Before you start: Get the client and subscription ready

Install a client that matches your operating system and processor architecture, then get a subscription URL that explicitly supports Clash or mihomo. The client reads the configuration and routes traffic; installing it doesn't automatically give you a proxy exit. Your service provider usually supplies the subscription. If you only have a list of node share links, don't import it as a complete Clash configuration.

Temporarily turn off other proxy clients and VPN apps, and make sure your current network can reach everyday websites. This makes it easier to tell whether a later problem comes from your base network or the new configuration. If you see a permission prompt on first launch, read what feature it's for. This desktop walkthrough uses the system proxy; you don't need to install service mode or enable a virtual network adapter to get started.

Keep a working configuration as a backup. If you're already using a client, create a new configuration entry instead of overwriting the old file. Subscription links may contain personal access credentials, so paste them only into your own client. When sharing a screenshot for help, hide the full link, account details, and node authentication fields. To learn how cores, proxy groups, and subscriptions differ, read the glossary before moving on to step one.

01 Import a subscription and enable the configuration

Open Clash Verge Rev and select “Subscriptions” in the sidebar. Find the subscription URL field or the option to add one, paste the complete link from your service provider, then click “Import” or the corresponding download button. Don't include explanatory text, line breaks, or quotation marks when copying, and don't remove parameters from the end of the link. Some clients ask you to choose “Remote Configuration” first, then enter a name and URL. The name is only for local reference, so choose a short label that helps you identify its purpose.

When the import finishes, a new configuration entry should appear, usually with a name, update time, or action menu. You still need to select or enable the configuration after it appears. If the client stores multiple subscriptions, downloading one without switching to it may leave the core using the old configuration. Check the selected indicator in the interface, then open the Proxies page to see whether proxy groups and exit nodes are available.

Make sure you imported a configuration, not a web page

After a successful import, you should see selectable proxy groups—not a blank page. If you get a YAML parse error or a message that the configuration format is invalid, return to your service provider's site and make sure you copied the Clash subscription URL, not a login page, purchase page, or subscription information page. A link opening in your browser doesn't mean it returns the configuration the client needs; the response can vary depending on your login status and how you access it.

If you already have a local configuration file, use “Import File” or drag it into the configuration area. Select the actual .yaml or .yml file, then enable it as described above. Don't convert a file by changing its extension, or rename an encoded list of node details to YAML. See subscription and configuration file terms for the differences between these formats. You don't need to learn to write a full configuration by hand before your first setup.

Confirm that the configuration is active

On mobile, open the Configurations page, tap Add, choose the option to import from a URL, paste the link, and save. Then select the entry you just created. If your provider supports one-tap import, your device may ask whether to open the client. Even after the client opens, confirm that the configuration was saved and selected. Don't assume the client finished loading just because the browser prompt closed.

After a successful import, don't change rules, DNS, or advanced override settings yet. Note the configuration name, make sure the Proxies page isn't empty, then continue to the next step. If the subscription fails to download, keep the existing entry and check whether the link has expired and whether your current network can access it. Don't keep creating entries with the same name. For specific errors, see subscription download troubleshooting, then continue from here once the issue is fixed.

02 Choose Rule mode and a proxy exit

Open the Proxies page and find the “Rule / Global / Direct” mode selector. Choose “Rule” for your first setup. In Rule mode, the active configuration's conditions decide which policy handles each request, so you can access local services normally while routing specific destinations through a proxy. This setting determines how an exit is chosen, not whether traffic is routed through the client. Changing to Rule mode alone doesn't mean other apps are sending requests to the client yet.

Next, expand the main proxy group. Depending on the subscription, it might be called “Node Selection,” “Proxy Selection,” or something else. PROXY is a common example name in this guide; your interface doesn't have to include a button with that exact label. Choose an exit marked as available by your provider, or select an automatic group included with the subscription. Keep your choice steady during the first test. Switching exits before every page refresh makes it difficult to tell which change affected the result.

Understand modes and proxy groups

Global mode usually sends connections already routed through the client to the global policy; it doesn't automatically route every program on your operating system. Direct mode sends intercepted connections straight to their destinations, though local DNS, network permissions, and configuration can still affect them. You don't need to stay in Global mode just to “make sure it connects.” Test in Rule mode first to see how your subscription routes traffic.

Mode	How the exit is chosen	How to use it for your first setup
Rule	Matches policies using the active configuration's rules	Recommended: check that traffic is routed as expected
Global	Sends intercepted requests to the global policy	Use briefly for comparison if needed
Direct	Sends intercepted requests straight to their destinations	Useful for comparison; does not disable traffic interception

If a proxy group shows DIRECT, REJECT, or other group names, don't assume they're all servers. DIRECT means a direct connection, while REJECT means the connection is blocked. Another group name may refer to a set of possible exits. After selecting the main proxy group, check which exit it ultimately points to. If there are several nested groups, you can inspect the full proxy chain later in the connection details.

You can run the client's connection test to rule out candidates that are clearly unreachable, but don't judge actual speed by the test result alone. A successful test only means a specific probe target was reachable at that time; it doesn't replace testing websites and apps. Keep Rule mode and your chosen exit selected. In the next step, enable the system proxy or connect on mobile so requests actually reach the core.

