Clash Meta Quick Start: Import, Connect, and Verify

Before you begin, prepare two things: a Clash Meta client compatible with your system and either a subscription URL from your service provider or a local YAML configuration file. The client reads configuration and forwards connections; installing it does not create usable nodes automatically. If you only have account details and no subscription URL, return to your provider’s dashboard and look for the Clash, Mihomo, or universal subscription entry.

For a first installation, use a graphical client. Windows and macOS users can choose Clash Plus, Clash Verge Rev, or another actively maintained client from the download page. Android users can choose Clash Plus, Clash Meta for Android, or a similar option. Linux desktop users can use a graphical client; running the mihomo core directly is mainly for servers and routers. Direct core operation involves configuration paths, service management, and transparent proxying, so it is outside this ten-minute tutorial.

After installation, check that the system date, time, and time zone are accurate. Subscription updates, HTTPS connections, and certificate validation all depend on the system clock; a significant mismatch may cause subscription download failures, certificate errors, or pages that will not load. Temporarily quit other tools that modify the system proxy, and fully exit any older client still running in the background before launching the client you plan to use.

After opening the client, look for “Subscription,” “Configuration,” “Config,” or “Profiles.” This area stores switchable client configurations rather than a live list of proxy nodes. Use the add option and choose “Import from URL,” “Add subscription,” or a similar action. Paste the complete subscription URL from your provider into the field, make sure it has no extra spaces, then select Import, Download, or Save.

After a successful import, the page will usually show a new configuration entry with its name, update time, or an update button. Select the entry to make it active. Some clients mark the selected state with a check mark, highlighted border, or “Enabled” label; others switch automatically after importing. Do not rely only on an “Import successful” message. Confirm that the active profile is the one you just added, or the strategy groups used later may still come from an older configuration.

Next, run one manual update. A successful update means the client can reach the subscription URL and parse the response as a Clash configuration. If the format is invalid, make sure you did not paste a website URL, login page, or QR-code instructions instead of the subscription URL. If the request times out, try again from a different local network. If the subscription is empty, check the plan status and subscription type with your provider. Do not edit the YAML immediately; first verify that the original configuration works as provided.

For a local file, choose “Import from file” and select a configuration ending in .yaml or .yml. Set it as the active configuration after importing. YAML is sensitive to indentation, and spaces can change after passing through a chat app, web editor, or text conversion tool. If the client reports a parse error, re-import the original file first. For field-by-field checks of proxies, proxy-groups, rules, or dns, see the configuration file structure guide.

Proceed only after the node list appears

Once the configuration is selected, open the “Proxy,” “Strategies,” or “Proxies” page. You should normally see several strategy groups; expanding one should reveal node names or nested strategies. A completely blank page means the active configuration has not loaded correctly, and enabling the system proxy will not produce the expected result. Return to the configuration page, select the profile again, and review any error message. Continue only after the strategy page displays the configuration content.

After the configuration loads, decide how traffic should be routed. Common clients offer “Rule,” “Global,” and “Direct” modes, usually written as Rule, Global, and Direct. Start with Rule mode. It evaluates domains, IPs, apps, or network types in the order defined by the configuration, then sends each connection to the corresponding strategy group. Ordinary websites can connect directly, while connections requiring a proxy are sent through the selected node.

Global mode sends most connections through one proxy strategy. It is useful for temporarily checking whether a website fails because of routing rules, but it should not be the first troubleshooting step every time. Direct mode bypasses the proxy and can help determine whether the problem lies in the client path. These modes are not speed settings and do not change the quality of a node’s route; they only determine the path a connection takes. Keep Rule mode after the initial setup and switch modes briefly only when comparing a specific problem.

With Rule mode selected, expand the main strategy group, often named “Node Select,” “Proxy,” “PROXY,” or “Manual Select.” Choose a node with a normal service status and look for a test option beside it. A latency test checks whether the client can establish basic communication with the node. A lower value usually means a shorter round-trip time, but it is not actual download speed and cannot prove that the node reaches every target website. Try another node if the test fails. If every node fails, the subscription status, local network, or client permissions are more likely to be the cause.

The configuration may also include strategy groups such as “Auto Select,” “Fallback,” or “Load Balance.” You do not need to adjust each one for the first connection. Point the main proxy strategy to one clearly working node to reduce the number of variables. After the basic connection is verified, enable automatic testing or fallback if needed. Strategy groups can reference one another, so an option shown in the interface may be another strategy group rather than the final node. This is normal configuration behavior.

