Clash First-Time Setup Checklist for Windows, macOS & Android

1. Before Installation: Check the Client, Core, and Device Architecture

A Clash client usually consists of a graphical interface and a proxy core. The interface handles subscriptions, mode selection, and system settings; the core parses configuration, matches rules, and establishes connections. Clash Meta continued development under the name mihomo, but clients may bundle different cores and support different configuration fields. If a client claims to “support Clash,” check whether your subscription provider requires the legacy Clash format or configuration features specific to mihomo.

• Windows: In Windows 11, open Settings → System → About and check “System type.” Most Intel and AMD PCs need the x64 build; for ARM devices, choose the client’s ARM64 build if available.
• macOS: Open the Apple menu → About This Mac. Choose arm64 for Apple silicon or x64 for Intel. For a Universal installer, follow the project’s release notes.
• Android: Most modern phones use arm64-v8a, but older devices and emulators may differ. If unsure, choose the project’s universal APK and check the minimum Android version.

Before downloading, check whether the project is actively maintained and review its release notes. An app that installs may still lack support for current system permissions or newer configuration fields. For a first install, choose your platform in the download center, then note the client and core versions so you can include them when troubleshooting.

2. First Launch: Check Permissions on Each Platform

You don’t need to enable every option right away. Import your configuration first, then establish a basic connection using the system proxy or Android VPN. Desktop TUN involves a virtual network adapter, routing, and DNS, so test it separately after confirming the basic connection works.

Windows: System Proxy vs. Service Mode

The system proxy setting usually adds a local HTTP proxy address to your user settings for apps that honor it. It does not necessarily capture traffic from every game, terminal, or UDP app. TUN uses a virtual network adapter to route traffic according to its rules. Whether it requires administrator access or a service depends on the client. Don’t run every app as an administrator just because a webpage won’t load.

macOS: Verify the Source Before Handling System Warnings

Move the app to Applications before opening it. In macOS 15, check System Settings → Privacy & Security for warnings related to the app’s source. Follow the system’s steps only if the installer came from the project’s official release channel and the warning is the standard first-open restriction. If macOS says the app is damaged, contains malware, or has an invalid signature, stop and verify the download source. Don’t disable system security protections across the board.

Android: Check VPN Permission and Background Activity Separately

The first time you connect, Android asks for VPN permission. Grant it so the client can use VpnService to route traffic. Usually, only one standard VPN service can be active per user or work profile, so other VPN-based firewalls and filtering apps may conflict. If the connection drops after the screen has been locked for a while, check the app’s battery restrictions. On near-stock Android 14, go to Settings → Apps → the client → App battery usage. Menu names may differ on manufacturer-customized versions of Android.

3. Import a Subscription: Check the Format, Status, and Active Configuration

A subscription link is a way to fetch configuration—not a proxy node or a software activation key. It often contains an account token, so treat it like a password and redact the full link from screenshots, logs, and support requests. Don’t paste a private subscription into an unfamiliar online converter.

1. Check the subscription format. Choose a Clash or mihomo configuration that matches the client’s core. A Base64-encoded node list, a single share link, and a complete YAML configuration are different types of input.
2. Add a remote configuration. On the client’s Configuration or Subscription page, add a remote configuration, paste the link, and download it. Menu names vary by client, so follow the options in your version.
3. Check the download result. Confirm the update time, parsing status, and proxy groups. HTTP 401 or 403 errors usually mean you should check the token, account permissions, or service restrictions. For a timeout, first check whether your current network can reach the subscription URL.
4. Activate the imported configuration. Seeing a configuration in the list doesn’t mean it’s active. Select it, confirm that the core starts successfully, then choose an available node in the relevant proxy group.

If YAML parsing fails, check the field name and line number in the logs. The response may be a login page, a service error, or a setting unsupported by the current core. Switching nodes repeatedly won’t fix invalid configuration syntax. Fetch the correct format first instead of deleting the reported line at random.

4. Verify the First Connection: Check Rule Mode and the Proxy

For an initial test, use Rule mode and select a node in the proxy group used by the rules you’re testing. Rule mode routes traffic directly or through a proxy according to the configuration. Global mode won’t fix an unusable node, and Direct mode doesn’t mean the client is off. If TUN is still enabled, traffic may continue to pass through the local core, but use a direct outbound connection.

1. Make sure the current configuration is enabled and the core hasn’t failed to start or entered a restart loop.
2. On desktop, enable the system proxy. On Android, tap Connect and grant VPN permission. For your first desktop test, leave TUN off.
3. Run a latency test for the target proxy group, then visit a site you actually need. A successful test only confirms that the test target is reachable; it doesn’t guarantee access to every website.
4. Open the connection log and confirm that new requests appear. Check the matched rule, proxy chain, and final node. Existing connections may keep using the previous outbound route, so reconnect after switching nodes.

