PREPARATION
Before you start: client, subscription, and system time
Before you begin, make sure the client is installed and opens normally. Windows and macOS users can start with Clash Verge Rev; mobile users should choose a compatible client for their platform. If it is not installed yet, visit the download page and choose a client for your operating system. This tutorial does not depend on a specific version, but the interface should provide basic profile management, proxy policies, runtime settings, and connection logs.
Prepare a valid subscription URL or a Clash configuration file that the client can read. A subscription URL is usually a link beginning with https://; it provides nodes, proxy groups, rules, and DNS settings to the client. It is not a regular web page, so you do not need to open it in a browser, and you should not manually split its contents into individual nodes. Import it through the client's subscription field to preserve references between proxy groups and rules.
Also check that the device date, time, and time zone are correct. An inaccurate system clock can affect TLS connections and cause certificate-time errors when updating subscriptions or connecting to nodes. If a laptop has just resumed from sleep, confirm that the network has reconnected. Completing these checks first helps prevent system issues from being mistaken for configuration problems.
STEP 01 / CONFIGURATION
Import a subscription: load profiles, proxy groups, and rules into the client
After opening Clash Verge Rev, use the left navigation to open Subscription or Configuration. Some versions may display Profiles instead. Find the field for a subscription URL and paste in the complete address. Do not add spaces or Chinese punctuation before or after it, then click Import, Add, or Update. The client will request and parse the subscription. Normally, a new profile entry appears with its name, update time, and update control.
Once the profile entry appears, do not jump straight to connecting. Click the profile and make sure it is active. Some clients show a highlighted border, checkmark, or Current label; others require opening the menu beside the profile and choosing Enable. If you only downloaded the profile without enabling it, the Proxy page may still show groups from the previous profile, and any node you select will not belong to the newly imported subscription.
Next, open the Proxy page and inspect the parsed result. You should see several proxy groups, such as node selection, automatic selection, fallback, or purpose-based groups. Names are defined by the provider, so they may not match the examples exactly. Expand a selectable group and confirm that it contains nodes, other proxy groups, or policies such as DIRECT. If the Proxy page is empty, shows only a few basic items, or reports a parsing failure, return to the Subscription page and update it again instead of enabling the system proxy.
If the subscription import fails, first check that the URL is complete, then confirm that the current network can reach it. When copying from a chat app or document, make sure no line breaks were included. You can also delete the empty profile created by the failed attempt and import again after pasting the URL anew. Errors mentioning YAML syntax, field types, or proxy-group references mean the client received the content but could not parse its structure; fix the source configuration rather than trying to repair it with a connection toggle.
After the subscription succeeds, manually run Update once and check that the update time changes. This confirms that the client can fetch future updates rather than merely reading cached content. Keep the new profile selected, then continue to step two and choose a proxy mode. For a systematic explanation of YAML sections, proxy-group references, and rule-set structure, see the protocol and core technical reference; this page focuses only on the steps needed for a first connection.
STEP 02 / ROUTING
Choose a proxy mode: start with Rule mode, then select the traffic exit
Once the profile is enabled, open the Proxy page or the mode selector on the client home screen. Common modes include Rule, Global, and Direct. For a first setup, choose Rule mode, shown as Rule. In this mode, each connection is matched against the configured rules from top to bottom, then passed to the corresponding proxy group. Requests that need a proxy can use a proxy policy, suitable direct requests can use DIRECT, and explicitly blocked requests may be handled by REJECT.
Global mode sends most traffic to one selected proxy group. It is useful for temporarily testing whether a node can connect, but it is not the best starting point for understanding rule-based configuration. Direct mode connects traffic without a proxy and is typically used to pause proxying or compare results. The mode determines the overall handling method, not the specific node, so after switching to Rule mode you still need to inspect the proxy groups.
Find the main node-selection group on the Proxy page. It may be called Node Selection, Proxy, Manual Selection, or another name defined by the configuration. Open the group and choose an available node. If the configuration provides an automatic selection group, you can choose it and let the client select an exit according to its configured tests. After selection, the group usually displays the active option. Some groups reference another group, so automatic selection, fallback, or regional groups are normal; they reflect the configuration's layered exit management.
You can use the client's connectivity test at this point, but do not treat its result as proof that the entire configuration is working. The test usually checks whether the client can attempt a connection to a node; whether browsers and other apps enter the client also depends on the system proxy or TUN settings in the next step. If every node immediately appears unavailable, update the subscription, try another network, and check the system time. If only one node fails, switch to another node in the same group and test again.
After choosing a node, avoid switching repeatedly between modes. Keeping Rule mode and one clearly selected proxy-group exit makes the verification repeatable. If the connection fails, you can then identify whether the issue lies in subscription parsing, node connectivity, system proxy settings, or rule matching. For detailed use cases for the three modes, read How do Clash Rule, Global, and Direct modes differ?; for a first setup, remember that Rule mode is the usual starting point.
STEP 03 / CONNECTION
Start the connection: enable the system proxy first, then TUN if needed
After choosing the mode and node, return to the client home screen or Settings and turn on System Proxy. It sends requests from apps that follow the operating system's proxy settings to Clash's listening port, where the active configuration applies its rules. Most common browsers on Windows and macOS read system proxy settings, making this a clear starting point for verification.