03 Connect and route traffic through Clash

Return to the desktop client's home screen or Settings and confirm that the core is running, with no configuration load errors. Then turn on the system proxy. In Clash Verge Rev, the switch may be in a home screen shortcut area or in Settings, depending on the interface version. Once enabled, the system makes a local proxy address available to apps that follow system proxy settings. Browsers usually use it automatically.

Keep the default listening address and port for now; don't change them to an arbitrary fixed number from another guide. The client configuration and system proxy settings must point to the same port that's actively listening. Changing only one side sends requests to a service that isn't there. If your browser has a separate proxy extension, disable it temporarily or make sure it uses system settings, so its own configuration doesn't override the system proxy you just enabled.

On desktop, start with the system proxy

For your first setup, you don't need to enable TUN, service mode, and multiple DNS overrides at once. The system proxy routes traffic only for programs that follow that setting; some games, command-line tools, and apps with their own networking stack may not use it. First get a browser working to confirm that the subscription, exit, and basic proxy route are functional. Then decide whether a specific app needs TUN. For virtual network adapters, administrator permissions, and route interception, see the troubleshooting guide for your use case.

On mobile, approve the system prompt

In the Android or iOS client, select a configuration and policy, then tap Start or Connect on the home screen. When the system first asks to add a VPN configuration or establish a connection, check which app is making the request and approve it as prompted. The VPN indicator means the client is using the system's network extension; it doesn't confirm that your chosen exit works.

After connecting, return to the client and confirm that it still shows as running, then test in a browser. If another VPN app is connected, disconnect it before starting this client; don't let two apps compete to route traffic. Android users should also check per-app settings: if the browser is excluded, it may not use the proxy even when the home screen says Connected. For your first setup, keep the client's default app coverage and adjust it later if needed.

Leave the client running for now; don't quit the process yet. On desktop, closing the window might minimize the client to the system tray or quit it, depending on your settings. The window disappearing doesn't tell you which happened. Check that the tray icon or client home screen still shows it running before moving on. The final step is to check whether requests reach the expected exit, not just whether a switch is on.

04 Test your connection and routing

First open a site you normally access directly to make sure basic browsing still works. Then open a site that your active configuration is expected to route through a proxy. Follow the subscription's actual rules; don't assume a particular website always has to use a proxy. Open a new page or refresh to generate a fresh request. A tab that's already loaded won't create a new connection just because you changed a setting.

Open the client's Connections page and find the entry for the domain you just visited. Expand its details and check the destination, matched rule, and actual proxy chain. A request expected to go direct should show a direct policy; one expected to use a proxy should pass through the relevant proxy group and end at your selected exit. Connections can end quickly, so reload the page if needed. If the client keeps a history of closed connections, you can look for the request there.

Confirm routing by checking the matched result

The example below simplifies rule order; it is not a complete configuration you can use to replace your subscription. PROXY must be the name of a policy that already exists in your configuration. For your first setup, just remember: rules are checked from top to bottom, and the matching policy is used. You don't need to add these rules by hand just to test your connection.

mode: rule
rules:
  - DOMAIN-SUFFIX,github.com,PROXY
  - GEOIP,CN,DIRECT
  - MATCH,PROXY

If a page loads but the connection details show Direct, that request may not have used a proxy exit; a working page alone isn't proof. Conversely, a VPN icon or an enabled system proxy only confirms that traffic interception is configured. To confirm the setup, check the actual request and matched policy, and make sure the response succeeds. For more on rule types and matching, see routing rules and traffic routing terms.

If something goes wrong, work through these checks in order

If neither test site opens, turn off the system proxy or disconnect on mobile and check whether your original network works. Once it does, check that the right configuration is selected and that the proxy group points to an available exit. If only the site expected to use a proxy fails, leave the other settings unchanged and try a different exit. If the browser works but another app doesn't, check whether the app follows system proxy settings or is excluded by mobile per-app routing. Don't rush to reinstall the client.

If you need help, note which step failed, the client name, selected mode, and any visible error. Hide your subscription URL and authentication details in screenshots. Don't reset DNS, rules, and system network settings all at once; that can erase useful clues. The Clash troubleshooting guide covers internet access failures, node timeouts, DNS issues, and system proxy problems. This page focuses on the first connection.

Keep the working setup, then manage routine updates

Once routing works as expected, note the configuration name, mode, and main proxy group selection. When the node list changes, update the entry on the Subscriptions page and check that the proxy group selection still works after the update. An update may add or remove exit options, so don't assume your previous selection will still be available. Put custom changes in the client's supported override or extension mechanism to avoid losing them when remote content updates.

When you're done, turn off the system proxy before quitting the desktop client. On mobile, tap Disconnect before leaving the app. Visit a familiar website after disconnecting to confirm that your network is back to normal. Launch at startup and automatically enabling the proxy at startup are separate settings. Turn them on only if you need them after completing this connection test, and repeat the browsing check after a restart. With import, selection, routing, and testing complete, the four-step setup is done; follow up on specific issues as they come up.

Clash Quick Setup