Clash Setup Guide: From Subscription Import to Connection Check

A subscription is a link starting with https:// that contains a node list and an update address, provided by your service through its account dashboard. Before starting, copy the full link to your clipboard from the provider's site — make sure nothing is cut off, especially trailing parameters.

Desktop (Clash Verge)

Profiles›Paste link›Import

Open the client and click "Profiles" in the left navigation. There's an input box at the top of the page — paste the subscription link there and click the "Import" button on the right. Within a few seconds, a profile card appears in the list below, showing the profile name, last update time, and data used and expiry date (if the provider includes that info in the subscription). Click the card to select it; its border becomes highlighted, meaning that profile is now active.

Mobile (Clash Meta for Android)

Profiles›+ New›Import from URL›Save

Open the app, tap "Profiles" on the home screen to open the profile list, then tap the "+" button in the bottom right and choose "Import from URL." Paste the subscription link into the URL field; you can also give it a recognizable name, then tap save in the top right. The app fetches the subscription immediately, and once done, returns to the list — tap the profile to select it and a checkmark appears next to it.

If the import fails with an invalid link or format error, it's usually an incomplete copy or an expired subscription. For the differences and format details between URL import, clipboard import, and local file import, see "Clash Subscription Link Import Guide." For precise definitions of "subscription," "profile," and similar terms, see Glossary · Core & Configuration.

Condition to move on: the profile card appears in the list and is selected. Node data is now ready — next, decide how traffic gets routed outbound.

This step involves two independent settings: the outbound mode, which decides whether each connection is proxied, direct, or rejected; and the level at which the proxy applies, which decides whose traffic the client intercepts. Start with the outbound mode — here's how the three options behave:

Mode	Matching logic	When to use
Rule	Matches each connection's domain and IP against routing rules one by one; a match routes accordingly, otherwise falls back to a default policy	Default for daily use. Local sites connect directly, sites outside the region go through the proxy, without interfering with each other
Global	All traffic is forwarded through the proxy node regardless of rules	Temporarily debugging rule issues, or when all traffic needs to exit through the proxy
Direct	All traffic goes out directly without the proxy	Temporarily disabling the proxy without closing the client

In Verge, the outbound mode switch sits at the top of the Proxies page; in CMFA it's under "Mode" in the profile details. For a first-time setup, keep the default Rule mode — the built-in rule set in the subscription already covers routing decisions for common sites, and switching to Global manually would route local traffic unnecessarily and increase latency. For rule matching order and syntax, see Glossary · Routing & Rules; for how custom rule priority works, see "Clash Routing Rule Priority Explained."

Now, the level at which the proxy applies. The default system proxy method changes the OS-level proxy setting, so apps that follow the system setting (like browsers) automatically route through it; but some apps (command-line tools, some games and desktop apps) ignore the system proxy, and that traffic needs TUN mode, which intercepts traffic at the network layer through a virtual network adapter. TUN isn't needed for a first setup — enable it later only if needed, after confirming the system proxy works.

Condition to move on: the outbound mode is confirmed as "Rule," and the applied level stays at the default. There's no save button — changes apply instantly, so you can move straight to connecting.

Desktop: turn on the system proxy and pick a node

Settings›System Proxy›On

In Verge's left navigation, go to "Settings," find the "System Proxy" toggle, and turn it on. Once the toggle is highlighted, the OS proxy now points to the local mixed port (default 7897; older kernel builds often use 7890 — check the Settings page for the actual value). The proxy chain is now established, but you still need to pick an available node.

Proxies›Node group›Latency test›Select node

Switch to the "Proxies" page, expand any node group, and click the lightning-bolt latency test icon next to the group title. Within a few seconds, a latency value in milliseconds appears next to each node name — lower is better, and timeout means that node is currently unreachable. Click a node with a normal latency value to select it; its name becomes highlighted. For how the test works and what the values mean, see FAQ · Usage Tips.

Mobile: start and authorize the VPN

Back on the CMFA home screen, tap the start button in the center. A VPN connection request dialog appears — choose "Allow." This is Android's standard authorization mechanism for any local proxy app; the connection doesn't go through any remote VPN server. Once authorized, the button switches to a running state and a key icon appears in the status bar. Node selection happens under the "Proxies" entry on the home screen, the same way as on desktop: run the latency test, then select a node.

Condition to move on: the system proxy toggle (or start button) is on, and a node with normal latency is selected. A toggle being on doesn't guarantee traffic is actually routing correctly — the final step confirms that.

There are three ways to verify, in increasing order of rigor. Passing any one of them confirms the proxy is working; for a first setup, it's worth trying all three, and after that, the first one is usually enough.

Method 1: Check egress IP in a browser

Open any IP lookup page in your browser (search "what is my IP" to find one). The egress IP shown should correspond to the region of the node you selected, not your local ISP's location. If it still shows your local IP, browser traffic isn't going through the proxy — usually because the system proxy toggle isn't on, or the browser has its own separate proxy extension configured.

Method 2: Verify the port from the command line

Command-line tools don't follow the system proxy by default, which makes them useful for testing the local proxy port directly. The following command works in Windows PowerShell and macOS/Linux terminals alike (replace the port with the actual value from the Settings page):

curl -I -x http://127.0.0.1:7897 https://www.gstatic.com/generate_204

A response of HTTP/1.1 204 or HTTP/2 204 means the request went out through the proxy port successfully; a connection refused error usually means the port number is wrong or the kernel isn't running.

Method 3: Read live entries in the connection panel

Verge's "Connections" page lists each connection's destination domain, the matched rule, and the final egress route in real time. Browse a few pages, then check the entries — pay attention to the egress column:

Sites outside the region routing through PROXY and local sites routing through DIRECT means the rules are working as expected; REJECT means that request was blocked by a rule (usually an ad or tracking domain), which is normal.

Signs of success

• The IP lookup page shows an egress region matching your selected node
• A command-line request through the proxy port returns a 204 status
• The connection panel shows local domains hitting DIRECT and others hitting PROXY as expected