Step 1: Import a Subscription and Activate the Configuration
Open Clash Verge Rev and select Subscriptions in the sidebar. Copy a subscription URL from your service provider’s account page, making sure it’s explicitly marked for Clash or Mihomo. It should be a complete URL—not a login page, a web share link, or a link for a single proxy protocol. Subscription URLs may contain access credentials, so paste them only into the client you intend to use. Don’t post them in public chats, screenshots, or support requests.
Paste the URL and Wait for the Import to Finish
Find the subscription URL field. If the current view only shows an Add button, click the plus sign and choose import from URL. Paste the complete URL, check both ends, and remove any extra spaces, line breaks, or quotation marks before clicking Import. Wait for the client to download and parse it. When the import succeeds, a configuration card should appear on the Subscriptions page, with its name and options such as Update and Edit. The name depends on the subscription or client and doesn’t need to match this guide.
Make sure the imported configuration is also active. Click its card or activation control and check that a selected indicator appears, then open Proxies and confirm that policy groups are listed. Seeing a card on the Subscriptions page alone doesn’t mean the core is using it. If Proxies is still empty, return to Subscriptions and check which configuration is selected, then look in Logs for parsing or configuration load errors. Don’t enable the system proxy yet.
Local Files vs. Subscription Updates
For a local .yaml or .yml file, use the file import option in the Add menu, select the file, and set it as the active configuration. It must be a complete, runnable configuration; a few rules or a DNS snippet won’t work as a full subscription. Local files usually don’t update automatically from your provider. When you get a new file, import it again or replace it using a method supported by the client.
If importing from a URL fails, check that the subscription is still valid, your account hasn’t expired, and your current network can reach the subscription server. Open Logs to distinguish a connection timeout or server rejection from a YAML parsing error: check the URL and network for the first two, and make sure you received the right format—not a login page—for a parsing error. Don’t submit the full subscription URL to an unfamiliar conversion site. If your provider requires a proxy to update the subscription, use an existing working connection; don’t assume a subscription that isn’t configured yet can connect by itself.
Once the initial connection works, use Update on the card to fetch changes from your provider. Direct edits to remote subscription content may be overwritten during an update, so keep the defaults for now instead of changing ports, DNS, or rules. For persistent custom settings, see Local Overrides and Combining Multiple Subscriptions in Advanced Usage. You’re ready to continue when the configuration card is selected, the expected policy groups appear on Proxies, and Logs show no errors preventing the configuration from loading.
Step 2: Choose Rule Mode and a Proxy Endpoint
Once the configuration is active, find the operating mode control and set it to Rule. Depending on the version, it may be on the home page or Proxies, and it may be labeled Rule. Rule mode uses the configuration’s rules to decide whether requests connect directly, use a proxy, or are blocked. It’s a good starting point because it preserves your subscription’s routing setup. It doesn’t automatically determine which sites need a proxy; the result still depends on your configuration and policy group selections.
Choose a Mode, Then Select an Endpoint in a Policy Group
Open Proxies and find the policy group that handles most traffic in your subscription. It might be named “Proxy Selection,” “Node Selection,” or something chosen by your provider; the name alone doesn’t tell you what it does. Expand the group to see whether it contains endpoints or another group, such as automatic selection or failover. In a manual selection group, click an option and confirm it’s selected. If you picked a nested group, expand the next level and make sure it leads to an actual working endpoint.
If the client offers a connection test, run it once for the current group as a helpful indicator. A successful test only means the test target was reachable at that moment; it doesn’t guarantee every site will work. A failed test may also mean the test address is restricted. For your first check, choose an endpoint you know works and avoid changing several groups at once. If Proxies shows only DIRECT or no options at all, go back and check the subscription rather than enabling TUN.
Rule, Global, and Direct Modes
Global mode usually sends traffic to a global policy group, but you still need to select a working endpoint in that group. Switching to Global doesn’t automatically find one. Direct mode sends requests without a proxy endpoint and is mainly useful for restoring or comparing connections. For your first setup, stay in Rule mode. Switch to Global briefly only after confirming an endpoint works and when you need to check whether a rule is the problem, then switch back to Rule.
Proxy mode and the traffic capture method in the next step do different jobs. Rule mode controls how requests entering the core are handled; the system proxy and TUN determine which requests enter the core. So even with Rule selected, your browser may still use its normal connection if no traffic capture method is enabled. Conversely, enabling TUN won’t select a policy group or fix an invalid subscription. Before moving on, confirm Rule mode is active and the main policy group has a working endpoint selected.
There’s no need to study automatic selection, load balancing, rule order, or rule-set subscriptions during your first connection. Note the group and endpoint you selected, then refer to the relevant sections in the Advanced Configuration Guide later. This avoids changing too many variables before you’ve verified the connection.
Step 3: Enable the System Proxy and Send a Request
Return to the home page or Settings. Make sure the Mihomo core isn’t stopped or repeatedly reporting errors, then find and enable System Proxy. It directs apps that support system proxy settings to the client’s local listening port. Keeping the client window open doesn’t mean the switch is enabled. Once it’s on, open a new page in your usual browser to generate a request you can inspect.
