Clash Quick Start: Import Subscription, Pick a Mode, Connect and Verify

Import the Subscription: Load Nodes Into Your Config Bin

A subscription link is a URL starting with https://, provided by your service on its backend, which resolves to a complete Clash config file. Copy the entire string — it often ends with a string of parameters, and missing even one character will break the import. There's no need to open it in a browser; hand it straight to the client.

On Android: open the client and go to the Profiles page (some clients place it in the bottom tab bar, others in a side drawer). Tap the "+" in the top right, choose "Import from URL" from the popup, paste the subscription link into the input box, and tap Save. The client starts downloading the config, usually within seconds; once it succeeds, a new config card appears in the list showing the config name and update time, and some providers also display remaining data and expiry date right on the card.

One last action is easy to miss: tap this card to set it as the active config. Selected state usually shows as a highlighted card, a checkmark, or a filled-in dot. Without selecting it, flipping the connect switch later won't have any nodes to use.

On desktop: using Clash Verge Rev as an example, go to the Profiles page on the left, paste the link into the input box at the top, tap Import, and once the download finishes, tap the newly added config card to activate it. Other desktop clients use slightly different names for this entry — look for "Profiles" or "Subscription."

Two common import errors: "Invalid format" or "Not a valid config" usually means the link is a generic sharing format rather than a direct Clash config link — go back to your provider's dashboard, switch the export format to Clash, and copy the link again; "Timeout" or "Network error" means you should retry on a different network. The differences between subscription formats and how to convert them are covered in more detail under Installation & Setup in the Help Center — no need to expand on that here.

Choose a Proxy Mode: Switch to "Rule"

With the config loaded, the next decision is how traffic should flow. Clash offers three modes, matching the three tags the robot holds on the homepage panel: Rule, Global, and Direct. Only one can be active at a time.

Rule mode is the everyday choice. It runs every connection against the routing rules in your config, line by line: traffic that matches a proxy rule goes through the node, traffic that matches a direct rule passes through untouched, and neither interferes with the other. This is the mode behind common setups like "keep local sites direct, route everything else through the proxy."

Global mode skips the rule table entirely and forces all traffic through the currently selected node, regardless of destination. It's mainly a diagnostic tool — if you suspect a rule is misrouting traffic, switch to Global and observe: if it works in Global, the rule is likely wrong; if it still doesn't work, the node itself is the problem. Switch back once you're done troubleshooting — leaving Global on wastes bandwidth and slows down local access.

Direct mode effectively bypasses the proxy, sending all traffic through the system's default path. It's mainly useful for a quick side-by-side comparison without the proxy.

Where to find it: on Android, look on the main screen or under Settings → Mode, and tap to cycle through the three options; in Clash Verge Rev, the three tabs sit side by side at the top of the Proxies page. All you need to confirm at this step is that the current mode is "Rule." How the rule table itself is written, how policy groups are arranged, and how rule sets are managed via subscriptions are advanced topics — they're covered chapter by chapter in the Advanced Setup guide, and you don't need them for your first setup.

Connect: Flip the Switch, Grant Permission, Pick a Node

Back on the client's main screen, find the large connect switch (some clients label it "Tap to Connect"). Tap it, and Android immediately shows a "Connection request" dialog — this is a system-level VPN permission prompt, since Clash needs a VPN tunnel to take over device traffic; tap "Allow"/"OK". Once granted, a key or VPN icon appears in the status bar — that icon is your physical proof the tunnel is up, and you can glance at it every time you connect afterward.

If you accidentally tapped Deny, there's no need to reinstall anything: flip the connect switch again and the prompt will reappear; if it still doesn't show up, check under Settings → Network → VPN on your device to see if the client's entry has been disabled.

The tunnel is up, but you still need an exit node. Go to the Proxies page — you'll see one or more policy groups listing all the nodes delivered by the subscription, each with an empty latency slot on the right. Tap the lightning bolt / latency test icon on the page, and the client will batch-test every node in the group; within a few seconds, the latency slots fill in with numbers in milliseconds (ms) — lower is faster, and anything under 200ms is usually fine for daily use; nodes showing "Timeout" or marked in red aren't usable right now, so skip them. Tap a node with lower latency to make it the current exit. More details on picking nodes and batch testing are covered under Usage Tips in the Help Center.

Desktop note: after connecting in Clash Verge Rev, also enable the "System Proxy" toggle in settings so system traffic routes through the local mixed port (default 7890) into the core; browsers don't need any extension, since the system proxy takes over directly. To also route apps that ignore the system proxy — virtual machines, game clients, and the like — you'll need TUN mode, which has its own chapter in Advanced Setup.

Verify It Works: Pick Any One of Three Methods

Flipping the switch on doesn't guarantee traffic is actually going through the proxy — the last step is getting proof. Three methods, from quick glance to hard evidence; pick one, or run through all three if you want to be thorough.

Method 1: Check the exit IP. Open any IP lookup page in a browser (search "IP address lookup" to find one) — the location shown should match your chosen node, not your real city. Switch to a node in a different region, refresh, and the IP and location shown should change accordingly — if the two results line up, the proxy is confirmed working.

Method 2: Check the logs. Open the client's Logs page, then visit a few sites. Connection entries will scroll through in real time, each showing the destination domain, the matched rule, and the exit (DIRECT or a node name). If overseas sites show a node name as the exit and local sites show DIRECT, rule-based routing is working correctly too.

Method 3: Check the traffic. Open the Connections or traffic stats page — upload/download rates should move as you browse, and active sessions should appear in the connection list. If the numbers stay flat, traffic isn't reaching the client at all.

If verification fails, check things in this order rather than jumping around: ① go back to the Proxies page and check whether the current node has timed out — switch to one with normal latency; ② confirm the mode isn't stuck on "Direct"; ③ the subscription may have expired — go back to STEP 01 and update the config card; ④ if none of that resolves it, take the error from the Logs page to the Troubleshooting section of the Help Center — common errors are covered there.