizable local name, and paste the full subscription link into the URL field. The name is just for identification on this device; it won’t affect how the connection works. Check that the URL, query parameters, and ending are intact. Don’t copy explanatory text or line breaks from a chat message along with the link.
Click Save, Import, or Download and wait for the request to finish. On success, you’ll usually see a profile entry, an update time, or config contents you can open. “Saved” alone doesn’t confirm the download succeeded: some clients save the link first and fetch the file afterward. Check the entry for errors, then click it or choose “Set as Current” or “Enable” so the core loads it.
Open the Proxy or Policy Groups page to check the result. If you see the group names from your subscription, the client has parsed the config. If the config list contains multiple files, a successful download may not automatically become the active profile; check the selected indicator. If the old groups are still showing, don’t add the same link again. First confirm that you switched to the right config.
Local Files and Subscription Formats
If you have a local .yaml or .yml file, choose “Import File” on the same page and open it with the system file picker, then activate it as above. A complete config usually includes proxies or proxy providers, proxy groups, and rules. A short text file containing only node parameters may not work on its own. Some links return only a node list and require the client's node subscription feature alongside a base config; they cannot replace a complete config file.
If the import fails with a format error, first check whether the config type from your service provider is supported by your client. A browser sign-in page, order page, or regular website URL is not a subscription link. A page that requires authentication may return HTML instead of YAML. Don’t submit a private subscription to an online converter just to fix a format issue. Subscription links often contain account credentials, so hide the full link and sensitive parameters in screenshots, logs, and support requests.
After your first successful import, don’t edit the body of the remote config directly. Many clients replace downloaded content the next time the subscription updates, which can erase your changes. If you need to preserve local changes later, look into the client's override or config merge features. For more, see Subscription and Config Troubleshooting. For now, keep the config that loaded successfully and move on to choosing a mode.
02 Choose a Proxy Mode and Policy Group
Success check: The mode is set to Rule, and the group used for proxy traffic has a working policy selected.
Start with Rule Mode
Return to the home screen or open “Settings → Proxy Mode,” then choose Rule, Global, or Direct. For a first setup, choose “Rule,” which corresponds to mode: rule in the core config. Connections are then matched against rules in order and sent to the relevant direct, reject, or proxy policy. Rule mode doesn’t send every request through the proxy; it follows the routing set up by the config author.
“Global” sends connections that enter the core through the global policy, which is useful for a brief comparison test. It does not automatically route every app through the core, and it does not replace the system proxy or TUN switch. “Direct” sends connections entering the core straight to their destination. Don’t use Direct as your default after selecting a proxy node; requests may still bypass it. It’s also not a good idea to leave Global on just for convenience and ignore whether the existing rules work.
Choose an Egress in the Proxy Group
Open the Proxy or Policy Groups page and expand the main selection group provided by your config. It may be named PROXY or something else, so don’t assume the tutorial’s group name will match. Find the group referenced by your rules, then select a node or an existing automatic selection group. A manual selection group typically uses type: select; an automatic selection group may use url-test to evaluate options based on its test settings.
Some configs use nested groups: a service group points to a region group, which then points to a specific node. In that case, selecting the outer group may not be enough; open the next level and confirm the final egress. If a policy chain for proxied traffic ends at DIRECT, the request will still connect directly. Group test results can help narrow down your options, but test destinations may differ from the sites you visit. A successful test doesn’t guarantee that every site will work.
If a group is empty, go back and check the subscription contents and provider download status. Don’t create a matching group just to hide missing entries. If options appear but all tests fail, check your device's network, system time, and subscription status, then follow the node timeout troubleshooting steps. Selecting a node only determines how requests that already entered the core are forwarded; it does not change your OS proxy settings. You still need to enable traffic capture in the next step.
03 Start the Core and Connect
Success check: The core is running, the desktop system proxy is enabled, or the mobile VPN is authorized and connected.
Desktop: Start with the System Proxy
Click Start or Connect on the client's home screen. If the core starts as soon as the client opens, check the status area for config load errors or port conflicts. Once it’s running, enable “System Proxy.” This usually points the OS's HTTP and HTTPS proxy settings to a local listening address. On Windows, check “Settings → Network & Internet → Proxy.” On macOS, check the proxy settings in the details for your current network service.
