Clash Beginner Guide: Airports, Subscriptions, And Nodes

Start with the four things you are actually choosing

Clash beginners often encounter four terms at the same time: client, proxy provider, subscription, and node. They are related, but they are not interchangeable. A Clash client is the application installed on your computer or phone. A proxy provider operates the servers and gives you access to them. A subscription URL is the address used to retrieve a configuration generated by that provider. A node is one individual proxy entry inside the configuration. Confusing these layers can lead to buying an application when you actually need a provider, or repeatedly importing a subscription when the real problem is an unavailable node.

The simplest way to visualize the relationship is this: the client is the control panel, the subscription is the delivery channel, and the node is the actual route used for a connection. The provider is the service behind the route. Installing Clash alone does not create an internet route, and obtaining a subscription URL does not automatically mean that every node in it will work on every network. You normally need a compatible client, a valid configuration, at least one reachable node, and a correct local routing mode.

The basic chain

Install a maintained Clash or mihomo client → obtain a legitimate subscription from a provider → import the subscription URL → select a profile and a node → start the service → verify that rules and DNS behave as expected.

Term	What it means	What it does not mean
Clash client	A graphical application that manages profiles, proxy groups, rules, DNS, and system integration	It is not a proxy server subscription
Proxy provider	A service that operates or resells proxy servers and supplies access details	It is not necessarily the same company as the client developer
Subscription URL	A URL that returns YAML, encoded configuration data, or provider-generated proxy information	It is not a single node or a permanent license
Node	One proxy endpoint with an address, port, protocol, and authentication parameters	It is not always a complete routing policy
Proxy group	A policy that selects a node, another group, DIRECT, or REJECT	It is not a server by itself

For example, a provider might give you a subscription URL that produces dozens of nodes. The imported profile may also contain groups named “Proxy,” “Auto,” “Streaming,” or “Node Selection.” When a browser opens a website, the rule may point to “Proxy,” that group may point to “Node Selection,” and the final selected item may be “Tokyo 01.” In this chain, the application is not choosing a server randomly; it is following several configuration layers.

What a first-time user normally needs

A device that supports the chosen client and its core, such as Android, Windows, macOS, or Linux.
A maintained Clash-compatible client. Many current clients use the mihomo core, which supports modern configuration fields and protocols.
A provider account or another legitimate source of proxy nodes. A client cannot manufacture working remote nodes by itself.
A subscription URL, a local YAML file, or manually entered node information.
A clear test plan for checking the profile, selected node, DNS behavior, and actual traffic path.

Do not assume that a “free configuration” found in a random post is safe or stable. A profile can contain rules that redirect traffic, DNS settings that expose requests, external provider references, scripts, or expired endpoints. Treat an unknown YAML file and an unknown subscription URL as untrusted input. Use a provider with clear terms, a visible renewal policy, traffic limits, supported protocols, and a way to revoke or regenerate access credentials.

Choose the client before importing a profile

The client determines how the configuration is loaded, which core is used, and how traffic is taken over by the operating system. On Android, the application may use Android’s VpnService to provide TUN mode and route traffic from multiple apps. On Windows and macOS, the client may offer a system proxy, TUN, startup launch, tray controls, and local API access. The same YAML can behave differently when a client lacks a required feature or uses an older core.

When comparing applications, check the core and maintenance status instead of choosing only by screenshots. A modern interface is useful, but configuration compatibility matters more. The client should clearly show the active profile, core version, running mode, connection logs, proxy groups, and update result. It should also let you stop the service cleanly and remove or disable system takeover when troubleshooting.

Requirement	Why it matters	Beginner check
Supported core	Determines available protocols, DNS features, rules, TUN behavior, and configuration syntax	Open About or Settings and identify whether the client uses mihomo or another maintained core
Profile management	Controls subscription updates, local YAML files, and the active configuration	Confirm that you can import, update, switch, and remove profiles
System integration	Allows supported applications to use the proxy without manual settings	Check system proxy and, where needed, TUN or VPN support
Logs and connections	Shows whether a request reached DNS, a rule, a group, and a node	Open the log view before testing a difficult website or application
Update controls	Prevents accidental use of an old subscription or stale provider data	Look for last update time, update errors, and the currently selected profile

System proxy and TUN are different operating modes

System proxy mode publishes a local HTTP or SOCKS address, often something such as 127.0.0.1:7890. Applications that respect the operating system proxy can send requests through it. A browser usually supports this path, but some games, command-line tools, background services, and UDP applications may ignore it. The exact port is determined by the active profile and client settings, so do not assume that every installation uses 7890.

