Checklist 01 / Add a Profile
Import a Subscription and Activate the Configuration
Start with a subscription URL from a provider you trust. Make sure it's a configuration subscription for Clash or mihomo—not an account page, payment page, or text for sharing a single node. Subscription URLs often include account-identifying parameters, so treat them like login details. Don't post them in public comments, screenshots, or online conversion tools. The client reads the configuration and connects to servers; installing a client does not provide remote servers by itself.
Open the client and go to “Profiles,” “Subscription,” or a similar page. Look for “New,” “Add Subscription,” or “Import from URL.” Paste the complete link into the URL field. You can give it a short, recognizable name, such as “Daily profile.” Check for extra spaces, line breaks, or punctuation added by a chat app at either end. Don't remove the parameters after the question mark just to shorten the URL. Select “Import,” “Download,” or “Save,” then wait for the client to fetch the profile for the first time.
Select the Profile After It Downloads
A new card in the profile list doesn't necessarily mean it's active. Click “Use,” “Activate,” or the selection button, and check that the profile is marked as current. If the client asks to reload the core, follow the prompt. Then open the proxy page: the proxy groups defined by the subscription should appear. The rules page should also show a rule list or a loading status. Some profiles download rule sets and data files separately, so the first load may take a while. Don't keep clicking Update while it's in progress.
If your provider supplies a local YAML file, use “Import from File” to select it. Don't paste the entire file into the subscription URL field. Local files usually don't update automatically from a remote subscription; remote subscriptions can be updated manually from the profile page. For your first setup, update the profile once and make sure it loads before configuring an automatic update interval. An update may overwrite edits made directly to a subscription file. Use the client's override or merge feature for custom changes; you can skip that for now.
Import Failed? First Identify Where It Failed
A download timeout means the configuration hasn't been retrieved. Check your network, the link's validity period, and whether the provider requires a particular way to fetch it. A YAML parsing error, missing field, or unknown protocol means content was retrieved, but its format or core compatibility may be the issue. Opening a URL in a browser doesn't prove it returned a configuration—it could be a login page or an error message. A Base64 node list and Clash YAML are different formats; don't assume every subscription works as-is.
If the format is incompatible, ask the provider for a subscription that works with your client. Don't send the full URL to an unfamiliar conversion service. For more on format differences, see subscription URL imports and formats. The checklist is complete when the profile is selected, its proxy groups are visible, and there are no recurring parsing errors. Then move on to choosing a mode.
Checklist 02 / Choose an Outbound
Choose Rule Mode and a Proxy Group
Once the configuration loads, return to the client home screen, dashboard, or proxy settings and find the operating mode. For a first setup, choose “Rule” or “Rule Mode.” Rule mode uses conditions such as domains and addresses in the current configuration to choose how each connection is handled: some go direct, some use a proxy group, and others may be blocked. Starting the client doesn't mean all websites will use the same remote node—that's the point of rule-based routing.
The other common options are “Global” and “Direct.” Global mode sends requests that reach the core through the selected global outbound. It's useful for temporary troubleshooting, but don't leave it on without understanding the configuration. Direct mode typically connects requests that reach the core straight to their destinations. The mode controls how the core handles requests it receives; it doesn't route every app's traffic into the core automatically. “Rule mode selected” and “system proxy enabled” are two separate things.
After choosing a mode, check which group the rules actually use
Open “Proxies” or the proxy page and find the selection group used for everyday traffic in the current profile. Names vary by subscription; it might be called “Node Selection,” “Proxy,” or something else. Expand the group and choose an available node if it's a manual selection group. If it lists an auto-select group, you can choose that instead and let it run health checks as configured. The check mark, highlight, or selected value should change. Leave the page, return, and make sure the selection stuck.
A subscription may also include dedicated groups for different services. These can be selected independently or point to the main selection group. Changing the most prominent group doesn't mean every rule uses it; you'll need to check the actual outbound path when you test a request. For the first setup, leave the other groups alone. Keep the subscription's default relationships, make sure the main outbound isn't set to Direct or Reject by mistake, then verify the route with a real request.
If the client has a “Test Connection,” “Health Check,” or “Speed Test” button, you can run it once to check whether the node can reach that test destination. A result only shows that the route to that particular destination worked at that moment; it doesn't prove every website is reachable or indicate your actual download speed. A single timeout could also be caused by the test destination. Try one suitable node first instead of repeatedly testing the entire list.
Keep the Default Rules to Minimize First-Time Changes
Don't replace the subscription rules with a large block you found online. Rule references must match the group names in the configuration, and rule order can change the outbound route. Even valid YAML can fail to load or take the wrong path if names don't match. For a quick explanation of proxy groups, rule mode, and nodes, see the quick glossary. Protocol support, core families, and configuration compatibility are covered in the technical reference. For now, stick with the steps you can follow in order.
Before moving on, check that the mode is set to Rule, the main outbound group has a selection, and the core hasn't reported an error after the profile change. Note the selected group and node names. Once system traffic is connected, compare them with the actual outbound shown in the connection list.
Checklist 03 / Route Traffic
Start the Core and Connect
After choosing the profile and outbound, check the core status on the client home screen. Some desktop clients start the core on launch; others require you to click “Start” or “Connect.” Make sure it's running, then enable “System Proxy.” This tells apps that follow the system proxy settings to send requests to the local listening port. It doesn't capture all traffic on the device: some games, command-line tools, and apps with their own network settings may not use it.