After enabling the toggle, make sure the client remains running. Desktop clients usually keep an icon in the system tray or menu bar; closing the main window does not always quit the program. However, choosing Exit from the tray menu can remove the local listening service used by the system proxy. During the first test, keep the client window open so you can inspect connection logs and errors. If the firewall asks for network access, allow the necessary local network communication according to the network you are using.
Android and iOS connections are carried through the system VPN interface. After tapping the connection button on the home screen, the system asks whether to create or connect to a VPN configuration. Once approved, the status bar usually shows a system VPN indicator. Mobile clients do not have a separate desktop-style System Proxy toggle, but the home screen should show Connected and the correct profile must remain enabled.
Some apps do not follow the system proxy, and certain command-line tools, games, or specialized network programs may connect directly. In that case, consider enabling TUN mode. TUN uses a virtual network interface to capture a broader range of traffic, but it commonly requires administrator access, network-extension approval, or system VPN permission. For a first setup, do not change System Proxy, TUN, DNS, and bypass lists at the same time. Verify a browser with System Proxy first, then enable TUN separately if your applications require it.
If enabling System Proxy immediately prevents every website from opening, turn it off to restore the previous network state. Then check whether the client core is running, whether the active profile is valid, and whether another program is using the proxy port. Do not change several settings in succession while disconnected, or it will be difficult to identify what fixed or broke the connection. Check in this order: client status, active profile, proxy mode, proxy-group node, and system proxy.
Once the connection toggle is stable, keep Rule mode unchanged and continue to verification. Do not rely only on the toggle's color: it shows that the setting was requested, not that browser traffic entered the core or matched the expected rule. Actual connection logs are the key evidence that the full path is working.
For initial browser verification
Routes traffic from apps that follow the operating system proxy settings. It is simple to configure and ideal for confirming that the subscription, node, and rules work.
For broader traffic capture
Uses a virtual network interface to handle traffic from more applications. It requires system permission and should be enabled after the basic connection works.
STEP 04 / OBSERVATION
Verify that it works: check the webpage, connection logs, and rule matches together
Open a browser, create a new tab, and visit a familiar website that normally loads reliably. If it loads, visit a target that should be handled by a proxy group. The goal is not merely to see whether a page opens, but to create two different request types so the client can show both direct and proxied rule results. Close other downloads or background tabs during testing to reduce noise in the connection list.
Return to Clash Verge Rev and open the Connections or Logs page. The list usually shows the request target, matched rule, proxy group, and final exit. Find the requests generated by the browser and confirm that they entered the client. If no new records appear, the browser may not be using the system proxy, or another proxy extension may be active. Check that System Proxy is still enabled, temporarily disable other settings that control browser traffic, and reload the test page.
If connection records appear, inspect the rule matches. Requests expected to connect directly should show DIRECT or enter a proxy group whose final choice is direct. Proxied requests should enter the configured proxy group and show the node or downstream policy selected in the previous step. If every request uses the same exit, first confirm that the client is not in Global mode. If it is in Rule mode, check that the configuration contains the relevant rule and that a broader rule did not match first.
You can also run a comparison by switching nodes: keep System Proxy enabled, choose another available node in the main proxy group, and refresh the test page. New requests in the connection list should show the updated exit. Then switch back to the original node. This verifies that the proxy-group choice affects subsequent connections rather than the page simply using browser cache. Existing connections may continue using the old exit, so judge the result by requests created after the switch.
When testing on mobile, fully close and reopen an app before testing so it does not reuse a long-lived connection created before the switch. The Android or iOS system VPN indicator should remain visible, and the client's connection page should show new records. If only one app produces no records while the browser works, the cause is usually the app's networking method or the system's traffic-routing scope. Review TUN, bypass settings, and per-app proxy options as needed.
Finally, return to the Subscription page and confirm that the active profile is still enabled. Note where the System Proxy or mobile connection toggle is located. The workflow is now complete: subscription import, mode selection, system integration, and rule verification. For everyday use, you usually only need to update the subscription periodically, choose an appropriate exit in the proxy group, and inspect connection logs when something goes wrong.
Confirm that the basic network and node connection are usable.
Confirm that app requests have entered the client's processing flow.
Confirm that direct, proxy, or blocking policies match the configured behavior.
Confirm that references between the proxy group and the specific node work correctly.
BASIC TROUBLESHOOTING
If the first connection fails, troubleshoot in order
Start troubleshooting closest to the configuration entry point instead of repeatedly switching nodes. First, check the subscription: the update should complete without errors, the new profile should be enabled, and the Proxy page should show complete groups. Second, check the mode and exit: use Rule mode and select an available node in the main proxy group. Third, check client integration: inspect System Proxy on desktop and system VPN status on mobile; check TUN only when broader traffic capture is needed. Finally, investigate deeper settings such as rules and DNS.
If the subscription updates but every node fails testing, try another network or restart the client core, then look for the first clear error in the logs. If node tests succeed but the browser produces no connection records, focus on System Proxy and the browser's own proxy settings. If records exist but website behavior is unexpected, inspect the matched rule and proxy group rather than focusing only on the node name. If some domains fail to resolve, check the configuration's DNS section, system DNS status, and whether another network tool is running at the same time.
Change only one setting at a time and generate a new test request after each change. This is slower than enabling several options at once, but it preserves a clear cause-and-effect trail. For specific error codes, subscription update failures, or TUN permission issues, visit Troubleshooting and browse by category. To compare protocol features, core relationships, and configuration compatibility, continue with the Technical Reference.