FlClash Setup Guide

Before You Start: Get the App and Subscription Ready

If you haven't installed the client yet, open the download center and choose a package for your operating system and processor architecture. On macOS, distinguish between Apple silicon and Intel; on Android, choose an architecture supported by your device. Open FlClash after installation and make sure you can reach the main screen. Grant network access if prompted, but don't enable multiple network-routing options at once.

FlClash is a client based on the Clash Meta / mihomo core; it does not provide proxy service. Before you begin, you need a subscription URL or a Clash configuration file with working nodes. A provider's sign-in page, plan details, and subscription URL are different things. On the provider's subscription page, choose a format explicitly supported by Clash or Mihomo. Don't paste an ordinary web page URL into the configuration.

Subscription URLs often contain personal access credentials, so keep them only on trusted devices and in trusted clients. When copying, check that the entire URL is included, with no explanatory text, line breaks, or quotation marks. Before troubleshooting, note the original state of other proxies or VPNs, then disable their network routing to prevent multiple apps from changing system proxy settings, routes, or DNS at the same time.

Step 1: Import a Subscription and Activate the Configuration

Add a Subscription Configuration

Open the Config page in FlClash, find the add button or plus icon, and choose the option to import from a URL. Paste the subscription URL and give the configuration a recognizable name, such as “Daily subscription.” If your version lets you name it only after import, import it first and rename it afterward. Check that the URL is complete, save, and wait for the client to download the configuration.

Once the download is complete, the configuration should appear in the list. Depending on your version, click the entry, use its enable option, or select its checkmark to make it active. A configuration appearing in the list does not mean it is active. Open the Proxies page and check for the proxy groups and node names defined by the subscription. If you still see old content, return to the Config page and check which entry is selected before importing again.

If the import fails, start by identifying the error. A connection timeout may mean the subscription URL is temporarily unreachable, or that leftover proxy settings on your device are blocking the download. A parsing error usually means the response isn't a supported configuration. Try copying the correct link format again from your provider's site, then update once. If the subscription returns a sign-in page, expiration notice, or plain text, it isn't a valid Clash configuration even if the URL opens.

Local Files and Future Updates

For a local file, choose file import on the Config page, select the appropriate .yaml or .yml file, then set it as the active configuration. Changing another file's extension to YAML won't make it a valid configuration: the client needs a supported structure, not a particular filename. If you don't know where a file came from, check what it does first, especially for unfamiliar remote resources or controller settings.

After your first successful connection, set an appropriate update interval for the subscription. A manual update can fetch new content when your provider changes its nodes, but it can't fix an expired subscription account. Keep subscription and local configurations distinct: the former may be downloaded again on refresh, overwriting direct edits. To keep custom rules, see the local override instructions in the Advanced Configuration Manual. For now, leave the subscription unchanged.

Before you continue: Make sure the configuration is selected, its proxy groups appear on the Proxies page, and no configuration loading errors keep appearing. Then choose a proxy mode and an exit.

Step 2: Choose a Proxy Mode and Exit

Start with Rule Mode

Return to the Dashboard, find the outbound mode, and set it to Rule. Rule mode routes connections according to the matching conditions in the active configuration: some traffic goes through a proxy, some connects directly, and some may be blocked. It's suited to everyday use, but the subscription determines how traffic is routed. Selecting Rule mode does not start routing your device's traffic through the client; you'll enable that separately in the next step.

Global mode sends regular connections entering the core to the global policy, and you usually need to select an exit for the global group on the Proxies page. Use it briefly for comparison—for example, if a site fails in Rule mode, switch to Global and try again to see whether the rules are involved. Global mode does not automatically route every app through the client. Apps that ignore the system proxy may still need TUN or their own proxy settings.

Direct mode routes connections entering the core directly. Use it to check whether your regular network works, not to test a proxy connection. These three modes only change how traffic is handled after it enters the core; they don't add a subscription or change your account status. After comparing modes, switch back to Rule so you don't leave a temporary troubleshooting setting in place.

Select a Proxy Group on the Proxies Page

Open the Proxies page and find the main proxy group referenced by your rules. Group names depend on whoever created the configuration; they may include “Proxy,” “Select,” or a custom name, so don't look for one exact label. In a manual group, expand the options and choose a node. If the selected option is another group, follow it to the next level until you can identify the final exit. If you selected DIRECT, that route still connects directly.

An automatic selection or failover group uses the health checks defined in the configuration and may not let you pin a node as a manual group does. Run the connection test available in the interface to identify candidates that are clearly unreachable. A successful test only means its test target responded; it doesn't guarantee that every site, protocol, or app will work. For your first verification, choose a known working exit manually to reduce variables from automatic switching.

Before you continue: Keep Rule mode selected and note the proxy group and node you chose. You'll compare the actual exit with this selection when checking request logs. For details on nested groups, automatic selection, and rule priority, see Advanced Proxy Group Configuration.

