Clash Meta Subscription Import and Connection Guide

PREPARATION

Before You Begin: Client, Subscription Link, and Network

Before configuring the client, prepare three things: a Clash client for your operating system, an active subscription link, and a network connection that can reach the subscription URL. Clash Meta or mihomo parses the configuration, matches rules, and creates proxy connections, while the graphical client handles subscriptions, node selection, and system proxy controls. Different clients can use the same core, but their layouts, permission prompts, and available settings may differ.

If the client is not installed, visit the download page and choose the software for Windows, macOS, Android, iOS, or Linux. After installation, launch it once so it can create its configuration directory and required system components. Desktop systems may request firewall or network-extension permissions, while mobile systems may show a VPN configuration prompt on the first connection; these permissions are used when the connection is enabled in step three.

A subscription link is usually generated by a network service provider. It should be a complete URL beginning with https://, not a node name, login password, or web dashboard address. Copy the entire link from start to finish, avoiding extra spaces, line breaks, or Chinese punctuation. A subscription is an entry point to configuration and may contain server addresses and authorization details, so do not paste it into public forums, screenshots, or shared documents.

This guide uses a graphical client and does not require manual YAML editing. For router or server deployments, or for changes to DNS, rule providers, listening ports, or the TUN stack, go directly to the complete documentation for all platforms. Concepts such as RULE-SET, GEOIP, policy groups, and fake-ip are organized in the glossary; you do not need to master every field before making your first connection.

After opening the client, look for a “Subscriptions,” “Configuration,” “Profiles,” or “Remote Configuration” page. On desktop, it is usually in the left navigation; on mobile, it is often in the home screen’s configuration area or the top-right menu. Choose “New Subscription,” “Import from URL,” or an add button. If both a local file and URL option are available, choose URL. Local files are for YAML configurations already saved on the device and are not used in this workflow.

Paste the complete subscription link into the URL field. Use the name field for an easy-to-recognize label, such as the service name or intended use; do not paste the URL there again. Some clients show an automatic update interval. For the first setup, keep the default value and focus on getting the subscription to load successfully. After confirming the URL, click “Save,” “Import,” or “Update.”

The client will request the subscription and pass it to the core for parsing. Normally, the page then shows a new profile name, a recent update time, or a profile status. The Proxy page should also contain policy groups and node entries. This means the subscription was parsed into a usable client configuration, not merely saved. If you see a name but no policy groups, click Refresh or Update once and check for an error message.

After the import succeeds, click the new profile to make it active. Some clients use a checkmark, highlighted border, or “Enabled” label; others activate the profile automatically. Do not enable the system proxy yet. Open the “Proxy” or “Proxies” page and confirm that at least one main policy group is visible. Common names include “Node Selection,” “Proxy,” or a name chosen by the service provider.

If the import reports “Request failed,” open the subscription URL in a browser first. If the browser cannot access it, the issue is usually the link, network reachability, or service status. If the browser returns content but the client fails, check that the link was copied completely and that the client is not trying to fetch it through a proxy that has not been established. For “Parse failed” or “Invalid configuration format,” do not keep switching nodes—the nodes have not loaded yet. Copy the subscription link again and confirm that the provider supplied a configuration format recognized by Clash or mihomo.

Once the active profile is selected and policy groups are visible, step one is complete. The next goal is not to pick a node at random, but to decide how the client should handle each connection and then choose the actual exit within the policy groups.

At the top of the “Mode,” “Mode,” or Proxy page, you will usually find Rule, Global, and Direct modes. For everyday use, choose Rule mode. Each connection is then evaluated against the configured domains, IP addresses, rule sets, and final matching rule: traffic that needs a proxy is sent to a policy group, while local websites, LAN traffic, and connections marked Direct remain direct. This is the primary operating mode for subscription-based configurations.

Global mode sends most connections to one global policy group. It is useful for briefly checking whether a proxy node works or comparing different exits, but it is not a reliable way to test rule-based routing because traffic that should be direct may also be proxied. Direct mode bypasses the proxy path and is useful for pausing proxying, accessing LAN devices, or comparing network behavior before and after enabling the proxy. Switching modes does not delete the subscription, but existing connections may keep using the old path; reopen the webpage or application during testing.

After selecting Rule mode, inspect the main policy group. A subscription may provide Auto, Failover, Manual, and region-based groups. For a first setup, choose the Auto group if one is available. If only a manual node list exists, select a clearly named node that is currently available. The latency shown by the client reflects a test target at a particular moment and does not represent the actual speed of every website, so do not focus only on the lowest number.

After making your selection, review the other policy groups once. Streaming services, downloads, or specific websites may have dedicated groups whose defaults do not follow the main proxy group. There is no need to change each one during initial setup; keep the subscription’s defaults. If only one category of website later behaves unexpectedly, inspect its corresponding group. For the basics of RULE-SET, DOMAIN-SUFFIX, GEOIP, and MATCH order, see rules and routing terminology.

Perform a quick configuration check: the active profile should be the newly imported subscription, the mode should be Rule, and the main policy group should point to an automatic group or a specific node. Once all three are confirmed, proceed to the connection stage. This order separates an inactive profile, an incorrect mode, and an unavailable node, so you do not have to change several switches at once.

