Before you start, have two things ready: a client that’s installed and opens normally, and a subscription URL from your provider that’s compatible with that client. The client reads the configuration and handles connections; the subscription provides nodes, proxy groups, and rules. Installing the client alone doesn’t give you a working proxy exit. This guide doesn’t provide subscriptions or require you to change advanced settings. Haven’t chosen a client yet? Pick one for your operating system in the download center, then come back here.
For your first setup, run only one proxy tool and leave your existing network settings as they are. If you’ve installed other tools, quit them first and check that your regular internet connection works. Each step below has a clear check: move on only when the current step succeeds. If you hit an error, stop there rather than changing the mode, DNS, and ports all at once and losing track of the cause.
Step 1: Import and Enable a Subscription
Open the client and look for “Subscription,” “Configuration,” or “Profiles” in the sidebar or bottom navigation. Then find “Add,” “New,” or “Import from URL.” If asked to choose between a local file and a remote URL, choose the remote option if you have a subscription URL. Use local import only if you already have a configuration file. Don’t use your provider’s account page URL as the subscription URL: both may open in a browser, but they return different content.
Paste the full subscription URL, give it a name you’ll recognize, then click Save or Import. The name is only for identifying it on your device—for example, “Everyday setup”—and doesn’t affect the nodes. Check for extra spaces, line breaks, or missing characters at either end of the URL. Subscription URLs may contain personal access credentials, so don’t post the full URL in public forums or include it in public screenshots. When asking for help, describe the error and redact any sensitive parts of the URL.
After saving, wait for the client to finish downloading. You should see the new entry in the configuration list, with its proxy groups and nodes on the Proxies or Proxy Groups page. Some clients enable an imported configuration automatically; others require you to click its card, select its radio button, or choose “Use this configuration.” Make sure the new entry is marked as active. A subscription appearing in the list doesn’t mean the core is using it.
Tell Download Errors from Parsing Errors
If you see a timeout, connection failure, or HTTP error, first check your regular internet connection and make sure the subscription URL is valid. Sign in to your provider’s account page to confirm the subscription hasn’t expired, then copy it again from the correct subscription link. If the client offers “Update via direct connection” or an update proxy option, try a direct connection for the initial setup. A proxy connection that hasn’t been established yet isn’t a reliable way to update the subscription. If you can’t reach the subscription server, resolve that first instead of repeatedly switching nodes.
If the file downloads but you see a YAML parsing error, an unsupported field, or an unknown proxy type, the issue is more likely to be the format or core compatibility. Check the field names near the error and confirm the subscription is intended for Clash or mihomo; the file extension alone isn’t enough to tell. Web page content, links intended for another client, and incomplete files may not load directly. For an overview of how configurations, nodes, and subscriptions fit together, see the quick glossary. There’s no need to rewrite the entire file by hand at this stage.
Step complete when: The configuration is active, its nodes and proxy groups are displayed, and the client isn’t reporting ongoing load errors. Keep the default auto-update schedule for now, and don’t rush to edit the online configuration—future subscription updates may overwrite manual changes. Once these checks pass, choose how to route traffic.
Step 2: Choose Rule Mode and a Node
Return to the client’s home or settings page and find “Proxy Mode” or “Operation Mode.” For your first setup, select Rule mode. It uses the configuration’s rules to decide whether a connection goes direct or through a proxy group, letting you test the proxy while keeping normal local access. Different clients may show “Rule,” “Global,” and “Direct”—these mean Rule, Global, and Direct modes. Select Rule for now; don’t confuse the system proxy toggle with the mode selector.
The three modes determine how connections are handled. Rule mode follows the rule list. Global mode usually sends connections handled by the core to the global proxy group, though that group may still be set to Direct. Direct mode usually connects without a proxy. The mode doesn’t determine whether every app’s traffic reaches the core, so choosing Global won’t replace the system proxy or VPN permission. Keeping these two layers separate makes troubleshooting much easier.
Next, open “Proxies” or “Proxy Groups.” You may see several groups, including a general-purpose exit group and groups for specific uses. Find the main exit group specified by your subscription provider, expand it, and choose a node. If the provider hasn’t specified one, check the available nodes and connection logs to see which group the rules actually use. Changing a node in an unused group won’t change the exit for your actual connections.
Latency Tests Help You Narrow It Down, Not Measure Speed
Click the test button beside the group or node, then wait for the result. The number usually reflects the round-trip time to a specific test address; it isn’t a download speed measurement and doesn’t guarantee access to every website. For now, choose a node that completes the test and has a stable status. There’s no need to chase the lowest number. If every node times out, check that the configuration is valid, your system clock is correct, and your local network is working, then review the logs. If only one node times out, try another.
If your subscription includes an “Auto Select” group, you can use it to start with, but expand it to see which node is currently selected. An automatic group picks from its candidates based on its own test target and schedule; it can’t account for every app’s needs. With a manual group, you choose the node yourself. Don’t delete groups you don’t recognize or set every group to the same node. Keeping the subscription defaults makes it easier to check whether the initial connection works as expected.
Step complete when: Rule mode is enabled, and the exit group you plan to use has an available node or automatic selection. Make sure you haven’t selected “DIRECT” or “REJECT” by mistake; these usually mean direct connection and blocked connection, not remote proxy nodes. You can review rule matching and group references later in the rule-based routing section of the user guide. For now, let your apps send traffic through the client.