Step 3: Connect and Route Network Traffic

On Desktop, Start with the System Proxy

Once the configuration and exit are set, return to the Dashboard and start the core using the main connection control or start option; in some versions, this is at the bottom of the window or in a floating action button. Make sure the interface shows that it's running, then enable the system proxy. FlClash will try to point the system proxy at its local listening port. Keep the port settings provided by your subscription or client; you don't need to change them to a fixed number for this guide.

On Windows, macOS, and Linux, the system proxy mainly affects apps that follow system settings. Browsers are a good first test, but extensions, custom proxy settings, and app-specific options can override the system choice. For the initial test, use a browser window without its own proxy rules. Desktop environments and app behavior vary on Linux, so check the request log to confirm the browser is actually using the system proxy.

If your system asks for permission to change network settings, make sure the prompt comes from the client you're using, then follow its instructions. If you lose all connectivity after enabling the proxy, turn it off first and confirm your regular connection works again. Then check that the core is still running and the active configuration is valid. Don't keep changing nodes, ports, and DNS settings at once; first work out whether the local proxy isn't listening or traffic can't reach its exit.

Enable TUN Only If You Need to Route More Apps

TUN mode uses a virtual network interface and routing to capture more traffic, including traffic from apps that ignore the system proxy. First verify a browser connection through the system proxy, then enable TUN if needed. Desktop systems may require administrator access, an auxiliary service, or permission for a network component; follow the prompts for your version and operating system. A switch appearing enabled doesn't confirm that the virtual interface was created successfully. Check the status message and logs as well.

Android usually routes traffic through the system VPN interface. When you start a connection, Android asks for permission to establish a VPN connection; approve it, then return to FlClash and check its status. Stop any other active VPN app first. If Android has Always-on VPN enabled or blocks connections that don't use a VPN, check that these settings aren't assigned to another app. Keep FlClash in the foreground during your first verification; adjust battery optimization and background settings afterward.

For initial troubleshooting, don't combine the system proxy, multiple VPNs, and complex TUN routes. Get a clear result using one routing method, then add others one at a time. If you need access to local network devices or a corporate network, make sure that traffic still connects directly as expected. Virtual interfaces, Fake-IP, and DNS working together are advanced topics; see the Advanced TUN Guide.

Before you continue: Make sure the core is running and the network-routing method required by your device is enabled. Don't rely on the switch color alone; next, you'll check the full path of a real request.

Step 4: Verify Requests and the Actual Exit

Verify the Full Route with a Real Request

In a browser, open a site that should use the proxy under your current configuration, refresh it once, and wait for it to start loading. Then return to the Requests or Connections page in FlClash and look for the domain you just visited. Some versions show completed requests separately from active connections, so watch the page while refreshing if needed. Browser cache may prevent a new request, so a page loading successfully alone doesn't confirm how the connection was routed.

Expand the matching entry and check three things: the destination, the matched rule, and the final proxy group or exit. Field names and layout vary by version, but the checks are the same. For a destination expected to use the proxy, the final route should match the group or node you selected in Step 2. If it shows DIRECT, first check whether that matches the configuration's routing rules rather than assuming the client isn't running.

Now open a site that should clearly connect directly, confirm it loads, and check that its request entry matches expectations. Finally, launch the app you actually plan to use and try a real task. A successful browser test doesn't guarantee other apps will work: if the app produces no new request entry, check whether it uses the system proxy or needs TUN. Command-line tools may only read environment variables and won't automatically use the desktop proxy setting.

If It Fails, Check Each Step of the Route

If no new entries appear, first check that the core is running and traffic routing is enabled, then check the app's own proxy settings. If an entry appears but the connection fails, make sure the proxy group hasn't selected Direct or an unavailable node, then review nearby log entries. A connection timeout, DNS lookup failure, and handshake failure point to different problems; don't treat them all as subscription errors. Try a known working node for comparison, changing only one thing at a time.

If only some sites fail, temporarily switch to Global mode and retry the request. If Global works but Rule doesn't, check the matched rule and proxy group selection—but don't treat that alone as a reason to change the entire configuration. Note the domain, matched rule, and exit, then consult the Rule Configuration section. Hide subscription URLs and personal address information when reporting an issue, and never post configurations containing access credentials in public forums.

If you lose connectivity and need to restore it immediately, stop the FlClash connection, turn off the system proxy and TUN, then check whether your system network settings still point to the local proxy. Force-quitting the app may leave those settings behind after its listening service stops. On Android, check the system VPN settings to confirm the connection is disconnected. On desktop, make sure your browser can reach familiar sites over your regular network.

When you switch devices or reinstall the client, return to the subscription import steps to repeat this process. Once your everyday connection is stable, use the Advanced Configuration Manual to add custom rules, merge subscriptions, or tune DNS. Make changes one topic at a time and keep the original configuration so you can restore it.