Configuration → Mode → Connect → Verify
Import a Clash subscription
and connect on your phone
Import a valid configuration, connect in rule mode, then check how the target app’s traffic is routed. These steps follow the usual first-time setup flow for users who already have the client installed and want to get the basics running in about ten minutes. Get this setup working first; there’s no need to change DNS, custom rules, or advanced routing yet.
Before You Start: Get the Client and Subscription URL Ready
Haven’t installed a client yet? Choose one for your device on the downloads page, then come back here. The client reads the configuration, applies routing rules, and establishes the connection; the subscription provides configuration details such as nodes and policy groups. Installing the client doesn’t automatically give you a working proxy route—check both separately.
Get a subscription URL from a source you trust and make sure it works with your client. A subscription URL is usually a long web address and may include private access credentials. Use the copy button on the source page to avoid missing characters at the end. Don’t use a plan description, account sign-in page, or individual website URL as a subscription. If several formats are available, choose one explicitly labeled for Clash or mihomo.
Make sure your phone has a working Wi-Fi or mobile data connection and that its date and time are correct. The client needs to reach the subscription server for the initial download. If the provider requires a particular network, follow its instructions first. You don’t need to send the URL to an online conversion service. If the format isn’t supported, check with the provider before trying to modify an unfamiliar URL.
Step 1: Import a Subscription and Enable the Configuration
Open the Configuration Page and Add a URL
Open the client and go to “Configuration” or “Subscription.” Look for a plus sign, “Add,” or “Import,” then choose “Import from URL.” Enter a recognizable local name, such as “Daily phone setup,” and paste the full subscription URL you copied. If there’s an automatic update interval, keep the default for now and first make sure the import succeeds.
After pasting, check the beginning and end of the URL. Make sure there’s no extra text, quotation mark, or line break. Some clients detect URLs from the clipboard; check that the detected address is correct. Don’t paste the subscription into “External Controller,” “Dashboard URL,” or a node password field. Those are for other purposes and won’t import a configuration.
Tap Save or Download and wait for the client to fetch and parse the configuration. When successful, a configuration card usually appears with its local name and an action menu; whether it shows an update time depends on the client. If you see a network timeout, access denied, or parsing error, stop here rather than trying to connect. For a timeout, check your network and whether the subscription URL is reachable. For access denied, check your subscription permissions. For a parsing error, check the format. See FAQ.
Select the Configuration and Check the Proxy Page
After importing, select the new configuration or choose “Enable” or “Set as active” from its menu. Some clients enable it automatically after saving; others only add it to the list. Look for a selection indicator or “Active configuration” label. Otherwise, you might import a new subscription but still be running an older configuration.
Next, open the “Proxy” or “Policy Groups” page. A policy group is a set of outbound options that rules can use. It may contain manually selected nodes, automatic selection, or a direct connection option. You should see the groups and options provided by the configuration. If the list is empty, return to the configuration page and confirm it’s enabled, then check the import status. Switching to global mode won’t fix a configuration that hasn’t loaded.
To get new or updated nodes from the provider later, open this configuration card and choose “Update subscription.” An update may replace the remote configuration, so don’t edit the downloaded rules file directly when you’re just getting started. If you need to keep personal settings long-term, see the configuration management section in the full documentation. Once you’ve confirmed the active configuration, choose a running mode.
Step 2: Choose a Rule Mode and Node
For Everyday Use, Start with Rule Mode
Go to the home or settings page and look for “Mode,” “Operating mode,” or a three-way mode switch. For your first connection, select “Rule.” It uses the configuration’s rules to choose an outbound route for each connection: traffic that should go direct uses a direct route, while proxied traffic goes through the relevant policy group. The results depend on the subscription’s rules; selecting rule mode doesn’t mean the client automatically knows what every app needs.
| Mode | How it works | When to use it |
|---|---|---|
| Rule | Chooses an outbound route for each connection using the configuration’s rules | A good starting point for your first connection and everyday use |
| Global | Uses the global policy for traffic routed to the client; system routing still determines which traffic gets intercepted | Use only when you need a single outbound route or want to troubleshoot by comparison |
| Direct | Connections handled by the core go directly to their destinations | Use when you want to pause proxy routing but keep the client running |
Global mode doesn’t mean all phone traffic is going through the client. It only controls how the core chooses an outbound route for traffic it receives. System routing determines whether an app’s traffic reaches the client—that’s what connection authorization covers in the next step. Likewise, switching to Direct doesn’t turn off the system VPN. To stop the client from routing traffic, use the disconnect control.
Choose a Candidate Node for the Manual Policy Group
Open the proxy page and expand the policy group used for everyday traffic. Group names are set by the configuration author, so it may not be called “Proxy.” Use the currently selected option and the provider’s instructions to identify it. If it’s a manual selection group, choose a candidate node and check that the selection indicator moves. If it’s an automatic selection group, you can leave it as is; there’s no need to set every group to the same node.
If there’s a “Latency test” or “Speed test” option, run it once and wait for the results. It usually measures the response time to a specific test address, not actual download speed, and doesn’t guarantee that your target service will work. If a candidate times out, try another responsive node. If they all time out, check the subscription and network first rather than repeatedly running tests and using up resources.
