Clash Client First-Time Install Guide: Cross-Platform Setup Checklist

A few concepts to understand before installing

Whether you're setting up a Clash-style client on Windows, macOS, or Android, the first-time hurdle usually isn't "how do I click install" — it's not having a mental model of a few basic concepts, which leaves you stuck right after install with no idea what to do next. Let's define a few terms up front so the steps below make sense.

The client is the app with a graphical interface — it manages subscriptions, switches nodes, and toggles proxy modes. Common ones include Clash Verge Rev, Clash Plus, and FlClash. The core is the actual engine doing traffic forwarding and rule matching; most mainstream clients now bundle the mihomo core (the continuation of the original Clash Meta), and the client UI is really just a "shell" around the core. A subscription is a URL — the client periodically pulls a config file containing node info and rules from that address. Installing the client alone does not give you working nodes; the subscription has to be obtained separately and imported manually.

Once those three layers are clear, the whole setup breaks down into five actions: install, import subscription, pick a proxy mode, enable system proxy, verify connectivity. Below we go through each one — what exactly to do, what the common options mean, and the mistakes beginners tend to make at each step.

The five-step setup flow

Step 1: Download and install the client

First confirm your OS and architecture. Windows users need to distinguish between the 64-bit and ARM64 builds; macOS users need to pick Apple Silicon (M-series) vs. Intel. Picking the wrong architecture can cause errors at best and a completely unlaunchable app at worst. Common installer formats include .exe, .msi, .dmg, .AppImage, and .deb — install them the same way you would any other software on that platform.

Mobile install differs slightly: Android typically installs directly from an .apk, and first-time installs require enabling "install from unknown sources" in system settings. iOS mostly goes through the App Store or TestFlight, depending on how the particular client is distributed.

Step 2: Import a subscription

After opening the client, find the "Subscription Management" or "Profile" entry (naming varies slightly between clients), paste in the subscription URL, and click "New" or "Import" to complete the addition. Most clients support two import methods:

Subscription link import: paste the URL directly and the client fetches the remote config over the network. This is the most common and lowest-maintenance method — future updates just need a click on "Update subscription" to sync the latest nodes.
Local file import: if what you have is a .yaml config file rather than a link, choose "Import from file." This method won't auto-update, though — if the nodes stop working you'll need to re-obtain the file.

After importing, remember to click "Update" or "Refresh" once to confirm the subscription pulled successfully and the node list shows actual node names rather than an empty screen.

Step 3: Pick a proxy mode

Clients generally offer three proxy modes with different behavior:

Rule mode: each connection is routed direct or through the proxy based on the rules bundled in the subscription — domestic domains/addresses go direct, everything else goes through the proxy. This is the recommended default for nearly all use cases.
Global mode: all traffic goes through the proxy node regardless of rules. Useful for temporarily testing whether a specific node works, but leaving it on long-term slows down access to local domestic sites.
Direct mode: all traffic bypasses the proxy entirely, effectively turning the proxy off.

For first-time use, we recommend sticking with rule mode — it usually needs no extra tuning to balance fast access to local sites with reliable access to sites outside your region.

Step 4: Enable system proxy or TUN mode

Having the core running doesn't automatically mean traffic is going through the proxy — the OS or individual apps still need to know "hand this traffic to Clash." There are two routes:

System proxy mode: the client automatically points the OS's HTTP/HTTPS proxy settings to its local listening port. Software that respects system proxy settings (like browsers) picks it up automatically — simple to use and the default choice for most people.
TUN mode (virtual network adapter): the client creates a virtual network interface and intercepts all traffic at the network layer, regardless of whether an app supports system proxy settings. This covers software that ignores system proxy rules (some games, CLI tools, etc.). Enabling TUN mode usually requires the client to run with admin privileges or grant certain system permissions — the OS may show a permission prompt the first time, which you should approve.

Mobile (Android/iOS) generally handles global takeover through VPN permission authorization — the first time you enable it, you'll also need to tap "Allow" on a system prompt.

Step 5: Verify connectivity

Once set up, don't close the client right away — spend a minute confirming the proxy is actually working:

Open a browser and visit a site outside your region that normally doesn't load — if it loads fine, the proxy chain is working.
Run a latency test on the currently selected node in the client's node list — a noticeably high value or a timeout means the node itself has an issue, so try a different one.
Check the client's connection log or traffic panel to confirm there are connection records going through the proxy node, rather than everything showing as direct.

If all three checks pass, the setup is fully working and you're good to use it day to day.

Common first-run pitfalls by platform

Almost every beginner runs into one of these on their platform at least once — knowing them ahead of time saves a lot of troubleshooting time.

Platform	Common issue	Fix
Windows	TUN mode won't enable, "insufficient permissions" error	Right-click the client and select "Run as administrator," or grant the required service permission in settings and restart the client
Windows	Client blocked or flagged by security software after install	Confirm you downloaded from the official release page, then add the client to your security software's trusted list and try again
macOS	"Can't be opened because the developer cannot be verified"	Go to System Settings → Privacy & Security, find the notice, and click "Open Anyway"
macOS	TUN mode asks for a password but doesn't respond	Confirm you're entering the password for your current login account, not another system account
Android	No traffic logged after granting VPN permission	Check whether battery optimization is restricting background activity, and add the client to the whitelist
iOS	Old connections still don't use the new node after switching	Manually disconnect and reconnect the VPN, or restart the client to refresh connections
Linux	No GUI feedback on whether the core launched successfully via command line	Confirm the process started by checking log output or listening ports rather than looking for a window

Common subscription mistakes

Beyond installation itself, there are a few common subscription-related misunderstandings worth avoiding early on.

The subscription link isn't the node itself: a subscription is a periodically updated config, and node info is maintained by the subscription provider — the client just runs what the subscription contains. Don't confuse "the client shows no nodes" with "the subscription itself has failed"; first confirm whether the subscription actually pulled any content.
Slow access under rule mode isn't necessarily a node problem: some sites get routed direct by the rules, and if the direct connection itself is having issues, it'll also look like "won't load." Switching to global mode as a test helps you tell whether it's a rule-matching issue or a node issue.
Node count changing after an update is normal: subscription providers adjust their node lists based on line conditions, so don't be surprised if some node names disappear or new ones appear — just re-run a speed test and pick an available one.

Habits worth keeping after setup

Once you've gone through the five steps above, day-to-day use should be smooth, but two small habits make things easier going forward: first, periodically click "Update subscription" to keep your node list and rules current; second, when a node stops connecting, try switching nodes first rather than rushing to reinstall the client — most connectivity issues come from the node itself or the network environment, not the client's settings. If you're migrating to a new client, the subscription link, rule sets, and most of your settings can be carried over directly — no need to start from scratch.