Clash for Android Quick Start: Subscriptions, Modes, Connections, and Verification

This guide applies to Clash Meta for Android and similar Android clients that can read Clash or mihomo configuration files. Before starting, prepare an Android device with internet access, an installed client, and a valid Clash configuration subscription URL. The URL is usually generated by your network service provider. It may look like a regular web address, but it returns YAML configuration or converted configuration data.

If the client is not installed yet, visit the Android download page and choose the appropriate app. After installation, open the client once to confirm that the home screen loads and that you can find entries such as Proxy, Configuration, Overrides, Logs, or Settings. Labels vary between projects; Configuration may also appear as Config File or Profiles. The goal is the same: have the client obtain and enable a usable configuration.

A subscription URL is a credential for accessing configuration data and should be stored only on trusted devices and apps. Preserve the entire string when copying it, including the protocol, path parameters, and final characters. If your provider offers multiple subscription formats, choose one explicitly labeled Clash, Clash Meta, or mihomo. Generic links and formats intended for other proxy tools may not be parsed directly; generate a compatible configuration on the provider's site first.

Also check whether Android is already running another app that uses the system VPN interface. Android normally allows only one VPN service to occupy that interface. If another network-control tool is still connected, Clash may be unable to establish a tunnel. After completing these checks, import the subscription from the Configuration page to reduce the chance of an empty configuration or failed startup.

Open the client home screen and go to the Configuration or Profiles page. The list is usually empty on first use. Tap the add button in the upper-right corner, then choose to import from a URL, remote file, or subscription. Do not choose to create a local configuration: that option is mainly for writing YAML manually, while this workflow requires the client to download the complete configuration prepared by the provider.

On the import page, paste the subscription URL into the URL field. Use a service name, purpose, or device name for the profile name—anything that will be easy to recognize later. The default update interval is fine to start with; if you need to enter one manually, 1440 minutes, or once per day, is common. An update only downloads the configuration again; it does not necessarily replace the policy selection currently in use, so continue to monitor the subscription status and active policy group.

After checking the details, tap Save or Download. The client will request the subscription URL and parse the configuration. On success, the configuration list will show the name you entered and may display its latest update time. Select this profile and make it active. Some clients use a radio marker to indicate the active profile; others require you to open the item menu and choose Enable. Return to the home screen and confirm that the newly imported name appears in the title or configuration status area.

If no new item appears after saving, do not keep tapping Start. Return to the import page and check that the URL is complete. Also confirm that the phone browser can open your provider's subscription management page. A format error usually means the response is not a compatible Clash configuration or that the subscription has expired. Return to the provider's site and generate a Clash Meta or mihomo format instead of editing unknown fields in the client.

After the configuration downloads successfully, open its details to inspect the basic structure. A usable configuration usually contains proxies, policy groups, and rules. Policy groups determine which outbound connection handles a type of traffic; rules determine which policy matches a domain or IP. You do not need to read the YAML line by line at first—just confirm that policy groups appear on the Proxy page. See Concepts at a glance for categorized definitions of profiles, policy groups, and rules.

At this point, the client has the configuration needed to handle traffic. Next, decide how rules should route it. For a first setup, Rule mode is usually the best choice because it uses the routing logic already included in the subscription without requiring you to understand every rule.

Open the Proxy page and find the running mode or mode selector. Common modes include Rule, Global, and Direct. For a first setup, choose Rule mode. The client reads the configuration rules from top to bottom and sends requests to the corresponding policy group based on domains, IP addresses, geographic information, or process conditions. Common sites may use Direct as configured, while requests requiring a proxy enter the proxy policy; connections that match no earlier rule are handled by the final MATCH rule.

Global mode sends most connections through a single proxy policy. It is useful for briefly checking whether the proxy tunnel works, but it is not the best default when you are unfamiliar with the configuration. Direct mode sends traffic straight to the destination and is useful for temporarily bypassing proxy rules or troubleshooting the local network. These modes change traffic handling only; they do not delete the subscription or modify the configuration, and you can switch back to Rule mode at any time.

After selecting Rule mode, review the policy groups on the Proxy page. Groups are often named by purpose, such as proxy selection, automatic selection, streaming media, or fallback. Open the primary proxy selection group and choose an available proxy supplied by the provider or an automatic testing group. If the group contains DIRECT, REJECT, and several proxy entries, use the group name to determine its purpose. The main proxy group normally needs a proxy entry, while an ad-blocking group may be preset to REJECT.

The policy group type determines how selections are changed. select requires a manual choice; url-test periodically selects a result using the configured test URL; fallback looks for an available outbound connection in order; load-balance distributes connections according to its configured strategy. During quick setup, just confirm that the main selection group has valid options. There is no need to change the test URL, tolerance, or load-balancing algorithm. See the policy group chapter in Advanced configuration for detailed field documentation.

If the Proxy page is completely empty, the issue is usually not the mode selection but that the active configuration was not enabled successfully. Return to Configuration, confirm that the imported item is marked active, and reopen Proxy. If group names appear without selectable options, try updating the subscription once manually. If they remain empty, check whether the subscription contains proxy definitions. Do not invent server addresses or authentication fields without the original information.

After choosing the mode and policy group, return to the client home screen. The current configuration name should be visible, the proxy mode should be Rule, and the main policy group should have a clear selection. Next, start the Android VPN service so the client can receive network traffic from the device.

