Clash First Connection Guide: Pick a Node, Test Latency, and Verify the Proxy

Step 1: Import Your Subscription to Load the Node List

The first time you open the client, the interface is empty with no nodes at all — that's normal. Clash itself is only a proxy tool; node information comes from a subscription link, an https:// URL provided in your service provider's dashboard. The client pulls the node list from it and can refresh it on a schedule.

The entry point differs slightly by platform, but the logic is identical — four steps:

1. Copy the subscription link. In your provider's dashboard, find "Subscription URL / Subscription Link" and copy the entire string. Don't truncate it manually — every trailing parameter matters.
2. Open the client's profiles page. On Windows, it's usually "Profiles" in the left sidebar; on macOS, ClashX-style clients use the menu bar icon under "Config → Remote Config → Manage"; on mobile, tap the plus icon in the top-right of the "Profiles" page.
3. Paste the link and save. Name it whatever helps you recognize it, then tap "Download / Update" to fetch the nodes.
4. Activate the profile. A successful download only saves it locally — you must tap the profile card to make it active before node groups appear on the "Proxies" page.

Signs of a successful import: the profile card shows a node count and update time, and the Proxies page shows groups such as "Manual Select", "Auto Select", or custom groups from your provider. If the download fails, first confirm the link hasn't expired and that your local network can open web pages normally, then try again.

Step 2: The Three Proxy Modes — Know Where Your Traffic Goes

The node list is loaded, but don't click yet. First check the mode switch at the top of the client's home or Proxies page — it determines where all your traffic goes:

Beginners should stick with Rule mode. Global mode routes even sites in mainland China around the world, which is slower; Direct mode is equivalent to no proxy at all and is only useful for control tests.

Beyond the mode, there's a master switch — "System Proxy". Turn it on so browsers and most apps at the OS level hand their traffic to Clash; running the client without System Proxy is like revving an engine without engaging a gear. Some clients also offer TUN mode (enhanced mode), which takes over all device traffic through a virtual network adapter and covers apps that ignore system proxy settings. Enabling it for the first time requires authorizing a service component. Get comfortable with System Proxy first, then consider TUN.

Step 3: Choose a Node and Test Latency

Go to the "Proxies" page, where each group lists several nodes. Tap the lightning icon next to a group name (or the "Latency Test" button), and the client tests each node in the group. A few seconds later, a millisecond figure appears beside each node.

This number is the round-trip time for the client to reach a test URL through the node — it reflects latency, not bandwidth. How to read it:

• Under 300ms: healthy — fine for everyday browsing and video streaming.
• 300–800ms: usable but slow — page loads will feel noticeably sluggish.
• timeout: the node is unreachable on your current network — switch to another one.
• Low latency ≠ fast speed: during evening peak hours, the same node's latency may double — that's normal fluctuation. If it stays high long-term, switch nodes or try at a different time.

If you don't want to pick manually every time, switch the policy group to the "Auto Select / url-test" type (usually included in provider configs), and the client will automatically use the fastest node by latency. If you prefer manual selection, remember one rule: choose a node with low latency and the right geography — if the streaming service you want is region-locked, pick a node in that region.

Step 4: Verify in the Browser — the Most Intuitive Check

With the three steps above done — subscription imported, Rule mode on, System Proxy enabled, and a node with normal latency selected — it's time to verify that traffic actually goes through the proxy.

1. Check Your Current Exit IP

   Open your browser and visit an IP lookup page such as ip.sb or ipinfo.io. Note the IP and location shown.

2. Compare the Location

   If it shows the region where your node is located (a Japan node shows Japan), the proxy is working. If it still shows your local ISP's address, traffic isn't going through the proxy.

3. Toggle for Comparison

   Turn off System Proxy and refresh — the IP should revert to your real address. Turn it back on and it returns to the node's address. This back-and-forth confirms the switch truly controls your traffic.

4. Real-World Access Test

   Open an overseas site you normally can't reach. If it loads properly, the whole chain is working.

Step 5: Verify via Command Line — Ruling Out Browser Interference

Browser verification depends on the browser, which has caches, extensions, and its own proxy logic. For the cleanest result, send a request from the command line directly through Clash's local port.

First confirm the port. Open the client's settings page, find "Port" or "Mixed Port", and note the number. The common default is 7890; some clients default to 7897. The commands below use 7890 — replace it with your actual port.

Windows (PowerShell window):

curl.exe -x http://127.0.0.1:7890 https://api.ipify.org

Note: type curl.exe, not curl — in Windows PowerShell, curl is an alias for a built-in command with different parameters. Adding .exe invokes the real curl program.

macOS / Linux (terminal):

curl -x http://127.0.0.1:7890 https://api.ipify.org

If it returns an IP matching your node's region, command-line traffic is successfully going through the proxy. Now run the same command without -x:

curl https://api.ipify.org

This time it returns your real local IP. Two different IPs — verification complete.

If you want all subsequent commands in the terminal to use the proxy, set an environment variable. macOS / Linux:

export https_proxy=http://127.0.0.1:7890

Windows PowerShell:

$env:https_proxy="http://127.0.0.1:7890"

The environment variable only applies to the current window and resets when you close it — good for temporary use without changing system settings.

Step 6: Quick Fixes for Common First-Connection Issues

• All nodes timeout: update the subscription first. If they still all time out, check whether your system clock is accurate (large time drift breaks the encrypted handshake), then switch to a mobile hotspot to rule out interference from your current broadband.
• System Proxy switch flips back off: usually insufficient permissions or blocked by security software. Run the client as administrator, or add it to your security software's whitelist.
• Command line uses the proxy but the browser doesn't: a browser extension has taken over the proxy settings. Disable other proxy extensions and retry.
• Command line says connection refused: the client isn't running, or the port is wrong. Go back to the settings page and check the port number.
• UWP apps from the Microsoft Store ignore the proxy: this is Windows' loopback restriction on UWP apps. Use the client's built-in UWP loopback exemption tool to check the corresponding apps.
• Connected but extremely slow: latency tests only reflect connectivity. Real speed also depends on node bandwidth and evening peak congestion — try several nodes and compare.