On desktop, explicitly specifying the local proxy can help determine whether the core can forward traffic and whether the browser is using the system proxy. The example below uses an HTTP or mixed proxy listening on 7890. This is only an example—check the actual port in the client settings first. You can also replace the target with an HTTPS address you need to test.

# Windows PowerShell
curl.exe -I --proxy http://127.0.0.1:7890 --connect-timeout 10 https://example.com

# macOS Terminal
curl -I --proxy http://127.0.0.1:7890 --connect-timeout 10 https://example.com

If you get HTTP response headers, the request received a response through the specified proxy. Interpret the status code in the context of the destination site. If the command works but the browser doesn’t, check the browser’s proxy extension and settings, then the system proxy. If the connection is refused, check the listening address, port, and core status before changing DNS.

5. Resolve Port Conflicts: Check the Process Before Changing Settings

Log messages such as address already in use or a failed bind usually mean that the listening address or port is already in use. Common causes include an old client that didn’t fully quit or two instances of the same app running at once. The commands below use TCP port 7890 as an example. Run them on the same computer as the client.

# Windows: Find the PID using the port
netstat -ano | findstr :7890
# Then find the process by PID on Task Manager’s Details tab

# macOS: Find the process listening on this TCP port
lsof -nP -iTCP:7890 -sTCP:LISTEN

• If an old proxy process is running: Quit it normally from its app before doing anything else. Don’t force-quit an unfamiliar system process.
• If you need to change the port: For example, changing 7890 to 7895 also requires updating the system proxy, any manual browser proxy settings, and proxy settings in the terminal.
• If nothing is listening on the port: Check the core logs and confirm that the configuration loaded successfully. The controller port is not a traffic proxy port, so you can’t use one in place of the other.

For local use, keep the listener bound to the loopback address and turn off LAN access if you don’t need it. HTTP, SOCKS, mixed, and controller interfaces serve different purposes. Don’t expose every listener to the network just to get a connection working.

6. Certificates, DNS, and TUN: Troubleshoot by Symptom

A Certificate Warning Doesn’t Mean You Should Install a Certificate

A standard HTTPS proxy connection typically forwards traffic through a tunnel and doesn’t require installing a root certificate from the client. If your browser reports an invalid certificate date, check the system date, time zone, and automatic time settings first. For a name mismatch or untrusted issuer, check whether you’re visiting the wrong domain, a public Wi-Fi sign-in page, or whether another HTTPS inspection app is interfering.

If a subscription download fails with a TLS error, check the subscription server’s certificate and your device’s clock. Don’t use certificate verification bypasses as a general fix, and never install a root certificate sent in a chat or offered by an unfamiliar website. On a managed work device, ask your administrator about the organization’s certificate policy.

When a Domain Fails, Identify Where It’s Being Resolved

System DNS, browser Secure DNS, the proxy core’s DNS, and DNS resolution at the remote node may all be involved. If a site won’t load, check the logs to see whether domain resolution failed or succeeded before the connection timed out. Android Private DNS and manufacturer network settings can also affect the resolution path. Note your current settings before changing one temporarily for comparison; don’t change every DNS option at once.

Enable TUN Only After the Basic Connection Works

Test desktop TUN only if you need to route traffic from apps that ignore the system proxy. Before enabling it, note your existing VPN, virtual network adapters, and DNS settings. Afterward, check the core logs, default route, and connection log. If the system proxy works but enabling TUN cuts off your connection, turn TUN back off first and investigate permissions, routing conflicts, and DNS handling instead of reinstalling the client.

7. Final Checks: Confirm Setup and Clean Exit

A successful first setup means more than seeing “Connected.” Check each item below to avoid repeating the same troubleshooting after a restart, network change, or subscription update.

• Configuration: The active configuration and its update time are clear, the logs show no recurring parse errors, and the required proxy groups have an available node.
• Traffic: New browser requests appear in the connection log, and you can tell why each one is routed directly or through a proxy.
• Clean exit: Before closing the client, turn off the system proxy or use the client’s normal exit option, then confirm that your regular network connection still works. In Windows 11, check Settings → Network & internet → Proxy for leftover manual proxy settings.
• Restart: After restarting the client, confirm that the configuration is still selected. If you enabled launch at startup, make sure it doesn’t start alongside another network tool.
• Mobile network: On Android, test again after switching between Wi-Fi and mobile data, then check that the connection stays active after locking the screen.
• When asking for help: Include your operating system, client and core versions, exact error, and steps to reproduce it. Share only the relevant log excerpt, with subscription tokens, passwords, and private addresses redacted.

When something goes wrong, keep the smallest setup that still works. Test one configuration, one node, and one traffic-routing method before adding auto-updates, TUN, or custom rules. This makes issues easier to isolate and helps you quickly return to a verified setup after configuration changes.