Tap Start on the client home screen. The first time this type of client starts on Android, the system displays a VPN connection request. The dialog usually explains that the app wants to set up a VPN connection and may show a key-shaped system icon. Confirm that the app name matches the installed client, then tap Allow or OK. Android manages this permission at the system level; only after approval can the client create the virtual network interface used to take over traffic.

After granting permission, return to the home screen and wait for the Start button to change to Stop, Running, or Connected. A VPN indicator will usually appear in the system status bar as well. Do not immediately change DNS, Overrides, or advanced TUN options. First complete a basic verification using the configuration's defaults. The configuration usually already defines the DNS, rules, and policy group relationships, while adding overrides too early makes troubleshooting harder.

Some clients let you choose between the system proxy and TUN mode. On Android, the usual startup method already captures app traffic through the VPN service, while TUN settings may also include auto-route, strict-route, and DNS hijacking options. For the first connection, use the client's default approach. Consider changing TUN only when a specific app bypasses the proxy, the system proxy cannot cover the target traffic, or the configuration documentation explicitly requires it. See TUN and Fake-IP in Advanced configuration for implementation and compatibility details.

If tapping Start does not bring up the system permission dialog, check whether the client already has VPN permission or whether Android retained the previous authorization. If the status changes to Running briefly and then stops, open Logs and inspect the errors at the end of the startup sequence. Configuration parsing failures often identify a field or line number; port conflicts, a busy VPN interface, and DNS initialization failures leave corresponding entries. Address the first clear error rather than switching several settings at once.

Also check Android's battery management. Some Android systems restrict background apps after the screen turns off, so a connection may work initially and then pause after the device is locked. Open the app's system information page and find the battery or background activity settings, then allow the client to remain active as needed. Menu names vary by manufacturer, but the goal is to prevent the system from stopping the VPN service too soon.

Once the client stays running, traffic can enter the rule-processing flow. The final step is not repeatedly running latency tests; confirm that the main policy group has a selection, the target request loads, and, when needed, use Logs to identify which rule matched it.

Return to the Proxy page and confirm that the main policy group still shows the proxy or automatic selection group you chose. Then open a browser and visit a site that normally loads directly to confirm that the local network remains available. Next, visit a site expected to be handled by proxy rules and check whether it loads normally. If both types of access work, the Direct rules, proxy rules, and DNS resolution have usually formed a functioning baseline.

For a closer check, open the client's Logs page. Keep it open while you make another request to the target site in a browser. Logs typically show the domain, connection type, matched rule, and final policy group. If the target domain matches DOMAIN-SUFFIX or a ruleset and is sent to the expected proxy group, Rule mode is working. If the log shows DIRECT, check whether a Direct rule matched the domain earlier.

The default log level is sufficient. Debug logging provides more detail for complex issues, but it should not be left on during routine first-time verification. Read from the newest requests backward and focus on DNS, timeout, connection refused, rule match, and configuration-loading messages. A single retry does not necessarily indicate a broad failure; consider whether the target site and other requests work normally.

If the client shows Running but no webpage opens, switch back to the Wi-Fi or mobile network that normally works on the phone and confirm that the basic connection is healthy. Then check whether the subscription has expired, whether the main policy group points to a valid option, and whether DNS has been overridden. If only certain apps fail, check whether the client's app-routing feature excludes them or whether another local VPN or Private DNS conflicts with the current settings.

If Direct sites work but proxied destinations do not, temporarily switch to Global mode for comparison. If access still fails in Global mode, the likely cause is the selected proxy, subscription status, or the route itself. If Global works but Rule mode does not, inspect rule matching and policy group references. Switch back to Rule mode after the comparison so a temporary troubleshooting state does not become the everyday setting.

If only domain-based access fails after startup while direct IP connections respond, the problem is usually in the DNS resolution path. Do not change several DNS fields at once. First remove any recently added local override and reload the original configuration. If further investigation is needed, review the relationship between nameserver, fallback, Fake-IP, and DNS hijacking in the DNS configuration chapter in Advanced configuration.

When the client stays Running, Rule mode remains selected, the main policy group has a clear outbound choice, and the logs show the target request matching the expected rule, the first setup is complete. You do not need to re-import the subscription every time you use the phone. Usually, just start the client and update the subscription when your provider publishes a new configuration.

For everyday use, keep a confirmed working configuration active. When your provider changes the proxy list or rules, open Configuration and tap Update. Afterward, check the update time and confirm that the correct configuration is still active. Some clients reload automatically after an update; others require one stop-and-start cycle. If policy group names change, revisit Proxy and confirm the main group's selection.

To import a second subscription, add a new configuration instead of overwriting the existing one. Give it a clear name and return to the home screen after switching to confirm the active configuration name. This makes it easy to switch between purposes and quickly return to the original configuration if the new one has parsing problems. Before deleting an old configuration, make sure the other one starts and provides working access.

Overrides are useful for changing selected parameters—such as DNS, listening ports, or specific rules—without editing the remote subscription directly. During initial setup, leave them disabled because overrides layer on top of the subscription and remain active through later subscription updates. If behavior no longer matches the original configuration after an override was enabled, include its status in the troubleshooting checklist.

External control, domain sniffing, merging multiple subscriptions, managing rulesets as subscriptions, and complex TUN routing are all Advanced configuration topics. They can address specific network environments but are not required for a basic connection. For further changes, consult the Advanced configuration guide by chapter. When you encounter an unfamiliar field, check its meaning in Concepts at a glance before changing the parameter.