Before You Begin: Get the Client and Subscription Link Ready
This guide starts with the client already installed. When you first open the app, make sure you can reach its home screen, then get a valid subscription link from your service provider. The client reads the configuration and handles the connection; installing the app does not provide working nodes. If you only have a service account, purchase receipt, or website login URL, go to your provider’s account page and find the subscription option for Clash or mihomo.
A subscription link usually contains personal access credentials, so treat it like account information. Use the copy button on your provider’s site rather than typing it from a screenshot, and never post the full link in a public comment. Parameters at the end may determine what the link returns, so don’t remove them to shorten the URL. If you need help troubleshooting, describe the error without sharing the subscription URL or node credentials.
Keep your phone connected to the internet, and leave DNS, ports, and advanced core settings unchanged for now. If another VPN, network filter, or proxy app is running, note its status and pause it before connecting. The setup takes four steps. Check the app’s feedback after each one; don’t repeatedly tap Connect before the subscription has finished downloading.
Step 1: Import a Subscription and Enable the Configuration
Add a URL Subscription on the Configuration Page
Open the client’s Configuration or Subscription page and tap the add button. It may be a plus sign in the top-right corner or an option at the bottom of the page. If you see options such as “Import from URL,” “Import from file,” or “Import from clipboard,” choose URL import for a subscription link. Give the configuration a recognizable name, such as “Daily mobile setup,” then paste the full subscription URL into the field. Check for accidental spaces or line breaks at either end.
Tap Save, Import, or Download and wait for the client to finish. You should see a new entry in the configuration list, often with its name, last-updated time, or an update button. Some apps save the link without downloading it, so you may need to tap Update separately. Enable the configuration only after the app confirms the download succeeded. Seeing a name in the list alone doesn’t mean the remote content has loaded.
If your provider’s site offers one-tap import, your phone may ask which app to open. Choose the right client, allow it to open, then check the source and configuration name in the app. After the redirect, return to the configuration list and verify the result; a browser message saying “Sent” does not confirm a successful import. If no app picker appears, use manual URL import instead.
Select the Configuration and Check That Proxy Groups Loaded
Tap the newly imported item in the configuration list and set it as active as prompted. Some apps show a check mark when it’s enabled; others require you to open its details and tap Use. Then open the Proxy or Proxy Groups page and confirm that expandable groups or outbound options are visible. If the page is still blank, first check which configuration is active rather than changing the connection mode.
If the import fails, read the exact error first. An unreachable URL, a response that isn’t a configuration, and a configuration parsing error are different problems. Try copying the link again from your provider’s site, and confirm that your account and subscription are still active. If the client says the format is unsupported, select a subscription format compatible with that client. Being able to open the provider’s website doesn’t guarantee its subscription endpoint is working, and one failed request doesn’t prove the subscription is invalid.
Keep the original configuration after your first import. If you want automatic updates, enable scheduled updates in the subscription details and follow your provider’s recommended interval; there’s no need to refresh repeatedly by hand. Proxy group names may change after an update. If a selection resets, check the group again. For more on subscription formats and core compatibility, see the protocol and core reference.
Step 2: Choose a Rule Mode and Outbound Policy
Start with Rule Mode
Once the configuration is active, return to the mode setting on the home screen or in Settings. Common options are Rule, Global, and Direct. For your first setup, choose Rule mode: the client uses the configuration’s rules to decide whether each connection goes direct, uses a proxy group, or is blocked. This preserves the subscription’s intended routing and makes it easier to check the connection log in the next step.
Global mode generally sends traffic entering the core through the global policy, but that doesn’t mean the system is routing traffic from every app. That still depends on the VPN, app exclusions, and connection settings. Direct mode usually sends traffic straight to its destination. Don’t switch repeatedly between all three modes just because a page won’t load; each mode changes how traffic is handled. Start with Rule mode, verify the basics, and change modes temporarily only when you have a specific reason.
Open the Proxy Group Used by the Rules
Open Proxy or Proxy Groups and find the group responsible for everyday outbound traffic. It may be called Proxy, Proxy Selection, or something specific to your provider. Expand it and choose an available node or an auto-select group already configured in the subscription. Check that the selection indicator changes. In some interfaces, expanding a group only shows its options; you still need to tap a specific entry to change the outbound route.
Proxy groups may also include DIRECT or REJECT. DIRECT means the connection goes straight to its destination; REJECT blocks it. Neither is a remote node. Groups can also be nested, so selecting an auto-select group doesn’t mean the final outbound name will also be “Auto Select.” For now, make sure the group handling your target traffic isn’t set to DIRECT or REJECT by mistake and has an available outbound option.
If the configuration has separate groups for video, messaging, downloads, and other uses, you don’t need to change them all at once. Identify the group used by the site you want to test and leave the others as they are. Check the connection log for the matched rule before changing that group. Rule types and matching order are advanced topics; you don’t need to edit them for your first connection. See the technical reference for more.
Step 3: Allow the VPN Connection and Connect
Allow System Permissions and Check the Connection Status
After choosing a mode and proxy group, return to the client’s home screen. Pause any other app using the system VPN, then tap Start or Connect. On Android, you’ll usually see a VPN connection request the first time. On iOS, you may be asked to add a VPN configuration and authenticate on your device. Confirm that the request comes from the client you just installed before allowing it. If you deny permission, the configuration may remain in the app, but system traffic won’t be routed through the client as expected.
After granting permission, return to the home screen and wait until the status changes to Connected or Running. The system status bar or Settings may also show a VPN icon; its location varies by OS version. The icon means the system tunnel is active, not that the remote node, DNS, and destination sites have all been verified. Make sure the client stays running, then test access in the next step rather than stopping at the icon.
