Clash Setup Guide
From subscription import to connection verification

Step 02 · Rule

Choose Rule Mode and a Proxy Node

Once the configuration is enabled, open the “Mode,” “Proxy Mode,” or Mode settings. Common options include Rule, Global, and Direct, typically shown in English as Rule, Global, and Direct. For an initial setup, choose Rule mode. It reads the rules in the configuration file and uses conditions such as domains, IP addresses, and application types to decide whether each request should connect directly, go through a proxy, or be handled by another policy. This is also the operating mode expected by most subscription configurations.

Global mode sends most proxyable requests through one proxy strategy. It is useful for briefly testing whether a node works, but it is not a good default when you do not understand the rules. Direct mode bypasses the proxy and is useful for pausing proxying or checking whether the client affects the local network. These modes do not change the nodes themselves; they change how requests enter the strategy groups. Keep Rule mode enabled during testing so the connection results remain clear.

After choosing the mode, open the “Proxies,” “Strategy Groups,” or Proxies page. This is usually more than a simple node list: it contains multiple strategy groups, some for manual node selection, some for automatic testing, and others for streaming media, messaging, or direct connections. Find the main manual-selection group defined by the profile. It may be called “Node Selection,” “Proxy,” “PROXY,” or a custom provider name, then choose an available node in that group.

If the client provides a latency test, use it to check whether a node can complete the test request. The number reflects one test address at one point in time; it is not the same as webpage loading speed or sustained connection quality. During initial setup, do not compare every number repeatedly. Choose a node that returns a result and matches your location requirements. If every node times out, update the subscription once and check the local network and system time before moving to the connection step.

Confirm That the Strategy Group Selection Is Saved

After clicking a node, check whether the strategy group header shows the new node name. Some clients save automatically when you leave the page, while others require another confirmation click. If the group uses automatic selection, the interface may show only the automatic strategy name rather than a specific node; you can leave that default in place. Do not change multiple strategy groups during first-time setup, or it will be difficult to identify which choice caused a later problem.

The relationship between Rule mode, strategy groups, and nodes can be summarized as follows: rules first send a request to a strategy group, and the strategy group then selects the actual node or direct action. This is the minimum configuration; just make sure Rule mode is enabled and the main strategy group has a clear selection. After the connection works, read the Configuration Field Reference to learn about strategy group types such as select, url-test, and fallback. They do not affect the current workflow.

Step 04 · Connections

Verify That Requests Follow the Rules

After connecting, do not judge the result by the switch color alone. Open a new browser tab and visit a site that normally works directly to confirm the local network is still healthy, then visit a target page that requires a proxy. If both types of pages open, the system connection, rule routing, and node path are working together. If only direct pages work, the issue is usually the proxy node, strategy group selection, or proxy rules. If no pages open, check the system proxy port, client status, and DNS first.

Then return to the client, open the “Connections,” “Sessions,” “Logs,” or Connections page, and refresh the browser again. Under normal conditions, new request records appear with the destination domain, matched rule, strategy group, or actual node name. Find the domain you just visited and confirm that it matched the expected strategy. A request that requires a proxy should enter the main proxy group, while local services or commonly direct sites may show DIRECT. This is more useful for confirming that the rules work than simply checking the exit IP address.

If a browser page opens but the connection list shows no new records, the browser may have its own proxy settings, another VPN may be active, or the system proxy may not actually point to the current client. Disable separate proxy extensions in the browser, recheck the system proxy switch, then fully quit and reopen the browser. If a connection record exists but matched an unexpected strategy, system interception is working and you should investigate the rules or strategy groups rather than reinstalling the client.

Troubleshoot Access Problems in Order

When the client shows connected but webpages do not open, check one variable at a time in this order. First, confirm that the current profile is still selected and that its update did not fail. Second, return to the main strategy group and switch to a node that completes a test. Third, turn the system proxy or mobile VPN off and on to rebuild the connection. Fourth, check whether the target domain appears in the connection records. Fifth, inspect the logs for DNS errors, connection timeouts, or port conflicts.

If switching nodes fixes the issue, the profile and system interception are basically working and the original node is currently unavailable. If the connection list contains no requests at all, focus on the system proxy, VPN authorization, and other network tools. If the request reaches the client but domain resolution fails, investigate DNS next. DNS issues should not be handled by randomly changing many options, because fake-ip, redir-host, system DNS, and TUN work together in specific ways. Use Troubleshooting based on the observed log behavior, then consult the DNS and Configuration Fields chapter when you need to verify individual fields.