Before You Start: Get the Client and Subscription URL Ready
First, connect to a working Wi-Fi or mobile network and disconnect any other active VPN. Then open the Clash client. If your network requires sign-in, as hotel and public Wi-Fi often do, complete the login in a browser first. A proxy profile cannot replace network authentication. Repeatedly refreshing a subscription before signing in will usually just result in a failed download.
Next, get the Clash-compatible URL from your subscription provider. The URL lets the client download a configuration file, which usually contains proxy nodes, proxy groups and routing rules. The client reads and applies this configuration; installing it does not give you access to a working proxy by itself. Your provider’s account, payment and subscription pages are separate. Before copying a URL, confirm that the page says it supports Clash or mihomo.
A subscription URL may contain account-specific information. Paste it only into the client you use—never share the full URL in public screenshots, group chats or support requests. If you have a YAML configuration file instead, choose Import from file; the steps for mode, connection and verification stay the same. For format and compatibility details, see the configuration file glossary. You don’t need to edit the file for your first connection.
1 · Import a Subscription and Select the Profile
Open the client’s Profiles page and tap Add. Some clients put this option under a plus sign in the upper-right corner; others show Add Profile directly. Choose Import from URL or Remote Profile. Enter a recognizable name, such as Everyday, then paste the full subscription URL. The name is only for identifying the profile on your device; it doesn’t change the subscription.
Before saving, check the beginning and end of the URL. Make sure you haven’t copied any explanatory text or added a line break or space. Tap Save, Download or Import, then wait for the client to fetch the file. When it succeeds, the profile usually appears in the list with an update time or other details. Providers show different information, so a missing traffic allowance field doesn’t mean the import failed.
Once the profile appears in the list, select it to make it active. Some clients show a check mark; others display the active profile name on the home screen. Check the interface you have, then open the Proxy page and make sure proxy groups and selectable options are visible. You’re not testing every node yet—just confirming that the profile has loaded and the client isn’t showing an empty screen.
If the download fails, first check whether you can reach your subscription provider over your regular network, then confirm that the URL is still valid. For a parsing error, make sure you copied a Clash-compatible subscription. A web page or a configuration for another client may not work as a Clash profile. Don’t submit a URL containing account details to an unknown conversion site. If you already have a usable local file, return to the Profiles page, choose Import from file, grant access to the file and select it.
After the first download, there’s no need to turn on every automatic update option right away. Complete the connection test first. Once the profile works, open its details and set an update interval if needed. After a manual update, wait for it to finish and make sure the profile is still selected. Node or group names may change, so you may need to review your selection. For failed updates and subscription issues, see common installation and profile questions.
2 · Select Rule Mode and Check the Proxy Group
Once the profile has loaded, return to the home or settings screen and find the mode option. For your first setup, choose Rule. In Rule mode, the client uses the profile’s rules to decide whether each connection goes through a proxy or connects directly. It’s a good choice for everyday use and makes it easier to check how different sites are handled. After selecting it, confirm the interface shows Rule or Rules; opening the menu alone may not save your choice.
Global mode usually sends traffic through the profile’s global proxy group. Direct mode usually bypasses proxy nodes. These modes can help with specific tasks or comparisons, but you don’t need to cycle through them for your first connection. In particular, Direct isn’t the recommended default: the service can show as running, but Direct mode won’t provide the proxy access you expect.
Next, open the Proxy or Proxy Groups page. A proxy group is a set of outbound options defined in the profile. It may contain individual nodes, an automatic selection group, other groups or DIRECT. Find the main proxy selection group. Common names include Proxy, Select Proxy and Node Selection, but names are set by the profile author, so don’t rely on one exact label. If your provider supplies setup instructions, use them to find the group referenced by the rules.
In that group, select an available node or an automatic selection group supplied by the profile. Automatic selection usually relies on health checks configured in the profile; it doesn’t mean the client will create a strategy for any subscription. If the group is set to DIRECT and you want matching traffic to use a proxy, choose a node instead. The group selection affects a connection only when a rule sends that connection to the group.
You don’t need to enable TUN yet. TUN is one way to capture traffic; it isn’t a routing mode on the same level as Rule, Global or Direct. Android clients usually receive device traffic through the system VPN interface. Keep the default traffic handling for now, and avoid changing the mode, DNS and traffic capture settings all at once. For background, see the explanations of Rule and TUN. Save custom rules for the beginner-to-advanced guide.
