Clash for Apple
Subscription & Connection Guide

STEP 01 / SUBSCRIPTION

Import a Subscription and Activate the Configuration

Open the client and go to its “Configuration” or “Subscription” page. Find the add option: some clients put it behind a plus button in the top-right corner, while others show a URL field directly. Choose import from URL and paste the full subscription URL. If a name is required, use something easy to recognize, such as “Everyday use.” The name is only for identification on this device and does not change the subscription. Check that there are no spaces, line breaks, or punctuation added by a messaging app before tapping Import, Download, or Save.

During import, the client requests the subscription URL and parses the returned configuration. Wait for a success message, then check that the new configuration appears in the list and that proxy groups or nodes appear on the Proxies page. A saved URL does not necessarily mean the configuration loaded successfully: some clients create a subscription entry even when the download fails. Open its details and check the update time, error message, or configuration preview to confirm the content was actually retrieved.

After the subscription downloads, select its configuration entry and make it active. The interface usually shows a checkmark, the active configuration name, or an enabled status. Open the Proxies page and confirm the content has changed. If it still shows the old configuration's groups, return to the configuration list and check whether you selected an item for editing rather than activating it. For your first test, keep just one active configuration to avoid confusion; there is no need to delete other saved subscriptions.

If Import Fails, Identify Where It Went Wrong

“Connection timed out” or “Could not resolve host” usually means the subscription request did not complete. Check your device's network connection, whether the URL has expired, and the provider's access instructions. “Parse error” or “Unsupported field” means the content was retrieved, but its format is incompatible with the client. Make sure you copied the subscription URL intended for your client, not an account page, purchase page, or URL that requires a browser login. If the provider offers multiple formats, choose one supported by your client and its core.

If you have a local YAML file, you can use “Import from file,” but the file is only a snapshot and may not update automatically with the remote subscription. For your first setup, don't edit node fields or delete lines that trigger parse errors. Confirm the compatible format with the subscription provider first; this is usually easier than making changes blindly. For a quick explanation of subscriptions, configuration files, and proxy nodes, see Terminology.

STEP 02 / ROUTING

Choose Rule Mode and a Proxy Exit

Once the configuration is active, open the mode menu on the home screen, in settings, or in the menu bar, and choose “Rule” or “Rule Mode.” Rule mode follows the configuration's rules to send different destinations direct, through a proxy, or reject them. It's a good starting point because it preserves the routing behavior the configuration was designed for. If the menu also offers “Global” and “Direct,” leave them alone for now. Switch modes temporarily only when isolating a specific issue, and note the original setting first.

Next, open the Proxies page to view the proxy groups. Group names are set by the configuration author and may be in any language or describe a purpose; there is no standard group named “PROXY.” Open the selection group responsible for the default proxy exit and choose an available node. If an option is itself another group, open it and confirm the final exit. If a group is set to DIRECT, its connections go direct; rule mode does not force them through a proxy node.

If the configuration includes an automatic test group, you can use it, but first run the client's latency test and check that it returns a result. The result reflects connectivity and round-trip time to a specific test URL; it does not mean every site is reachable or indicate download speed. If a node keeps timing out, switch to one that returns a result to complete your first check. Don't change the test URL, interval, and DNS all at once to chase a lower number, or it will be harder to identify the cause of any issue.

Understand Routing Modes and Traffic Entry

Rule, Global, and Direct determine how traffic is routed after it enters the core. System proxy and TUN determine how app traffic reaches the core. These settings handle different stages. Switching to Global does not capture traffic from apps that ignore the system proxy, and enabling the system proxy does not replace choosing a node. For your initial setup, keep rule mode and choose one traffic-entry method that fits your platform in the next step.

Global mode generally sends connections that have entered the core to the global policy; you still need to choose an exit for that policy. Direct mode sends connections directly and does not turn off the system proxy. To fully stop the client from handling traffic, you'll also need to disconnect and disable system integration in the next step. For more on nested groups and the difference between url-test and fallback, see proxy group terminology. You don't need to write configuration by hand for your first connection.

Once you've confirmed the settings, note the current mode and selected policy, or save a screenshot on your device that does not show the subscription URL. During connection checks, a destination may match a different proxy group. This record will help you adjust the right group instead of assuming your previous node selection wasn't saved.