On mobile, traffic is often routed through the system VPN interface, and the app may also have TUN-related options. Clients don’t all use these labels in the same way, so you don’t need to turn on every toggle to follow this guide. Start with the client’s default routing method. “Allow LAN” is usually not required for your phone to access the internet; leave it unchanged during initial setup to avoid adding extra sharing options.
If the Connection Won’t Start, Check the First Error
If the connection stops right after you tap Connect, open the logs or diagnostics and look for the earliest error from that attempt. Configuration parsing, port conflicts, VPN permission, and core startup failures need different fixes. First confirm the active configuration is valid, then check whether another app is still connected in the system VPN settings. Don’t clear the app’s data before noting the error; you may have to re-enter the subscription URL and restore your selections and local settings.
On Android, if the client supports per-app proxying, check that the browser you’re testing isn’t excluded. Some configurations proxy only selected apps; others proxy every app except those selected. The lists work in opposite ways. For your first test, use the clearly defined default scope, then set app filters after the connection works. Once system permission is granted and the client stays running, you can test real traffic.
Step 4: Verify Access and Rule-Based Routing
Check the Outbound Route with Real Requests
Leave the connection on and open a site in your browser that normally works without a proxy to make sure basic internet access is still available. Then visit a site that should use the proxy under your current configuration and wait for it to make a fresh request. Return to the client’s Connections, Sessions, or Logs page and find the domain you just visited. Check the matched rule, proxy group, and final outbound. Fields vary by app, but at minimum confirm that the request reached the client and was handled as expected.
If the rule is expected to connect directly, seeing DIRECT in the log is normal. Don’t switch to Global mode just to make every connection show a node name. If a request expected to use the proxy shows a direct route, check the matched rule and the group selection. A page loading only confirms that the request succeeded; check the log to verify routing. Likewise, one site failing could be a problem with the site itself or a particular outbound, not proof that the client isn’t working at all.
If no new entry appears, reload the page and make sure the browser isn’t excluded by an app-level rule. Some requests reuse an existing connection, and browser caching may prevent a new network request; try another page. If the client can pause logging or filter domains, check those filters too. You don’t need detailed debug logs running all the time; turn them on when troubleshooting.
Narrow Down the Problem
If neither direct nor proxied sites load, pause the connection and check that your phone’s Wi-Fi or mobile data works. Once the underlying connection is back, reconnect. If direct access works but proxied sites don’t, return to the proxy group, choose another available outbound, and retry the same page. Change one thing at a time to identify whether the issue is the network, node, or selection.
Use the logs to investigate DNS errors; don’t replace the entire DNS configuration the first time something fails. The subscription may include DNS settings designed to work with its rules, and changing them at random makes troubleshooting harder. If the logs continue to point to DNS, save a brief error summary and read the DNS and network stack reference. Your initial setup is complete once the configuration is active, the right rule and group are selected, the system connection stays up, and real requests follow the expected route.
Node Latency: Test Results vs. Real-World Performance
To compare outbounds, open Proxy or Proxy Groups and use the client’s latency or availability test. Some apps can test a whole group; others require you to start the test from each node’s menu. Wait for the results before choosing an outbound. Don’t switch between several groups while a test is running, or you may lose track of what was measured.
The value usually measures how long a request to a specific test URL takes. It isn’t necessarily an ICMP round-trip time or a measure of download speed. The test URL, DNS, TLS handshake, and your phone’s current network all affect the result. Lower latency can help you choose, but you should still open the sites or apps you actually use and check that they load reliably.
If a test times out or fails, first check your phone’s network, subscription status, and access to the test URL, then try another outbound for comparison. There’s no need to reinstall the client if only a few outbounds fail. If every test fails, check the connection status and logs. An auto-select group relies on the test mechanism in its configuration; running a manual test won’t turn a regular manually selected group into an automatic failover group.
Background Activity and Auto-Start: Configure After the Connection Is Stable
Android: Check Battery Restrictions and Startup Permissions
After completing the access tests above, lock your phone for a while, then unlock it and reopen the test page. If the connection works in the foreground but often drops while the screen is locked, open the client’s app settings and check battery management and background activity permissions. Manufacturers use different labels, such as “Unrestricted,” “Allow background activity,” or “Disable battery optimization.” Use the settings available on your device; the wording doesn’t have to match exactly.
If you want the connection to resume after a reboot, first look in the client for an option such as Connect on startup or Launch at boot, then check whether the system has a separate auto-start permission. Allowing an app to launch automatically and having it establish a VPN connection are two different things: the app may start after a reboot without loading the active configuration or connecting. After changing the settings, restart your phone when convenient and check the selected configuration, VPN status, and a real page load—not just whether the app icon appears.
Some Android versions offer Always-on VPN or an option to block connections that don’t use a VPN. The latter can cut off internet access if the client isn’t running or its configuration stops working, so it isn’t required for initial setup. First make sure the regular connection and background operation are reliable, then decide whether to enable it based on how you use the device. Review these permissions again after an OS update or switching clients.
iOS: Verify the Client’s Auto-Connect Features
iOS handles background activity and startup differently from Android. There’s no need to look for Android-style battery exemptions or boot permissions. If the client offers on-demand or automatic connection, read how its conditions work before enabling it. If there’s no such option, use the features the app actually provides. After locking your phone or switching between Wi-Fi and mobile data, check the system VPN status and load a real page to confirm the connection recovers.
Keep a simple record of your setup: the client you use, the subscription configuration name, your everyday proxy group, and how you connect. Don’t include the full subscription credentials. If something goes wrong, check in this order: underlying network → active configuration → proxy group → system connection → request log. This is usually more useful than reinstalling the app, changing DNS, and switching modes all at once. For protocol choices, core differences, and advanced rules, see the protocol and core reference. If you’re considering a different client, start with the client selection guide.