3 · Start the Connection and Grant VPN Permission
Once you’ve checked the active profile and proxy group, return to the client’s home screen and tap Start, Connect or the service toggle. On the first Android connection, the system usually shows a VPN connection request explaining that the app will set up a VPN. Make sure it’s from the client you just installed, then tap Allow or OK. If you tapped Cancel, return to the home screen and try again. Reimporting the subscription won’t grant system permission.
This uses VpnService, Android’s mechanism for letting apps create a local VPN interface. It allows the client to receive device network traffic and route it according to the profile. Seeing a VPN icon only confirms that the interface has been established; it doesn’t guarantee a connection to a remote node or mean every app’s traffic is included. Wait until the client’s home screen says the service is running, then continue to the connection test.
If the service stops immediately after you start it, check whether another VPN, firewall or network filtering app that uses the device’s VPN is still running. These apps typically compete for the system VPN connection within the same user profile. Stop the other service and try again; don’t keep toggling both apps on and off. If it still fails, check the client log for startup errors and save the details. Hide your subscription URL and account information before sharing them.
Once the connection is stable, long-press the client icon on your Android home screen, open App info, then find Battery or App battery usage. If your system offers options such as Unrestricted or Allow background activity, allow the client to run in the background. Some manufacturers have separate Autostart or Background management settings; look for the names used on your device. This helps prevent interruptions when the screen is locked—you don’t need to disable every battery-saving feature on your device.
On Windows, macOS or Linux, graphical clients usually also require the system proxy to be enabled after the core starts. This lets browsers and other apps that follow system settings use the proxy. Command-line tools don’t always use the system proxy, so a failed terminal request alone doesn’t mean the whole setup is broken. Desktop TUN may require extra permissions. For your first setup, test in a browser using the system proxy; see the complete guide for how traffic handling differs between desktop and Android.
4 · Test Your Connection and Routing Rules
Keep the service running. First open a site that normally works for you, then open one that should use the proxy according to your subscription’s rules. Don’t just refresh a page that has already loaded—open a new tab and visit a specific page to confirm its text or images load again. Testing both types of site helps distinguish a basic network problem from a proxy routing issue, and tells you more than the status bar icon alone.
Next, open the client’s connection history or log and look for the domains you just visited. Clients that show connection details usually include the matched rule, proxy group and final outbound route. A site that matches a direct-connection rule may correctly show DIRECT. For a site that should use the proxy, check that it went through the expected group and node. Details vary by client; if a field isn’t shown, use the actual access result as your guide rather than expecting every interface to match.
A successful node test doesn’t mean every website will load. The test may use a different destination from the site you’re visiting, and web pages can load resources from multiple domains. Apps may also have their own network settings. An IP lookup can provide extra context, but in Rule mode the lookup site may connect directly, so seeing your local IP doesn’t by itself prove the proxy is broken. Check the rule and outbound route for that request as well.
If neither test site opens, stop the proxy service and retry a site that normally works. If it still fails, troubleshoot Wi-Fi, mobile data or network sign-in first. If access returns when the service is stopped, go back to the client and check that the right profile is selected, the correct proxy group is chosen and the service stays running. Change one setting at a time and revisit the same test page so you can tell what fixed the problem.
If regular sites work but sites that should use the proxy don’t, return to the proxy group, select another available node and repeat the test. If it still fails, check the logs for specific errors such as connection timeouts, DNS resolution failures or configuration errors. Don’t delete every profile or copy DNS settings from an arbitrary online post. DNS failures and node timeouts are different issues. For more help, see common troubleshooting questions and work through the checks for your error.
Finish with a quick check of everyday use: lock the screen for a moment, unlock it and reopen the test page. Then switch from Wi-Fi to mobile data, wait for the network to reconnect and try again. If the connection drops only when the screen is locked, revisit the background restrictions in step three. If it fails only on one network, keep that network in place while troubleshooting. A brief reconnection after switching networks is normal; wait until the underlying network is available before checking whether the service recovers.
For future subscription updates, follow the same checks: confirm the profile loads, review the proxy group, check that the service is running and test a real connection. For custom rules, DNS changes or desktop TUN, continue with the complete beginner-to-advanced guide. Keeping a verified working profile makes it easier to return to a known-good setup if an advanced change causes problems.