Clash for Android
Subscription Import and Connection Guide

Before You Begin: Install a Client and Prepare a Subscription

After installing a client, you’ll need a working configuration. It typically includes nodes, policy groups, and routing rules, and is provided by your service provider. The client does not generate this connection information automatically. Open your provider’s subscription management page and copy the link explicitly labeled for Clash or compatible with your client. Don’t use the URL of an account sign-in page, purchase page, or help article as a subscription link.

Subscription links may contain account identifiers, so protect them like passwords. Use the page’s copy button when possible to avoid missing a parameter at the end of the link. Don’t post the full URL in public forums or share screenshots that reveal it. If you only have a local configuration file, use Import from File; the steps for choosing a mode, starting the service, and testing the connection stay the same.

Before your first attempt, make sure your phone can access the internet normally with the proxy off. If another VPN client is connected, disconnect it first to avoid conflicts with permissions and routing. Keep the client’s default network settings; don’t change DNS interception, ports, and access controls all at once. That way, if something goes wrong, you can tell whether the subscription failed to import or traffic isn’t reaching the client. For platform-specific installation requirements, see the setup guide for all platforms.

01 / Import a Subscription and Select the Configuration

Open the client and go to Profiles. In interfaces similar to Clash for Android, choose New Profile, then Import from URL. Other clients may show a plus button or Add Subscription instead. On the form, give the profile a recognizable name, such as “Daily,” then paste the full URL you copied into the URL or subscription field. The name is only used to identify the profile locally; it doesn’t change the subscription.

Before submitting, check that the URL hasn’t wrapped onto a new line, contains no extra spaces, and hasn’t been pasted twice. You can leave automatic updates at their default setting; there’s no need to change the update interval for your first connection. Tap Save or Download and wait for the request to finish. If successful, the client usually returns to the profile list and shows the name you entered. Some clients display an update time; others simply confirm the import. Follow the prompts in your app.

A profile appearing in the list doesn’t necessarily mean it’s active. Select the profile you just imported and look for a checkmark, radio button, or “Current Profile” label. Once it’s selected, return to the home screen. Avoid creating multiple profiles with the same name while troubleshooting: you might update one but activate another. If you have several subscriptions, note which one you’re using and check that same profile throughout.

Import Failed? Check the Error First

If the download fails or times out, return to your provider’s page to confirm the link is still valid and check that your internet connection works. Errors such as parse failed, missing fields, or unsupported configuration format mean you need to check the response and client compatibility. A login page opening in your browser doesn’t mean the URL returns a usable configuration. Use a link explicitly marked as compatible by your provider, and don’t submit it to an unfamiliar conversion site.

Continue only after the import succeeds and the profile is selected. If the error persists, follow the subscription expired or parse error troubleshooting steps to distinguish a link issue from a format issue, then try again. Changing proxy modes won’t fix a subscription that hasn’t imported successfully.

02 / Choose Rule Mode and a Proxy Route

Return to the home screen and open Proxy Mode or Mode, then select Rule. In interfaces similar to Clash for Android, the home screen may show “Proxy Mode: Rule.” Other clients may offer Rule, Global, and Direct. Make sure Rule is selected, not just that the mode menu is open. For your first connection, keep the subscription’s default rules; there’s no need to edit YAML.

In Rule mode, traffic is routed according to the configuration’s matching rules, so some connections may go direct while others use a proxy. Global mode typically routes traffic through the global policy group, while Direct mode typically bypasses proxy nodes. Global isn’t a stronger connection mode, and Direct doesn’t mean the client is off. Rule mode is a good starting point because it preserves the usual routes for local services and everyday websites.

Next, open Proxies and review the policy groups. Think of a policy group as a selector for the route chosen by a rule; it may contain nodes, other groups, or both. Group names vary by subscription, so don’t look for one specific label like PROXY. Use your provider’s instructions to find the main group for proxied traffic. If it’s a manual selection group, choose a known working node and make sure the checkmark moves to it.

If the main policy group uses automatic selection, failover, or a similar mode, keep the provider’s settings for now instead of switching each option to manual. If the client offers a latency test, you can use it to spot nodes that time out, but the result is only a probe and doesn’t guarantee every site will work. Don’t consider setup complete based on a number alone; test an actual website in step four.

You should now have two clear results: the home screen shows Rule mode, and the main policy group on the Proxies page has a suitable route selected. If the expected group is missing, return to the profile list and make sure the right configuration is active. Don’t rush to create new rules. For nested groups, rule matching order, and overrides, see the configuration section in the complete documentation; these aren’t required to get connected for the first time.