TUN mode creates a virtual network interface through the operating system. On Android, this usually requires VPN permission. Packets from selected applications enter the interface, and the mihomo core applies DNS handling and rules before sending traffic DIRECT, REJECT, or through a proxy group. TUN can cover more applications, but it also introduces more variables: VPN conflicts, battery restrictions, private DNS, IPv6 behavior, local network access, and per-app bypass settings.

For a first test, use the least complicated mode that covers your goal. A browser-only test can begin with system proxy mode if the client provides it. If several applications need coverage and the client supports TUN reliably, enable TUN only after importing a valid profile. Android normally permits one active VPN service per user profile, so another VPN, firewall, work-profile VPN, or ad-blocking application may prevent Clash from taking control.

Understand subscription URLs and profile updates

A subscription URL is a retrievable configuration source. Depending on the provider, it may return a complete YAML profile, a provider-specific encoded format, or data that the client converts into a profile. The URL often contains an access token, which means anyone who obtains it may be able to use your traffic quota or retrieve your node list. Do not paste it into public issue trackers, screenshots, browser history shared with others, or online conversion tools that you do not trust.

Importing a subscription normally creates a profile inside the client. The profile may include proxy nodes, proxy groups, rules, DNS settings, fake-IP behavior, external rule providers, and ports. The subscription may also carry metadata such as an expiration date, traffic quota, or device limit. A successful import only proves that the client received and parsed the response. It does not prove that the nodes are reachable or that the rules match your intended traffic.

Use this order when importing

Copy the subscription URL from the provider’s account area, not from an unofficial repost.
Open the client’s Profiles or Subscriptions page and add a remote profile.
Give it a recognizable name, such as the provider name and month of import, without placing the full token in the name.
Run the update and wait for a clear success message. Record the update time and the number of parsed proxies if the client displays it.
Select the newly imported profile as active. An imported but inactive profile does not control the running core.
Open the proxy page, expand the main policy group, and choose a known node or a controlled automatic group.
Start the service and approve the system proxy or VPN permission.

Keep the original URL separately in a password manager or another protected location. If the client stores the URL in a local database, an application reset may remove it. Conversely, do not repeatedly update a profile while diagnosing a failure: a provider may change the node list between updates, making test results difficult to compare. Preserve a copy of the last working YAML if the provider and the client allow local export, but protect it because it may contain credentials.

Import result	Likely meaning	Next action
URL cannot be reached	The URL is expired, blocked, mistyped, or the device has no usable internet access	Test the ordinary network first and request a new URL from the provider if necessary
Response received but parsing fails	The returned format is unsupported, incomplete, or not a Clash-compatible profile	Check the provider’s client instructions and inspect the response only in a trusted environment
Profile imports with zero nodes	The account may be expired, the subscription limit may be reached, or the format conversion failed	Check account status, quota, expiration, and provider-side device limits
Profile imports and nodes appear, but all fail	The configuration is present, but endpoints, DNS, rules, or the network path may be unusable	Test several nodes and inspect logs before replacing the client

Do not publish your subscription token

A subscription URL is closer to a password than to a public website address. If it is exposed, revoke or regenerate it through the provider whenever possible, then update the client with the replacement URL.

Understand nodes, proxy groups, and rules

A node is one set of connection parameters. At a minimum, it may contain a server address, port, protocol, authentication information, and transport options. Depending on the configuration, it may also include TLS settings, WebSocket or gRPC parameters, Reality-related fields, UDP support, or a network-specific option. A node name such as “Singapore 02” is only a label. It does not guarantee location, speed, privacy, or availability.

Proxy groups organize nodes into policies. A selector group lets you choose manually; a URL-test group measures a test URL and selects according to latency or availability; a fallback group uses the first available item; and a load-balance group may distribute connections according to its configured behavior. The exact names and algorithms vary. “Auto” is not automatically faster, because a small latency test may not reflect sustained download speed, streaming performance, packet loss, or compatibility with a particular service.

Rules determine which policy receives a connection. A profile may match a domain, domain suffix, IP range, process, port, country rule, or rule provider. The order is important: many rule engines evaluate from top to bottom and use the first matching result. A request can therefore appear to ignore your selected proxy if an earlier rule sends it DIRECT, or it can fail because a broad rule routes local traffic into an unreachable node.