If you’re not sure what the group names mean, don’t select DIRECT or REJECT at random: the first means direct access, and the second blocks the connection. See the glossary for more terms. Once rule mode and the current node are set, leave both unchanged and move on to the system connection. That makes any issues easier to troubleshoot.
Step 3: Connect and Grant System Permission
Android: Allow the VPN Connection
Disconnect any other active VPN apps, then return to the Clash client’s home screen and tap Start. Android generally doesn’t allow regular apps to maintain multiple independent VPN connections at once. Other tools that use a local VPN can also conflict. There’s no need to uninstall them—just let this connection run on its own for now.
The first time you connect, Android displays a VPN connection request. Check that the app name in the prompt matches the client you installed, then tap Allow or OK. This permission uses Android’s VpnService API, which lets an app create a local VPN connection and route traffic through it. It doesn’t mean you’ve purchased a separate VPN service, and basic connectivity doesn’t require root access.
After granting permission, return to the client and check whether the home screen shows Running, Connected, or a Stop button. A key or VPN icon may appear in the status bar, depending on your device. If the connection stops right after you approve it, check the first clear error in the client log and make sure another VPN hasn’t started automatically. Don’t change the mode, DNS, and every node at once before you know what went wrong.
Some Android clients have a single connection switch and handle VPN routing automatically; others also offer TUN settings. TUN routes network traffic through a virtual network interface. For your first setup, use the client’s default mobile routing method. Don’t enable every related option in the advanced settings just because a desktop guide mentions TUN.
iOS: Allow the VPN Configuration
In your iOS client, check that the subscription is enabled, then tap Connect on the home screen. If iOS asks to add a VPN configuration, tap Allow and confirm using your device passcode or biometric authentication. Return to the client and wait for its status to update. Repeatedly tapping Connect won’t bypass the system prompt if authorization is still pending.
If you denied permission, check whether the prompt appears again when you reconnect. You can also search for “VPN” in Settings and check whether the configuration is present and allowed to connect. A VPN configuration isn’t the same as a device management profile; this guide doesn’t require installing profiles from unknown sources. If you don’t recognize an existing configuration, stop using it and check where it came from rather than deleting settings in bulk.
Desktop: Know the Difference Between System Proxy and TUN
If you’re following this guide on a computer, start the core after importing the configuration and choosing a node. Then enable “System Proxy” as described by your client. This directs apps that honor the system setting to a local proxy port; it won’t affect every app. Consider TUN only if the target app ignores the system proxy and you need broader traffic routing. TUN may require administrator privileges, a helper service, or system network extension permissions.
For your first setup, use one clear traffic-routing method and avoid leftover ports from older proxy tools conflicting with the new client. For OS-specific permissions and network settings, see the full cross-platform guide. The client is now connected, but don’t turn on background keep-alive or other advanced features yet. First, test real-world access.
Step 4: Verify Access and Check the Connection After Locking Your Phone
Test Real-World Requests—Don’t Rely on the Connection Icon
Keep the client connected, open your browser, and visit the target website in a new tab. Then try a website you normally access directly. Use new requests rather than relying on pages that have already loaded; cached content can still appear offline. You’ve confirmed the basics only when the target site loads and your usual direct-access sites still work.
Then open the client’s “Connections,” “Activity,” or log page and find the entries for those requests. If the client shows details, check the requested domain, matched rule, and final policy. The target request should use the expected proxy group, while everyday direct traffic should follow the configuration’s direct route. That tells you more than a “Connected” status on the home screen. Some clients require you to enable connection logging first; not seeing this option doesn’t necessarily mean the connection failed.
To check your outbound IP, you can also use a public IP lookup site you trust. In rule mode, the lookup site itself may use a direct route, so seeing your usual network’s IP doesn’t necessarily mean the proxy failed. First check which rule matched the lookup request. And don’t assume a browser result applies to every app: app-specific routing, bypass settings, and existing connections can all change the path.
Lock and Unlock Your Phone to Check Background Restrictions
After basic access works, lock your phone for a while, then unlock it and send the target request again. If the connection only drops while locked, check whether the client is still running and whether the system VPN is still active. On Android, allow background activity in the app’s battery settings. Set the client to unrestricted or turn off battery optimization, if available. Some manufacturers also have an auto-start setting; check your system’s instructions.
Don’t turn off every battery-saving feature on your phone. Change settings only for this client, then test before deciding whether to keep them. Android’s “Always-on VPN” and “Block connections without VPN” are separate system policies. The latter can block network access when the client is stopped, so there’s no need to enable it during initial setup. On iOS, first check that you haven’t manually ended the client’s connection and that another VPN isn’t taking over, then review the connection settings supported by the app.
If It Doesn’t Work, Troubleshoot in This Order
First, check the configuration page to make sure the imported subscription is active. Next, check that the manual policy group has a working node selected, then confirm that the system VPN or system proxy is enabled. Check DNS—the domain name resolution path—and whether the target app is excluded from routing last. Change one thing at a time and retry the request so you can tell what fixed it.
If rule mode fails but switching temporarily to global mode works, check which rule matches the target request and which policy group it uses; reinstalling the client shouldn’t be your first move. If every mode fails, check whether the node is reachable and whether system routing is enabled. For parsing errors, node timeouts, and permission issues, see the FAQ. For configuration fields or platform-specific details, read the full documentation.