The address and port used by the system proxy must match the client's current listening settings. A common mixed port is 7890, but it isn’t universal; check “Settings → Ports” in the client or the active config. mixed-port accepts both HTTP and SOCKS proxy connections on the same port; it is not the remote node's server port. Don’t enter the remote server port in your local system proxy settings.
If your browser or an extension has its own proxy settings, switch it to use the system proxy to keep the test simple. Terminal apps may not use the system proxy and may need their own proxy settings or environment variables. So if your browser connects but the terminal goes direct, that doesn’t necessarily mean the client is broken. For the first test, use a browser that follows the system proxy; configure other apps after the basic connection works.
Mobile: Grant VPN Permission
Android and iOS clients usually have a Start or Connect button on the home screen. The first time you tap it, the OS will ask to allow a VPN connection or add a VPN configuration. Confirm the request comes from the client you installed, then grant permission. Return to the client and wait for the status to show Connected, then check the system's VPN settings. The VPN indicator means traffic capture is active; it doesn’t confirm that the remote proxy egress works. Verify that in the next step.
If per-app proxying is enabled in your Android client, check that your browser is included in the apps to route. “Proxy only selected apps” and “Bypass selected apps” mean opposite things, so don’t rely on whether an app name simply appears in the list. Another VPN service on the device may conflict with this connection; disconnect other services while testing. Troubleshoot background battery restrictions separately, after confirming that the first connection works.
When to Enable TUN
On desktop, test with the system proxy first; there’s no need to enable TUN at the same time. Use TUN only if you need to capture traffic from apps that ignore the system proxy or have a specific need such as UDP support. TUN often involves a virtual network interface, routes, and permissions. If it fails to start, check the service component and permissions instead of switching nodes repeatedly. For detailed setup and conflict handling, see TUN Mode Troubleshooting. Avoid changing the network stack and subscription config at the same time during your first setup.
04 Verify the Connection and Rule-Based Routing
Success check: New requests appear in the connection log, and the matched rules and policy chains behave as expected.
First, Check That Requests Reach the Client
Leave the client running, open a new browser page, and visit a destination that should use the proxy under your current config. Then return to the client's Connections or Active Connections page and search for the domain. Some requests finish quickly, so you may need to enable history or check the logs. Look at the destination domain, matched rule, and policy chain actually used. Don’t rely only on the home screen's running status to decide whether the proxy is working.
If the page loads but there’s no matching entry in the client, check whether the browser uses the system proxy and whether per-app rules exclude it. The page may also have loaded from cache; try making a fresh request on a new page. If the request reached the core but the policy chain shows DIRECT, check whether the matched rule was meant to connect directly before assuming node selection failed. Rules are evaluated in order, so an earlier match can override the one you expected.
Cross-Check the Routing Results
Next, visit a destination that should connect directly under your config and confirm the connection page shows a direct policy. This helps distinguish working rule-based routing from a setup that proxies everything globally. Then use a trusted IP lookup service to compare the egress details for a proxied request. A changed egress only confirms the route for that request; it doesn’t prove that every app is captured or replace dedicated DNS and IPv6 checks.
If a request matches a proxy group but the page won’t load, note the domain, rule, policy chain, and time, then try another available policy in the group without changing anything else. Change one variable at a time to tell whether the issue is with the node, the rule, or the traffic-capture method. For DNS resolution errors, certificate errors, or failures in just one app, use the Troubleshooting Guide to investigate by symptom. Don’t start by deleting the entire config or changing every DNS setting.
Save Your Setup and Disconnect Safely
Once the connection works, return to the subscription page and run one manual update. Check that the active config still loads and the main proxy group still has the intended selection. Set remote subscription updates according to your provider's guidance; there’s no need to refresh repeatedly. To add custom Clash rules, prefer the client's override feature. Read Config and Usage Tips first to avoid losing local changes on the next update.
Use Rule mode day to day and switch modes only for troubleshooting. Before quitting the desktop client, turn off the system proxy or confirm the client restores your system settings automatically. On mobile, use the Disconnect button to end the VPN. If your browser can’t connect after you close the client, first check for a leftover local proxy address rather than blaming the subscription. Next time, review the active config, proxy group, and traffic-capture switch in that order.