STEP 03 / SYSTEM ACCESS

Enable the Connection and Grant System Permissions

Once the subscription and exit are set, enable traffic entry. Before you begin, disconnect other VPNs, proxy clients, or tools that may take over network traffic to avoid multiple apps changing system proxy settings or routes at once. Don't enable the system proxy, TUN, and several other switches all at the same time. Start with one clear connection path, then add features only if your apps need them. This makes it easier to tell whether a problem is in the configuration, node, or system integration.

iOS: Connect and Allow the VPN Configuration

Find the connection switch on the Clash Plus home screen. The first time you connect, iOS may ask to add a VPN configuration. Confirm that the request came from the client you just opened, tap Allow, and complete any device authentication required by iOS. Return to the client and wait for its status to show Connected. If you cancelled the permission prompt, tap Connect again and approve it. Don't assume the connection succeeded just because you tapped the button.

After granting permission, check the VPN configuration and connection status in the relevant section of Settings. Whether a VPN icon appears in the status bar depends on the device and interface, so don't rely on it alone. If Settings shows another app connected, disconnect it before starting this client. iOS uses system networking to route traffic; unlike desktop setup guides, you don't need to enter a local proxy port in your Wi-Fi network details.

macOS: Start the Core, Then Enable the System Proxy

Open the client, make sure its core is running, and then enable “System Proxy.” Some clients have this switch in Settings; others put it in the menu bar. When enabled, the system sends traffic from apps that follow its proxy settings to the client's local listening port. If your browser has a manually configured proxy or an extension that controls proxy settings, switch it back to using the system settings to avoid overriding this route.

If the listener fails to start or the port is already in use, check the client's actual mixed-port setting, then see whether another program is using the same port. Don't assume every client uses the same port. For local use, “Allow LAN” is usually unnecessary; it lets other devices connect to the listener and is not required to enable the proxy. See Terminology for an explanation of ports and listening addresses.

Consider TUN only if an app does not use the system proxy and your client supports TUN. macOS clients may use different mechanisms, such as helper services, virtual network interfaces, or network extensions, so the permission prompts vary. Follow the instructions for your specific app and approve the system prompts; don't disable macOS security features just to match a guide. See the all-platform setup guide for version-specific details and permissions. For your first test, system proxy is enough.

STEP 04 / VERIFICATION

Verify the Connection and Rule-Based Routing

Once the client shows a healthy connection, open a new browser tab and visit a known, normally accessible website to make sure basic browsing still works. Then visit a destination that should use a proxy under your configuration, and open the client's “Connections” or “Activity” page. Find the request and check the domain, matched rule, and policy chain. Labels differ between clients, but you should be able to tell whether a connection went direct, was routed through a proxy group, or was rejected by a rule.

To avoid misleading results from an existing connection, close the relevant page after changing policies, then make a new request. If the client can disconnect individual connections, you can disconnect just that entry instead. Don't clear all connections during a file transfer or meeting. Rule and policy changes usually affect new connections; existing ones keep using their original exit, which does not necessarily mean the setting failed to apply.

Match the Exit IP to the Connection Log

To check the exit IP, visit a trusted public IP lookup site while connected through the proxy, then compare the result with one taken while disconnected. The lookup site is also subject to your rules, so first check which policy it matched in the client. If it matched DIRECT, an unchanged exit IP is expected. An IP lookup only shows the route for that request. It doesn't prove that every app on your device uses the same route or replace testing the app you care about.

Next, test a destination that should go direct according to your configuration and confirm that its connection entry shows DIRECT. Then check the proxied destination again and compare the policy name and selected node. This verifies both that traffic is reaching the client and that rules are choosing the expected exit. There's no need for extensive speed tests during initial setup: a request that connects reliably, matches the right policy, and transfers data is enough to confirm the setup.

Troubleshoot in a Consistent Order

If the client says Connected but the Activity page shows no browser requests, first check whether the system proxy is enabled, whether the browser bypasses system settings, and whether another VPN is capturing traffic. If requests appear but a destination keeps timing out, try another working node and check whether a direct destination loads. If only one app has trouble, check whether it supports the system proxy. A working browser does not prove that every app is connected through the client.

If a connection shows REJECT, check the matched rule instead of switching nodes. If the logs show a DNS resolution error, keep the current configuration and check whether the subscription provides suitable DNS settings. Don't immediately replace them with a DNS configuration copied from the internet. Change one setting at a time and retest the same destination so you can tell whether the change helped. For in-depth DNS, TUN, or platform routing troubleshooting, follow the relevant OS section in the all-platform guide.

When reporting an issue to your subscription provider or project maintainer, include the client name, operating system, step where the error occurred, whether the destination matched a proxy, and the error text with sensitive details removed. Don't share the full subscription URL, authentication fields from the configuration, or complete logs containing private browsing records. Reproducible steps are more useful than a screenshot that only says “Connection failed.”

You've completed the four steps for your first connection. From here, update the subscription as needed and keep a verified setup as a reference. To choose a different client, return to the client list. For terms related to rules, proxy groups, and network stacks, see Terminology; you don't need to learn every configuration field for everyday use.