Clash Client Setup Guide

Before you start, gather two things: an installed Clash client and a subscription link. If you haven't installed a client yet, head to the Downloads page and pick one for your OS — installers, hands-on reviews, and ratings for all five platforms are laid out there, so just grab the top pick without overthinking it. Installation works like any other software: on Windows, double-click the installer and click through; on macOS, open the dmg and drag the icon into "Applications"; on Android, if you see an "unknown source app" warning while installing the apk, just allow it on the settings screen that pops up; on iOS, grab it straight from the App Store; on Linux, pick the deb or rpm package for your distro.

Launch it once after installing to confirm the main window opens properly — desktop clients usually tuck themselves into the system tray or menu bar, and clicking that small icon brings the main window back up. Seeing an empty interface on first launch is normal since there's no configuration yet, so don't worry and start clicking around.

Your subscription link comes from your service provider: log into their user dashboard and find a button like "Subscription," "One-Click Subscription," or "Copy Subscription Link." What you copy is a long URL starting with https://. This link is your configuration source — the client pulls nodes and rules from it periodically, so don't share it publicly. If you're still not sure what a "subscription" actually is, the Subscriptions & Configuration section of the glossary covers it in full; for now, all you need is the link in hand to move to the next step.

Open the client and find the "Subscription" page in the sidebar or bottom bar (some clients call it "Profiles" or "Configuration"). You'll see an input box and buttons like "Import" or "Download." Paste the full subscription link you copied into the box and click import — the client immediately fetches the configuration over the network, and within a second or two a new profile card should appear on the page, usually showing a name, an update time, and sometimes traffic usage.

Once the card appears, click it once to make sure it's selected (highlighted or checked), then switch to the "Proxies" page. You should now see several proxy groups laid out — expand any group and you'll see a list of node names. Once this screen lights up, the import worked. If the Proxies page is still empty, go back to the Subscription page and check whether the profile card is actually selected — that's the step beginners miss most often.

If import fails or spins for a long time, check three things: first, whether the link was copied in full — long links often get truncated when copied from a webpage, so it's best to go back to the user dashboard and grab it again with the "Copy" button; second, whether your network connection is working at all, since fetching a subscription is just a regular network request; third, try again later, as provider servers occasionally have hiccups. If it keeps failing, most clients support "Import from File" — paste the subscription link into your browser's address bar to download a yaml file, then import that local file from the Subscription page instead, which works just as well. Finer-grained troubleshooting (what response codes mean, UA restrictions, etc.) is a more advanced topic covered in the Subscriptions chapter of the troubleshooting handbook, so we won't get into it here.

One quick thing while you're at it: check the profile card's menu for an "Auto Update" option, and turn it on if it's there. Node info changes as the provider adjusts things, and auto-update saves you the trouble of manually refreshing later.

Don't connect right away after importing the subscription — take a minute to decide how traffic should be handled. There's a mode switch on the home page or Proxies page, usually with three options: Rule, Global, and Direct. Their roles are straightforward: Rule mode automatically decides based on the routing rules in the config — proxying what should be proxied and connecting directly to what doesn't need it; Global mode shoves all traffic through the proxy no matter what; Direct mode is essentially a temporary way to turn the proxy off.

For everyday use, go with Rule mode — there's no real debate here. It keeps things fast (local sites aren't routed unnecessarily) without wasting bandwidth, and the rule set built into your subscription is good enough out of the box for most people. Only switch to Global temporarily when a specific app doesn't respect routing rules, and remember to switch back afterward — leaving Global on long-term is the top reason beginners see their internet slow down. If you want to understand exactly what rules match on (domain suffixes, IP ranges, GEOIP, and so on), the Rules & Routing section of the glossary breaks it down item by item, though it's not required for this step.

With the mode set, go back to "Proxies" to pick a node. Open a proxy group and find the latency test button (usually a lightning bolt or waveform icon) and click it — within a few seconds, each node will show a latency number in milliseconds: green under three digits gives the best experience, yellow is usable, and red or "timeout" should be skipped entirely. Click a low-latency node to select it — it'll be highlighted, and that's your pick made. If that feels like too much work, many subscriptions include an "Auto Select" group that tests periodically and automatically switches to the fastest node — pick that group once and forget about it.

One small detail worth noting: the latency number reflects how fast the handshake is, not exactly your download speed — but it's reliable enough as your first-pass criteria for picking a node. With a node selected, everything's ready, and the next step is to actually route your traffic through it.

After the first two steps, the client is "ready to proxy," but system traffic hasn't actually been handed over to it yet — this step turns on that main valve. The process varies slightly by platform, so find yours below:

• Windows / macOS: Find the "System Proxy" switch on the client's Settings page or home screen and turn it on. Once it lights up, the client automatically updates your system's proxy settings, and traffic from your browser and most apps starts routing through it. On macOS, the first time you enable this, the system may prompt for a password to authorize the change.
• Android: There's no "system proxy" switch on mobile — instead, there's a prominent start button on the main screen. Tapping it triggers a system prompt asking to allow the app to set up a VPN connection — this is Android's standard authorization flow. After tapping "OK," a small key icon appears in the status bar, indicating the tunnel is up.
• iOS: Similar to Android — tap the connect button in the app, and the first time it'll guide you through "Allow VPN Configuration" in system settings, verified with Face ID or your passcode. After that, connecting is just a single tap on the switch inside the app.
• Linux: Desktop clients also have a system proxy switch, but some desktop environments (especially Wayland sessions) don't always honor the automatic setting. If it doesn't work, go to Settings → Network → Proxy and manually enter 127.0.0.1 plus the client's listening port (commonly 7890 by default, but check your client's Settings page to confirm). Command-line setups follow a different path entirely, covered in full in the blog's Linux setup guide.

After flipping the switch, watch for changes on the client's main screen: most clients show a traffic graph starting to move, or "Connected" lighting up in the title bar. Seeing either signal means traffic is now flowing through. You may also have noticed a setting called TUN mode — it's a more thorough takeover than the system proxy, capable of catching stubborn apps that ignore system proxy settings, but it requires admin privileges and more configuration detail, so there's no need to touch it on your first run. Look it up in the glossary if you're curious.

For the final step, confirm everything's working with two checks. Check one: test in a browser. Visit a site that previously wouldn't load — if it loads successfully now, that's the most direct proof it's working. It's best to test in a new incognito window, so cached pages don't create a false impression of success. Check two: look for evidence in the client. Switch to the client's "Connections" or "Logs" page — new connection entries should scroll in as you browse, and the upload/download graph on the home screen should also start moving. Records plus traffic means data really is flowing through the client rather than bypassing it entirely.

If the page won't load, don't panic — work backward through the step closest to you, and you can usually pin it down in three checks:

1. Check the node first: go back to Proxies and re-test latency — if the currently selected node shows a timeout, switch to a green-latency node and retry right away. A single flaky node is the most common failure and accounts for most beginner issues.
2. Then check the switch: confirm the system proxy (or the connection switch on mobile) is actually turned on. Some security software or system updates quietly reset proxy settings — flipping the switch off and on again usually fixes it.
3. Finally check the mode: make sure it's not stuck on "Direct." If only a few sites won't load under Rule mode, try switching to "Global" temporarily as a test — if Global works, the rules simply didn't match, which is a configuration issue rather than a connection problem.