First-Time Clash Setup: Four Steps From Import to Verification

Before You Start: Two Things You Need

Before diving in, make sure you have these two things ready:

• An installed Clash client. If you haven't installed one yet, head to the download page and pick a client for your platform. Clash Plus is the top pick for desktop, with installers for both macOS and Windows; launch it once after installing so it completes its first-run setup.
• A subscription link. Your proxy provider issues this link after you purchase a plan, usually found in the "Account" or "Subscription" page on their site — a long URL starting with https://. It isn't a node itself but a remote configuration address; the client periodically fetches the latest node list and routing rules from it.

Treat the subscription link like an account credential — anyone who has it can use your plan's traffic. Avoid pasting it into public chats or screenshots. For more background on what a subscription link actually is, check the FAQ once setup is done; it won't affect the steps ahead.

The goal of this step is simple: turn the client's empty node list into a row of selectable nodes.

Copy the link first. Go back to your provider's site, find the "Copy" button next to your subscription link, and click it to copy the full link to your clipboard. Always use the copy button instead of manually selecting the text — subscription links are long, and manual selection often clips characters at either end, causing an "invalid link" error later.

Open the client's subscription page. In Clash Plus and Clash Verge Rev, click "Profiles" (some versions call it "Subscriptions") in the sidebar; in ClashX Meta, click the cat icon in the menu bar, then "Config" → "Remote Config" → "Manage"; in FlClash, tap "Profiles" in the bottom navigation. You'll see an empty list and a "New / Import / +" button.

Choose to import via URL. Click the import button, select "URL" or "Download from link," paste the subscription link from your clipboard into the input field, optionally give it a memorable name, then confirm. The client immediately sends a request to that address to download the configuration — usually done within a few seconds.

Confirm the import succeeded. There are two signs of success: a new entry appears in the profile list, usually showing traffic usage and expiration date; switching to the node (proxy) page shows a long list of nodes, most labeled with a region name like Hong Kong, Japan, or Singapore. Once you see the node list, this step is done.

If the import fails or the node list is empty, common causes are an incompletely copied link, an expired subscription, or your current network being unable to reach the subscription address. Don't rush to reinstall the client — work through the subscription troubleshooting checklist item by item; most issues can be pinpointed within two minutes.

With nodes in place, the next decision is which traffic goes through the proxy. This is controlled by proxy mode, and mainstream clients place three options prominently on the main screen:

• Rule mode: Traffic is matched against the routing rules in your configuration one by one — connections matching a proxy rule go through a node, everything else connects directly. Local sites stay direct while sites outside your region go through the proxy, without interfering with each other. This is the default choice for everyday use.
• Global mode: All traffic goes through the currently selected node without exception. Useful for temporarily checking whether a specific site was missed by the rules, or when you genuinely need every connection to go through the proxy for a short while. Leaving Global mode on long-term routes local traffic through nodes too, which slows things down and burns through data faster.
• Direct mode: No traffic goes through the proxy at all, effectively bypassing it while keeping the client running. Useful for troubleshooting network issues; you won't need it day to day.

In practice this takes one click: select "Rule" in the mode area on the main screen (a row of buttons in some clients, a dropdown in others). The configuration bundled with your subscription usually already includes a complete set of routing rules, so beginners don't need to edit anything.

After picking a mode, take a quick look at the proxy group on the node page: most subscriptions provide a group named something like "Auto Select" or "Fallback," which lets the client automatically pick the lowest-latency node; you can also manually pick a fixed node. For your first time, it's worth manually selecting a geographically closer node (such as Hong Kong or Japan) — latency is usually lower and feels more responsive. Click the latency test button (a lightning bolt or waveform icon) on the node page, wait a few seconds, and a millisecond figure appears next to each node — lower is better, and nodes showing timeouts should be skipped for now. Reading latency numbers, multipliers, and weighing regions in more depth would derail this walkthrough — see the node selection guide for that.

With a node selected and a mode chosen, one switch remains. After launching, the Clash client is just "on standby" — browsers and apps on your system won't automatically hand traffic to it. You need to turn on the system proxy switch so the operating system routes HTTP/HTTPS traffic to the local port the client listens on (7890 or 7897 by default, slightly different across clients).

What to do: Find the "System Proxy" switch on the client's main screen (in Clash Plus / Clash Verge Rev it's at the top of the home or settings page; in ClashX Meta it's labeled "Set as System Proxy" in the menu-bar menu; FlClash has a large start button on its home screen that activates both the connection and system proxy at once), then turn it on.

Note for macOS users: The first time you enable system proxy, macOS shows an authorization prompt asking for your login password or Touch ID — this is the standard flow for changing network settings, so just confirm it. If you accidentally click cancel, the switch snaps back to off; simply toggle it again to re-authorize.

What to expect once enabled: The client's status area shows "Connected" or a traffic graph starts moving; opening the menu-bar or taskbar icon shows live upload/download speeds. Browser requests are now passing through the client — but hold off on celebrating until step four confirms the connection actually works.

One note in passing: some apps (command-line tools, certain game clients) don't read the system proxy setting and stay direct even with the switch on. That traffic needs TUN mode to intercept it, which is a more advanced topic covered in the relevant platform section of the documentation — no need to get into it for your first setup.

A green switch doesn't guarantee the proxy is actually working. This last step uses two complementary checks to confirm the connection is truly established — doing both takes under a minute.

Method 1: Check exit IP in a browser

Open your browser and visit any IP lookup page (search "what is my IP" and pick any result). The page shows your current exit IP address and its location. Compare it: does the location match the region of the node you selected in step three? Selecting a Hong Kong node should show Hong Kong; selecting Japan should show Japan. A match means browser traffic is going out through the node; if it still shows your local ISP's address, the system proxy hasn't actually taken effect — check the switch state and the browser's own proxy settings (some browsers have proxy extensions that override system settings).

Method 2: curl test in the terminal

Browser verification only proves the browser is connected; a terminal check further confirms the local proxy port itself is functioning. Open a terminal (Terminal on macOS or PowerShell on Windows) and run:

curl -x http://127.0.0.1:7890 -I https://www.google.com/generate_204

This forces the request through the proxy on local port 7890, hitting an address designed specifically for connectivity testing. If the client listens on a different port than 7890, substitute the actual mixed port shown in the client's settings page. Seeing HTTP/2 204 or HTTP/1.1 204 (some setups show 200) in the response means success; a Connection refused error means the port is wrong or the client isn't running; a long timeout usually means the current node is unavailable — go back to the node list and try one with normal latency.

Once both checks pass, your first-time setup is complete. For more verification techniques and troubleshooting steps, see verifying your first connection in detail.

After Setup

Day to day, only two things need occasional attention. Subscription updates: providers add and remove nodes periodically, and the client auto-updates the subscription at the interval set in the configuration; if you notice widespread timeouts across nodes, manually trigger an update on the subscription page first. Node switching: when a node slows down, go back to the node page, re-run the latency test, and switch to one with a lower value — no other settings need to change.

To go further, pick what fits your needs:

• Advanced configuration such as launch on startup, TUN mode, and GeoIP database updates, along with full installation details for all five platforms, is organized by platform in the documentation.
• If you run into errors or unexpected behavior, check the "Troubleshooting" section of the FAQ first — most situations already have a documented answer.
• To understand the routing rules inside your subscription configuration and start editing them yourself, start with rule syntax and priority explained.

Read the full documentation