Step 3: Connect and Route Traffic
Return to the home page and check the client’s status. If there’s a Start, Connect, or power button, click it once and wait for the client to show that it’s running. Some desktop clients start the core in the background as soon as they open, without a separate connect button. In that case, check the active configuration and core status rather than toggling it repeatedly. If you see a configuration load failure or a message that the core has stopped, go back to Step 1. A traffic-routing toggle can’t fix a core that isn’t running.
On Windows and macOS, use the system proxy for your first browser test. You’ll usually find it on the home page, in settings, or in the tray menu. When enabled, apps that follow the system proxy settings can connect through the local proxy port. Keep the client’s default port unless there’s a clear port conflict. If you change the listening port, reapply the system proxy settings; changing only the core’s port will leave the system pointing to the old one.
Linux desktop environments handle system proxies differently. After enabling the setting in the client, check your desktop’s network settings to confirm the proxy was applied. Browsers, terminals, and background services may also use different proxy settings, so this guide uses a browser for the initial check rather than treating a successful terminal command as the only measure. For servers or headless environments, see the user guide.
On Android and iOS, tapping Connect usually brings up a system prompt to configure a VPN connection or grant connection permission. Make sure the request comes from the client you just installed, then approve it through the system prompt. If you decline, apps may not send traffic through the client even if the subscription is imported. When the system shows a connected indicator, return to the app and confirm it’s still running normally. Here, VPN refers to the system’s traffic-routing interface; the client configuration determines how traffic is forwarded.
Verify the System Proxy Before Trying TUN
On desktop, don’t enable both the system proxy and TUN at the same time just to see what happens. TUN can route traffic from more apps that don’t follow system proxy settings, but it typically requires a virtual network interface, routing changes, and extra permissions. If the browser works through the proxy but a particular app doesn’t, first check whether that app has its own proxy settings, then consider TUN separately. Note the original settings before enabling it, and follow the client’s prompts to install a service or grant permissions. If your network starts behaving unexpectedly, turn off the new routing method first to restore the previous setup.
While connecting, close other proxy tools or VPNs that may also route traffic to prevent conflicts between the default route and system proxy. If your browser has a proxy-switching extension, check whether it overrides system settings. Then open a new tab and visit a test page. Existing connections may continue using the old route, so close the relevant tabs or restart the app if needed. Don’t assume a new connection is working just because an old page still loads.
Step complete when: The core is running, the system proxy is applied on desktop, or the system has approved and established a connection on mobile. Leave the default DNS settings unchanged for now. If you have trouble accessing local network resources or domains, finish checking the connection logs below, then work through the DNS section.
Step 4: Verify the Rules and Actual Exit
The final step isn’t just checking whether a toggle is on. Confirm that the target connection actually uses the expected exit. Open a page that should go through the proxy under your current rules, then open the client’s “Connections,” “Active Connections,” or similar panel. Refresh the test page and filter the new entries by domain. A browser may request several subdomains and background resources, so focus on the domain you’re testing rather than unrelated connections.
Expand a matching entry to check the destination, matched rule, and policy chain. If the chain shows the selected proxy node, the connection was routed through that exit. If it shows DIRECT, the current rule or proxy group is sending it directly. Direct connections are normal in Rule mode; what matters is whether they match your configuration’s intent. If you can’t find the entry, check whether the app is bypassing the system proxy, the client is running, and the connections panel has no filters or hidden entries.
Use Exit Details as a Clue, Not the Only Test
You can also visit an IP lookup service you trust to see the exit address and its approximate network location. However, the lookup service itself may connect directly in Rule mode, so an unchanged result doesn’t prove the client is broken. First use the connections panel to check which policy handled that request, then interpret the page’s results. Geolocation databases can be inaccurate, so a city name isn’t a reliable way to pinpoint a node’s location.
If you need an isolated test, switch briefly to Global mode, explicitly select a proxy node in the global proxy group, and reconnect. Restore Rule mode when you’re done. A Global mode test can help distinguish a rule-selection issue from a node connectivity issue, but it won’t route traffic from apps that never reached the core. If the browser works but another app doesn’t, go back to Step 3 and check how its traffic is routed instead of changing modes again.
If the log shows that a connection used the proxy but the page still won’t load, check the logs for errors around the time of that request. Connection timeouts, DNS failures, and certificate errors call for different fixes. Note what happened and change one thing at a time. Try another node or compare with a different standard HTTPS page. Don’t ignore a browser certificate warning; check your system clock, and don’t enter account details or other sensitive information on a page showing an error.
Once the setup works, note the client, configuration name, main exit group, and routing method. There’s no need to record the full subscription URL or other sensitive details. Before quitting on desktop, turn off the system proxy. If the client offers automatic restoration, check that your regular internet connection works after quitting. On mobile, disconnect through the client or system settings. That gives you a clear starting point to return to if network problems arise later.
Initial setup is complete: The subscription loads, Rule mode is set, app traffic reaches the client, and the target connection log shows the expected exit. For startup settings, subscription updates, and ongoing care, see the maintenance section. To compare Rule, Global, and Direct modes, see the proxy modes section. Keep this verified setup stable for now; there’s no need to turn on every advanced feature at once.