Return to the client home or settings page and find the “System Proxy” switch. On desktop, start by enabling the system proxy. The client points the operating system’s HTTP and HTTPS proxy settings to its local listening port, so browsers and applications that follow system proxy settings pass their connections to the Clash Meta core. The switch will usually change color or show “Enabled”; keep the client running in the background.

Windows and macOS users should wait a few seconds after enabling the proxy, then open a new browser window. If the browser was already running with old connections, close the relevant tabs and try again. Linux desktop support varies: some applications read the desktop proxy settings, while others require separate environment variables. For the first test, use a browser known to follow system proxy settings. See the Linux chapter in the complete documentation for more detailed desktop and command-line setup.

Android and iOS clients typically do not show a desktop-style “system proxy.” Instead, they route connections through the system VPN interface. Tap the start button on the home screen and approve the VPN configuration request. A VPN icon in the status bar only confirms that the network interface was created; step four is still needed to verify that traffic passes through the node. If the mobile OS restricts background activity, allow the client to keep its VPN service running, or the connection may be reclaimed after locking the screen or switching apps.

TUN mode captures traffic from applications that ignore system proxy settings, as well as some UDP, command-line, and game traffic. Desktop clients commonly place it under “Service Mode,” “Enhanced Mode,” or “TUN.” If the system proxy is sufficient for browser use, leave TUN disabled for now; running multiple traffic-capture tools makes troubleshooting harder. When TUN is necessary, follow the client’s instructions to install its service component or grant administrator permission, and keep only one client responsible for capturing traffic.

If enabling TUN immediately cuts off the network, disable TUN first and check whether the system proxy still works. Common causes include incomplete network-extension permissions, another VPN occupying the interface, DNS conflicts with the local network, or an old service component that did not exit cleanly. During initial setup, do not repeatedly change the TUN stack, DNS mode, and route exclusions. Return to the system proxy and establish one verifiable basic path before expanding traffic capture for specific applications.

At the end of the connection stage, the client should be running, the system proxy or mobile VPN should be enabled, and the active profile and policy group should still match the choices from step two. Do not rely solely on an “Connected” label; check the actual result through the external address, client records, and rule matches.

Before enabling the proxy, note your current external address or approximate region. Then enable the connection and use a new browser tab to visit a familiar external-address lookup page. If the displayed exit information changes to the region associated with the selected node, browser traffic has entered the proxy path. Do not rely on one test page alone; caching, browser extensions, or a site’s own geolocation method can produce differences, so use another lookup page for confirmation.

Next, open the client’s “Connections” or log page and visit a new website. You should see a new connection record containing the target domain, matched rule, and final policy. In Rule mode, external services may show a proxy policy, while frequently used local websites may show DIRECT. Different requests being sent through different exits demonstrates that rule-based routing is working, rather than merely confirming that a global proxy can open webpages.

Test three types of destinations: an external website that needs a proxy, a site you normally access directly, and a router or shared device on your LAN. The first two show how proxy and direct rules behave; the third confirms that LAN traffic is not being sent through the proxy by mistake. If the external site works but local sites become noticeably slower, check whether Global mode was selected accidentally. If the browser works but another application does not, that application may ignore system proxy settings; consider TUN then, rather than importing the subscription again.

Also check DNS behavior. The clearest signs are stable domain resolution, no long pause before the first page opens, and new connections being established after switching nodes. If an IP address works but the domain name does not, the issue is more likely DNS than the node itself. DNS enhanced-mode, fake-ip, nameservers, and filter lists behave differently across systems and LAN environments. For this topic, continue with the configuration issues chapter in the complete documentation.

Finally, perform a reverse check: disable the system proxy or stop the mobile VPN, reopen the address lookup page, and confirm that the exit returns to the original network. Enable the connection again and observe the change. This rules out browser cache and stale connections and confirms that the client switch controls the traffic path. If traffic is still proxied after closing the client, check for leftover system proxy settings or another network tool still running.

Ongoing Use: Update Subscriptions and Handle Problems

You do not need to import the subscription again every day. Open the client, confirm that the current profile is still active, and enable the system proxy or VPN. When the subscription changes, return to the subscription page and click Update. Afterward, check whether the policy groups kept their previous selections. If the provider deleted or renamed a node, the client may revert to the group default, so select a node again.

Connections already established will not always migrate immediately after you switch nodes. Browser downloads, video playback, and long-lived applications may continue using the old exit until their connections close. When testing a new node, refresh the page, restart the relevant application, or close old connections from the client’s connection list. Frequent mode and node changes mix the results together; for troubleshooting, keep Rule mode fixed, replace only one node, and record the change.

When a connection fails, work backward through this guide: first inspect the connection records and matched rules from step four, then confirm the system proxy or VPN status from step three, review the mode and policy group from step two, and only then update the subscription from step one. Change one condition at a time to make the cause easier to locate. For ports, LAN access, TUN routing, DNS leak prevention, rule-set overrides, or server deployment, open the complete documentation instead of changing too many parameters after the basic setup already works.