Layer	Example	Question to ask
Node	Tokyo 01, a VMess, VLESS, Shadowsocks, or Trojan endpoint	Can this endpoint complete a connection from the current network?
Proxy group	Node Selection, Auto, Streaming, or Fallback	Which node or policy is actually selected right now?
Rule	A domain suffix, IP range, or rule-provider entry	Does this request go DIRECT, REJECT, or to the expected group?
Runtime mode	Rule, Global, or Direct	Is the active mode allowing the rule system to operate as intended?

Run a controlled first connection

Stop unrelated VPN, proxy, firewall, or DNS-filtering applications temporarily.
Confirm that the active profile is the one you just imported and that it contains nodes.
Set the runtime mode to Rule if you want normal rule-based routing. Use Global only as a short comparison test.
Open the main proxy group and manually select one node rather than starting with an unknown automatic group.
Run the client’s latency or URL test, but treat it as an availability signal rather than a complete speed test.
Start the service, then open a simple website and inspect the connection or log view.
Repeat with a second node from a different region or route label. Change one variable at a time.

If the first node fails, do not immediately delete the profile. Check whether the failure affects every node or only one. If all nodes fail while ordinary browsing works with Clash stopped, inspect the subscription status, system time, DNS mode, VPN permission, and network restrictions. If one node fails and another works, the client and profile are probably functional, while the individual endpoint or route may be unavailable.

Follow a safe first-connection checklist

A beginner-friendly setup should be reversible. Before changing DNS, rewriting rules, enabling TUN, or installing a second client, record the current profile name and settings. Keep a backup of important local configuration, but do not share files that contain subscription tokens or private credentials. If a provider supplies a URL with usage limits, monitor the quota and expiration date instead of assuming that an imported profile remains valid indefinitely.

Check the local device first

Verify that the device date and time are correct. TLS-based protocols can fail when the clock is substantially wrong.
Confirm that Wi-Fi or mobile data works with the Clash service stopped.
Disable or pause another VPN service during the comparison test.
On Android, allow the VPN permission and review battery restrictions if the service stops in the background.
On desktop systems, check whether another application already occupies the configured proxy or control port.

Check the configuration and traffic path

Make sure the profile update completed successfully and the active profile is not an old local YAML.
Confirm that the main proxy group contains usable nodes and that a final node is selected.
Use Rule mode for ordinary mixed traffic, then inspect whether the request is marked DIRECT, REJECT, or proxied.
If domain names fail while local IP addresses work, investigate DNS, Private DNS, Fake-IP settings, and DNS hijacking.
If only one application fails, inspect per-app routing, bypass lists, UDP support, IPv6 behavior, and that application’s own network settings.

For a controlled baseline, test with Clash stopped, then start it and test the same website on the same network. Next, keep the client unchanged and switch only the selected node. This sequence separates local connectivity, client behavior, and node quality. Avoid changing the subscription, DNS mode, TUN mode, and proxy group simultaneously because a successful result would not reveal which change solved the problem.

Symptom	Most useful first check	Do not conclude too quickly
No internet even with the service stopped	Wi-Fi, mobile data, router, or system connectivity	The subscription is not responsible yet
Only one node fails	Select another node in the same group	The entire client is broken
Every proxied destination fails	Profile status, selected group, DNS, VPN permission, and logs	A new subscription is always necessary
Browser works but one app fails	App routing, UDP, bypass rules, and app-specific proxy support	The node has no connectivity at all
Connection is fast at first and then slows	Sustained throughput, quota policy, congestion, and battery restrictions	A low initial latency proves stable speed

Once the basic connection works, review the profile instead of blindly enabling every advanced feature. TUN is useful when applications do not honor a system proxy, but it may expose conflicts with another VPN or alter local-network access. Fake-IP DNS can improve rule matching in some configurations, while redirection or compatibility problems may require a different DNS mode. Advanced options should solve a specific coverage or compatibility problem, not be enabled simply because they are available.

The most reliable beginner path is therefore straightforward: choose a maintained client, obtain a trustworthy subscription, protect the subscription URL, import and activate one profile, select a known node, start with Rule mode, and verify the actual connection in logs or the connection list. After that baseline works, test automatic groups, TUN, DNS changes, and per-application routing one at a time. For the current installation packages, use the download page; for the initial profile and runtime sequence, follow the quick start guide.