Getting Started with Clash: From Subscription Import to Verification
This page is the main path for first-time setup: import subscription, choose a proxy mode, connect a node, and verify the result — four steps, about ten minutes total. Each step spells out where to click, what you should see, and what to do next. Advanced topics like policy groups, TUN, and DNS aren't covered here — see the advanced handbook for those.
This page describes the workflow using the desktop Clash Verge Rev and mobile Clash Plus interfaces as reference. Menu naming varies slightly across Clash-based clients — "Subscription" is sometimes called "Profile" or Profiles, and "outbound mode" may appear as "proxy mode" — but the import → choose mode → connect → verify sequence is identical across every client. Just look for the matching label. If you haven't installed a client yet, grab one for your platform on the downloads page first.
Before you start: two things you need on hand
Before diving in, make sure of two things. First, the client is installed and has completed its first-run authorization: on Windows, the first launch requests administrator permission to install a system service — click "Yes" to allow it; on macOS you may be prompted to allow a background item or network extension — approve it in System Settings; on Android, the first connection triggers a VPN connection request dialog that you must confirm, otherwise traffic can't enter the client; on iOS, the first launch of Clash Plus walks you through adding a VPN configuration, which requires your passcode to confirm. These authorizations only need to be done once.
Second, get your subscription link. This link is provided by your service in its user dashboard, usually a long URL starting with https://. Copy it in full and watch out for stray spaces. It's essentially a pointer to a remotely hosted, auto-updating configuration file — see the "Subscription" and "Profile" entries in the glossary for the conceptual details, which we won't repeat here. With both in hand, move to step one.
Step 1: Import the subscription
Desktop (Windows / macOS / Linux, same steps): Open Clash Verge Rev, click "Subscription" in the left sidebar, and you'll see an input field at the top of the page. Paste in the subscription link you copied and click the "Import" button on the right. The client immediately fetches the config from that URL, and within seconds a new profile card appears in the list below — showing the profile name, remaining traffic or expiry date (if the service includes it in the response headers), and the last update time. If the card isn't automatically marked as selected, click the card itself to activate it; an active card carries a visible border or highlight.
Mobile: Both Clash Plus and Clash Meta for Android have their entry point on the "Profiles" page. Tap the plus icon in the top-right or bottom-right corner, choose "Import from URL," paste the link, and confirm; if you just copied a link elsewhere, some clients detect the clipboard automatically and offer one-tap import — check the content and accept. Success looks the same as on desktop: a new entry appears in the profile list and is checked as the one in use.
Once the import is done, it's worth checking one more thing: open the profile card's menu (the "…" in the top-right corner on desktop, or long-press the entry on mobile) and confirm the auto-update interval. Most clients default to fetching once every 24 hours, which is fine to keep; if your service's nodes change frequently, you can shorten it to 6–12 hours — there's no benefit to setting it to minutes, since that won't make node updates arrive any faster.
If you get stuck at this step — an error on import, a spinner that never resolves, or the card never showing up — first double-check the link was copied in full, then try a different network (like your phone's mobile data as a hotspot) and retry. If it still fails, work through the three troubleshooting steps under "Subscription import failed" in the FAQ instead of retrying blindly on this page.
Step 2: Choose a proxy mode
Once the subscription is active, the next thing to confirm is the outbound mode. On desktop, this is "Outbound Mode" on the Settings page or near the top of Clash Verge Rev's home screen; on mobile it's usually labeled "Proxy Mode" in the main screen or settings. There are always three options, meaning:
| Mode | Behavior | When to use it |
|---|---|---|
| Rule | Matches traffic against the routing rules in the profile — traffic matching a proxy rule goes through a node, everything else goes direct | Everyday default; pick this for first-time setup |
| Global | Skips matching entirely — all traffic is forwarded through the proxy node | Temporary check for whether a site is being wrongly routed direct |
| Direct | All traffic bypasses the node and goes out directly, equivalent to disabling routing | Comparison testing, temporarily disabling the proxy |
Set the mode to "Rule" for first-time setup and leave it there. Rule mode's behavior is entirely determined by the routing rules bundled in your subscription: sites that don't need a proxy go direct, sites that do get routed through a node — this is the default design of a subscription profile, and it works out of the box. Global mode should only be used temporarily for troubleshooting; leaving it on long-term wastes node bandwidth on traffic that never needed a proxy, and slows down access to sites that were fine going direct.