If the client offers both “System Proxy” and “TUN,” start with the system proxy for your first test; it's easier to inspect. Don't enable both at once or change DNS and routing at the same time. TUN routes traffic through a virtual network interface and may require a service component or elevated permissions. Consider enabling it for specific apps only after browser requests are routing correctly. TUN support and setup requirements vary by platform.
Desktop: Start the Core, Then Enable the System Proxy
In a Windows, macOS, or Linux desktop client, open “Settings,” “Network,” or the system tray menu and enable the system proxy. Return to the home screen and make sure it stays on. Some Linux desktop environments also require apps to follow the desktop proxy settings, so a successful toggle isn't a substitute for testing. For your first setup, close other proxy tools to avoid competing system settings. If your browser has a separate proxy extension, temporarily switch it to use the system settings; otherwise, you may be testing the extension's route instead.
If a permissions prompt appears, check which operation it's for. Enabling the system proxy, installing a service component, and activating a virtual interface can require different permissions. Proceed only when you initiated that operation and the prompt is from the client you're using. Don't run every app as an administrator just because a webpage won't load. If the client says a service isn't installed, follow its instructions to install the required component, then return to the step you were on.
If the log says the listening address is already in use, stop other proxy apps that may be using the same port, then try starting the client again. The common mixed-port setting is a listening port shared by HTTP and SOCKS, but use the port specified in your profile and client settings. If you change it, make sure the port shown by the client matches any proxy port entered manually in an app. Don't treat a port number from a guide as a fixed value for your device.
Mobile: Check VPN Permission and Connection Status
In an Android or iOS client, return to the home screen and tap “Connect” or the start button. The first time, the system will usually ask to configure or connect a VPN. Check the app name and allow the request. Once connected, the client status should change and the system should show a VPN indicator. Here, VPN means traffic is routed through a system network interface; it doesn't guarantee every request uses a remote proxy. Rules still decide which connections go direct and which use the selected outbound.
If the system says another VPN is already connected, disconnect it before testing this client. After connecting, keep the client in the foreground while you complete the next step, then check whether it stays stable in the background. Android battery restrictions may affect background activity, but don't start changing battery settings before confirming the basic connection works. For help with background disconnects, repeated permission prompts, or port conflicts, see the FAQ. Troubleshoot the issue shown instead of making unrelated changes.
Checklist 04 / Test a Real Request
Check the Rule and Outbound; Verify It Works
A Connect button showing an active state only proves that a component has started. To verify the setup, check whether requests reach the core and which outbound they use. Open a new browser tab and visit a website you know is reachable to confirm the basic connection still works. Then visit a destination that should use a proxy group under your current configuration. Don't keep checking an old tab: cached content or an existing long-lived connection may not use the outbound you just selected.
Return to the client's “Connections,” “Connection,” or request log page and find the domain you just visited. Clients show different fields, but focus on the destination, matched rule, and outbound chain. The destination should match your request; the matched rule explains why that route was chosen; and the outbound chain should include the expected proxy group or node. If a rule selects a direct route, seeing DIRECT is normal. A request that doesn't use a node doesn't mean the client is broken.
Test Direct and Proxied Routes Separately
Choose two destinations expected to use different outbounds, make a new request to each, and compare them with the connection list. If both follow the configuration, the basic system routing and rule-based routing are working. An IP lookup site can provide extra context, but it only shows the outbound used to reach that site—not the routes used by other apps or domains. Check the matched rule for each connection rather than relying on whether a single IP address changed.
If the browser request doesn't appear in the connection list at all, first check that the system proxy is really enabled and that the browser isn't using a separate extension or manual proxy setting. Don't switch nodes yet: the request hasn't reached the current core, so changing the outbound won't fix the entry point. If only one app is missing, check whether it supports system proxy settings. Consider TUN if you need to route more traffic; don't switch to Global mode expecting it to capture apps.
If the request appears but uses the wrong outbound, go back to step two and check the current mode, matched rule, and proxy group selection. If the outbound is correct but the connection fails, check whether the node and service are available, then inspect the specific error in the log. A resolution error usually points to the DNS path; a connection timeout needs to be assessed against the destination and node. “Timed out” alone isn't enough to conclude there's a DNS issue. Change one setting at a time, make a new request, and check the result so you know what helped.
Reconnect Once to Finish First-Time Setup
Once basic access works, disconnect and reconnect once, then make a new web request to confirm the profile and proxy group selection are still in place. On desktop, you can also exit the client normally and check whether the system proxy is restored. If webpages stop working after exit, first turn off any leftover system proxy setting, then restart the client to troubleshoot. Don't delete the profile outright—you could lose working outbound selections and subscription details, making recovery harder.
Finally, return to the profile page and update the subscription manually once. Confirm that the expected profile is still in use and the main proxy group still has a valid selection. Set up launch at startup, background operation, and automatic updates after verifying the basic route; you don't need to configure them all during the first import. At the end, all four checklists should agree: the profile loads, Rule mode is selected, system traffic is routed, and real requests match the expected rules and outbounds.
If a page only fails occasionally, start with the relevant issue in troubleshooting by symptom. For protocol differences, mobile resource trade-offs, or mihomo configuration compatibility, see the protocol and core technical reference. Keep a working base configuration and add features one at a time; it's easier to maintain than changing the entire settings page at once.