03 / Start the Service and Approve System Access

Once the profile and mode are set, return to the home screen and tap Start or the current stopped status bar. On common Android interfaces, you’ll see “Clash is stopped” and a prompt to tap to start. The first time you start the service, Android usually displays a VPN connection request explaining that the app wants to set up a VPN connection. Make sure the app name matches the client you just installed, then allow the request as prompted.

The VPN service lets the client route your device’s traffic; it doesn’t mean the subscription node is reachable yet. After granting permission, wait for the home screen to show that the client is running or connected, then check the VPN status in the system status bar, notification shade, or settings. Android versions display this differently, and some hide the status icon. Check the client’s running status too rather than relying on a particular key icon.

If the client returns to the stopped state after you tap Start, check the home screen or logs for the first clear error. Startup may fail if VPN permission hasn’t been granted, another VPN is connected, or the configuration failed to load. Disconnect the other VPN and restart the current client. If you previously denied permission, start the connection again and follow Android’s prompts. Avoid rapidly toggling Start and Stop, which makes it harder to tell what state the client is in.

Connection Options on Desktop and iOS

On Windows and macOS, running the client doesn’t necessarily route browser traffic through it. With a standard desktop setup, you may also need to enable System Proxy in the client so apps that follow system proxy settings send requests through it. Start with this method for your first test. Set up TUN according to the documentation only if you need to route traffic from the whole device. Don’t enable multiple traffic-routing methods as a precaution; if something goes wrong, it’ll be harder to identify which one is active.

On iOS, starting a connection in the client may also prompt you to allow a VPN configuration and confirm it in system settings. Linux desktop support for system proxies varies, and some apps need to be configured individually. For platform-specific permissions, installation paths, and TUN requirements, see the installation guide for all platforms. Back on Android, once the service stays running, keep the screen on and test the connection before adjusting background battery settings.

04 / Test Websites and Apps

First, open a browser and visit a website you can normally access to confirm that starting the client hasn’t interrupted your internet connection. Then visit a known site that requires a proxy and that you’re authorized to access. Wait for the page to fully load. Don’t rely on the address bar starting to navigate or on the client showing Connected. A running service means the routing component has started, not that every route is working.

If the target page loads, return to the client’s Connections or Logs page and review the request you just made. Clients with connection details usually show the domain, matched rule, and policy group or node used. Check that the request took the expected route; not every connection should use a proxy. DIRECT is common in Rule mode. Check the relevant rule only if a destination that should be proxied is going direct.

Once the browser test passes, open an app you use regularly and perform an action that needs the network, such as refreshing content or loading a new page. An already-open page may be cached, so it doesn’t prove that new requests work. If the browser works but an app doesn’t, check Access Control or the app routing scope in the Android client. Proxy only selected apps and bypass selected apps do the opposite; read the setting’s description before changing it.

Narrow Down the Cause by Symptom

If no websites open after you connect, check the active profile, the main policy group’s route, and whether the system VPN is still running. You can temporarily stop the client to see whether basic connectivity returns. If you still can’t connect with the client off, troubleshoot Wi-Fi, mobile data, or any network that requires sign-in first. If basic sites work but the target site doesn’t, switch to another working node in the same manual policy group and retry the same page. Change one thing at a time.

If only one app fails, check Access Control and the app’s own proxy behavior first. If domain-related errors persist, investigate DNS next. Don’t start by changing nameserver, Fake-IP, and DNS interception all at once. To investigate further, use the connected but no internet troubleshooting checklist to record what you observe. Keep the error message, but redact subscription URLs and account details before sharing logs.

After Setup: Update Subscriptions and Keep Connections Alive

For everyday use, make sure the active profile is the one you tested, then start the service. If your provider announces node changes or several nodes stop working, update the relevant subscription on the Profiles page and check the policy group once the update finishes. An update may change the group’s available options. If your previously selected node was removed, choose another route instead of repeatedly toggling the VPN.

If the connection works while the screen is on but drops after the phone has been locked for a while, check the system’s background activity and battery restrictions. Open the Android app settings for your client and allow the background activity needed for it to run; some systems manage auto-start separately. Settings vary by manufacturer, so follow your system’s options one at a time. You don’t need to disable every battery-saving feature on your phone.

When you’re done, stop the service in the client and make sure the system VPN is disconnected. If you enabled the system proxy separately on desktop, turn it off too so apps don’t keep pointing to a local proxy port after the client exits. That’s the end of the first-time setup. For LAN sharing, port changes, or more detailed app routing, consult the complete documentation for the task you need.