Keep the Default Port for Your First Connection
You may see a Mixed Port setting, such as 7897; use the value shown in your client and don’t change it just to match this guide. The local address and port used by the system proxy must match the listening settings of the running core. If you’ve used another proxy app, an old port may still be set in your system. Turn off the Clash Verge Rev system proxy, then turn it back on so the client can update the settings. Don’t enable the system proxy in another app at the same time.
If your browser can’t load any pages as soon as you enable the system proxy, turn it off and make sure your original connection is restored. Then check Logs for a port conflict, core startup failure, or connection refusal. For a port conflict, first check whether another program is still running or multiple instances of the same client are open. Don’t keep changing ports at random: you’d also have to update the address in any apps using manual proxy settings, making troubleshooting harder. Once the subscription works, the core is running, and the port is listening, enable the system proxy and try again.
Use TUN Only if an App Doesn’t Honor the System Proxy
Some apps have their own proxy settings, and others don’t honor the system proxy at all. If your browser works but another app still uses its normal connection, first check whether it supports a separate HTTP or SOCKS proxy. Consider Clash TUN mode only if you need to capture more traffic. TUN routes traffic through a virtual network interface and may require installing a service, granting administrator permissions, or approving a network extension, depending on your system and client version.
Before enabling TUN, keep your verified system proxy setup as a fallback. Follow the client’s instructions for services and permissions, then enable TUN and check the logs. Change only one traffic capture setting at a time, and avoid combining multiple tools, virtual adapters, and manual routes during your first test. If TUN disrupts your basic network connection, turn it off and restore the previous settings; it’s not a universal fix for network problems. Save Fake-IP, routing, and DNS details for Advanced Usage.
On mobile, import and select a configuration, then tap Start or the connect button to route traffic. The first time on Android, you’ll see a system VPN connection request. Read the prompt, grant permission, and confirm that the system shows the VPN as connected. On iOS, follow your client’s instructions to add a VPN configuration and authorize it. Resolve any conflicts with existing VPN connections first. A connected status only means traffic capture has started; check reachability in the next step.
Step 4: Verify Traffic Routing and Access
Don’t judge success by the switch color or a “Running” label alone. Open a page that should use the proxy under your current rules, then another that should connect directly. Use new tabs and refresh to avoid seeing cached pages. Next, open Connections, find the request for the domain or destination you just accessed, and check which rule matched, which policy group it entered, and which endpoint was selected.
Match the Connection Log to What You Accessed
If the page loads and Connections shows the expected rule and policy chain, you’ve verified the setup with evidence. A request marked DIRECT is following the current rules without a proxy; that isn’t necessarily an error. Check whether that site was supposed to use the proxy. Some versions remove entries soon after a connection ends, so watch Connections while refreshing the page or check the client’s connection history. Don’t reinstall the client just because the list is temporarily empty.
If the browser keeps loading and Connections shows no matching request, check whether the system proxy is enabled, whether the browser uses its own proxy extension, and whether the request was actually sent. If a connection appears but uses the wrong endpoint, return to Step 2 and check Rule mode and your policy group selection. If the endpoint is right but the connection fails, check Logs for a timeout, refusal, or parsing error. Check in this order—did the request enter, is it routed correctly, and is the destination reachable? This is more effective than changing DNS, ports, and TUN all at once.
Check Public IP and DNS Separately
To check your public IP, use a trusted IP lookup service and compare the result with traffic capture off and on. The lookup page itself is subject to your routing rules: if it connects directly, seeing your local network’s public IP is expected. Using a browser proxy only tells you how that browser’s requests are routed, not how every app is routed. Don’t assume all traffic on the device uses the same route just from the location shown on one lookup page.
Being able to browse the web doesn’t mean you’ve completed a DNS leak test. Browser secure DNS, system resolution, client DNS, and TUN traffic capture can all work differently. To get started, make sure your usual sites load and that you can explain the connection records. If you have a specific DNS isolation requirement, run a separate test using the DNS and TUN sections of the Advanced Configuration Guide. Don’t replace your current subscription with a full DNS configuration copied from an untrusted source.
Restore Your Network When You’re Done
After verifying the connection, note the configuration name, mode, main policy group, and traffic capture method so you have a known-good baseline for troubleshooting. When you’re done, turn off the system proxy or TUN before quitting the client. Force-quitting may leave your system proxy pointing to a local port. Reopen a usual website to confirm your original connection is restored. If it still won’t load, check for leftover manual proxy settings in your system rather than repeatedly reinstalling the software.
Launching at startup and enabling the system proxy automatically are separate settings. Turn them on only if you need them after verifying the setup, then do a quick check the next time you sign in. If a subscription update changes anything, check the active configuration and policy group before repeating the whole setup. You’re done: the subscription is loaded, an endpoint is selected, requests reach the core, and the traffic route has been verified.