You'll also see "System Proxy" and "TUN Mode" toggles at this step. These control how traffic enters the client — a separate dimension from the three modes above. In short: system proxy covers browsers and most regular apps, and is the recommended choice for first-time setup; TUN mode intercepts all traffic at the network layer, covering apps that don't respect the system proxy, but it involves a virtual network adapter and DNS hijacking — see the advanced handbook's TUN and Fake-IP section for the mechanics and trade-offs. This page continues with the system proxy route.
Step 3: Connect a node
Pick a node first. On desktop, click "Proxies" in the left sidebar to see one or more policy groups, each holding the node list provided by your subscription. Find the lightning bolt or radar-shaped button in the top-right corner of the list and click it to run a latency test — within seconds each node shows a millisecond value; green or low numbers mean the connection is healthy, red or "timeout" values mean the node is temporarily unavailable. In the default policy group (often called "Proxy Selector" or PROXY), click a node with normal latency; the selected node gets a visible marker. What policy groups are and how auto-test groups work is an advanced topic — see the policy groups section of the advanced handbook. For now, manually picking a working node is enough.
Then let traffic in. On desktop, go back to the Settings page and turn on the "System Proxy" switch — once enabled, the operating system's proxy settings are pointed at the local port the client listens on (Clash Verge Rev defaults to 127.0.0.1:7897), and requests from browsers and most apps now flow through the client. Mobile has no concept of a system proxy — just tap the large connect button on the main screen: Android starts a VPN service and a key icon appears in the status bar; on iOS, Clash Plus shows a VPN indicator in the status bar once connected. Seeing that icon confirms the traffic channel is up.
If turning on the system proxy throws an error on desktop, or the switch snaps back off, the common cause is another proxy app already occupying the local port — make sure no similar client is running in the background, then retry. If it keeps failing, the full troubleshooting flow is in the diagnostics section of the FAQ.
Step 4: Verify it works
Don't rely on a gut feeling — confirm with two observable pieces of evidence. The first is in your browser: open a site that should be routed through the proxy per the rules — if the page loads normally, the "rule match → node forward" chain is working. Then open a site that shouldn't need a proxy — if it loads at the usual speed, direct routing is also working correctly and hasn't been accidentally pulled into the proxy.
The second piece of evidence is inside the client: open the "Connections" page (some clients call it "Active Connections" or fold it into the logs) — you should see a stream of live-updating connection entries, each tagged with the destination domain, the matched rule, and the actual exit used. Every page you open in the browser adds a few more entries here — if the list is moving, routing is working. On desktop you can add a third layer of confirmation with a command line request explicitly through the client's mixed port:
A response header like HTTP/2 200 means the local port is forwarding correctly. If the port number doesn't match, use the actual mixed port shown on the client's Settings page.
If a site won't load or the Connections page stays empty, check these four things in order: did the node latency test time out (try another node); is the outbound mode stuck on "Direct"; is the system proxy or VPN switch actually turned on; has the subscription already expired. Detailed steps for each are in the FAQ; deeper issues involving DNS and Fake-IP are covered in the advanced handbook.
After setup is done
At this point, the main setup path is complete: the subscription auto-updates, Rule mode is routing traffic, and a node is connected and verified. Day-to-day, there are only two small things to keep an eye on — retesting latency and switching nodes on the "Proxies" page when things slow down, and occasionally checking the expiry date on the profile card. If you want to go further, there are three directions: for finer-grained routing, read the rule sets and custom rules sections of the advanced handbook; to have every app taken over — including ones that ignore the system proxy — read the TUN mode section; if you're unsure whether your current client fits your platform and habits, the comparison page has an item-by-item reference.