After choosing the node and mode, return to the client home or settings page and enable “System Proxy,” “Set as system proxy,” or the System Proxy switch. This points the system proxy to the local port monitored by the client, so browsers and apps that follow system proxy settings send their connections to Clash. Keep the client running. If you quit it without restoring the system proxy, the browser may still point to a local port that is no longer listening and lose network access.

The first time you enable this on Windows, Windows Firewall may ask whether the client can access the network. After confirming that the program matches the installed file, grant the permissions required for the network types you actually use. macOS may request your system password or approval for a network extension or proxy-setting change. Android and iOS commonly show a VPN connection authorization prompt because the system passes traffic to the client through a local VPN interface. These prompts are part of the operating system’s network handoff; without completing authorization, the client may appear active but still receive no connections from other apps.

Test the browser with only the system proxy enabled; do not change TUN, DNS, and ports at the same time. The system-proxy path is shorter and easier to diagnose. Open a new browser window instead of only refreshing an existing page, since the browser may reuse an existing connection. First visit a website that normally works without a proxy to confirm that local network access is intact, then visit a target that should use the proxy strategy. If both types of sites load, continue to verification.

When should TUN mode be enabled?

Some apps do not read system proxy settings, including certain game launchers, command-line tools, store apps, and software with its own network stack. Consider TUN mode only when the browser works normally but these apps still bypass the client. TUN creates a virtual network interface and handles a broader range of traffic, usually requiring administrator privileges, a system service, or network-extension support. Save the working state before enabling it so you can turn TUN off and quickly return to the system-proxy baseline if something goes wrong.

If enabling TUN prompts you to install a service, authorize a network extension, or restart the client, follow the prompts and then confirm that the TUN switch remains enabled. Do not run two proxy tools that provide virtual network adapters, and do not leave an older VPN occupying the default route. More advanced stack, auto-route, strict-route, and DNS hijacking settings vary by system; see the TUN and common fields guide for the relevant options.

tun:
  enable: true
  stack: mixed
  auto-route: true

A successful connection cannot be confirmed by the switch color alone. Reliable verification combines an external access result with the client’s internal records. Open a new browser window and visit a site that should use the proxy under the current configuration, confirming that the page loads completely. Then visit a site that normally connects directly and confirm that local traffic still works in Rule mode. Testing only one page can mistake browser cache, an existing connection, or a website-side outage for a proxy result.

Next, open the client’s “Connections,” “Logs,” or “Connections” page and refresh the web page you just visited. A new connection record should normally appear with the target domain, protocol, matched rule, and final strategy. The number of connections matters less than whether the domain appears and which strategy group or node receives it. If the record shows DIRECT, the current rule chose a direct connection. If it shows the selected proxy node, traffic has entered the proxy path.

If the page loads but no new connection appears in the records, first confirm that you are viewing the client currently running rather than another background instance. Then check whether the browser has its own proxy settings or a network feature that bypasses the system proxy, and confirm that the client’s system-proxy switch is still enabled. Command-line tools may ignore system proxies by default, so a working browser test and a terminal request with no record are not contradictory. To make a command-line tool use the proxy, configure its own proxy options or environment variables.

If a connection record appears but the page still cannot be reached, inspect that connection’s rule result and error type. A timeout usually calls for comparison with other nodes; a refused connection may involve the node service, target port, or local firewall; a DNS resolution failure points to the DNS path. Switch to another node in the same strategy group and reopen the page. If the new node works, the issue is isolated to the original node. If every node behaves the same way, check the subscription, network, and DNS instead of repeatedly reinstalling the client without changing the actual failure point.

When the first setup fails, do not reinstall the client, replace the configuration, change DNS, and switch among several nodes at once. Too many changes remove the basis for comparison. A better sequence follows the path from “subscription → strategy → node → system proxy → app → DNS.” After each check, retest the same target page and watch for changes in the connection record.

If the issue is still unclear after following the sequence above, record the client name, operating system, current mode, exact step where the problem occurs, and the first clear error in the logs. Then consult the Clash configuration file reference. The in-depth documentation covers ports, DNS, proxy nodes, strategy groups, rule syntax, and override merging; this quick guide stays focused on the shortest path to a first successful connection.