Beginner's Guide Seven steps, from installation to custom routing rules
From install to up and running
in just seven steps.
This tutorial walks through Clash in the order you'll actually use it: install the client, import a subscription, choose the right proxy mode, learn the main interface, enable TUN mode to take over system traffic, write your own routing rules, and troubleshoot common issues. Follow along in order and you'll be up and running in under ten minutes.
Install the Client
Download the installer for your operating system. Before running it for the first time, we recommend verifying the file's SHA-256 checksum.
Go to the download page and choose the version that matches your system: Windows / macOS users should install a GUI client directly (Clash for Windows, Clash Verge, ClashX); Android users should install Surfboard; Linux users can choose Clash Verge (ARM64) or deploy the Mihomo core themselves; iOS users need to get a compatible client from the App Store.
- Find the installer for your platform on the download page and click download.
- On Windows, if SmartScreen blocks the first run, click More info → Run anyway to continue installing.
- On macOS, if it warns of an "unidentified developer," allow it under Privacy & Security in System Settings, or run a quarantine-removal command on the core binary.
- Once installed, open the client — seeing the main interface means the install succeeded, and you're ready to import a subscription.
Tip: If you don't have a subscription yet, you'll need to purchase or request a subscription link from a proxy provider first — you'll need it for the rest of this tutorial.
Import a Subscription
A subscription link points to a config file containing all your node information, which the client automatically re-fetches on a schedule.
- Open the client and go to the Subscriptions or Profiles panel.
- Click New Subscription and paste the subscription link from your provider into the input field.
- Click Download / Update and wait for the client to fetch and parse the node list.
- After switching to this subscription, open the Nodes panel to see all available nodes.
Most clients let you set an auto-update interval (e.g. every 24 hours) so nodes don't go stale when the subscription content changes. You can also update manually at any time.
Tip: Some providers require a specific User-Agent for their subscription links. If the update fails inside the client, try opening the link directly in a browser to confirm it returns valid config content.
Choose a Proxy Mode
Clash offers three traffic handling modes that determine how connections are treated by default.
| Mode | Behavior | Best For |
|---|---|---|
| Rule Mode | Matches each connection against the configured rule list to decide direct, proxy, or block | Everyday use, balancing speed and access — the recommended default |
| Global Mode | Ignores rules — all traffic goes through the currently selected proxy node | Temporarily debugging routing issues, or when you need all traffic through a proxy |
| Direct Mode | Ignores rules — all traffic connects directly, bypassing the proxy | When you want to temporarily disable the proxy and use only your local network |
We recommend staying in Rule mode for everyday use. If you suspect a routing rule is causing an issue with a specific site, temporarily switch to Global mode to check if rules are the cause.
Get to Know the Main Interface
Layouts vary slightly between clients, but the core panels serve the same purpose.
Nodes
View all proxy groups and nodes — switch nodes manually or trigger a speed test.
Rules
View the list of currently active routing rules and the policy each one maps to.
Connections
See all active network connections in real time, along with the rule they matched and the node they're using.
Logs
View runtime logs here to see detailed error messages when troubleshooting.
Subscriptions
Manage multiple subscriptions, update nodes manually, and edit local override configs.
Enable TUN Mode
TUN mode uses a virtual network adapter to take over all system traffic, skipping the need for manual system proxy setup, and covers apps that don't support a system proxy.
- Go to the Settings panel and find the TUN Mode toggle.
- On Windows / macOS, enabling it for the first time usually requires admin privileges or installing a virtual network adapter driver — just follow the client's prompts to authorize.
- Once enabled, traffic from almost all apps on your system is automatically routed through Clash — no need to configure a proxy separately for your browser or any specific app.
- If pages won't load or you get a DNS error, try enabling the client's built-in DNS takeover feature — this usually resolves it.
Tip: TUN mode and the system proxy are mutually exclusive — use one or the other. Enabling both at once can cause traffic to be processed twice or conflict, so pick whichever fits your needs.
Write Custom Routing Rules
Rules are matched from top to bottom, and the first one hit takes effect immediately. Here are the most common rule types:
Most subscriptions already include a general-purpose rule set. Here are a few of the most common rule patterns you can add to a local override config for finer control:
rules: # Domain suffix match — routes to the proxy when matched - DOMAIN-SUFFIX,openai.com,PROXY # Domain keyword match - DOMAIN-KEYWORD,github,PROXY # Route by IP region — example uses CN (mainland China) for direct connection; swap for your own region - GEOIP,CN,DIRECT # Ad domains — blocked directly when matched - DOMAIN-SUFFIX,doubleclick.net,REJECT # Catch-all rule — any traffic not matched above goes through the proxy - MATCH,PROXY
The MATCH rule at the end acts as a catch-all — always keep it last to make sure any traffic not matched by earlier rules still has a clear destination. If you have a lot of rules, consider using a Rule Provider to bring in a well-maintained rule list instead of writing every rule by hand.
Troubleshoot Common Issues
The most common issues you'll run into during installation and use
Clash won't connect to the network at all after installation — what should I do?
First confirm the client has successfully imported a subscription and a working node is selected. Then check whether the system proxy or TUN mode is enabled. Finally, confirm the node itself is online — try switching to another node in the proxy group to test.
What if the subscription update fails or the node list is empty?
Confirm the subscription link is complete and hasn't expired, and check whether your provider requires a specific User-Agent. If the update fails inside the client, try opening the subscription link directly in a browser to see if it returns valid config content, or contact your provider to confirm the subscription status.
Why are some websites still inaccessible?
Check whether the domain is matched by a direct or block rule — you can confirm which rule was hit in the Connections panel, or temporarily switch to Global mode to test if routing rules are the cause, then go back to Rule mode and adjust accordingly.
What if pages won't load or I get a DNS error after enabling TUN mode?
This is usually caused by a DNS configuration conflict. Try enabling the client's built-in DNS takeover feature in settings, or turn TUN mode off and back on. If that still doesn't work, try restarting your network adapter or reinstalling the virtual network adapter driver.
Haven't installed the client yet?
Head to the download page and pick the installer for your system — each one comes with a SHA-256 checksum so you can verify file integrity.
Want to go deeper? →
Auto speed-testing proxy groups, subscription-based rule sets, DNS optimization, LAN sharing, and the external control panel — check out advanced usage.