Clash for Android: How to Add Subscriptions and Switch Nodes

How Clash for Android Handles Subscriptions

Clash for Android is a client interface built around a Clash-compatible kernel. It does not provide proxy nodes by itself. The client loads a profile, reads the proxy definitions and rules inside that profile, starts a local service, and then sends selected traffic through the node or proxy group you choose. This distinction explains why installing the application is only the first step: without a valid subscription or manually created configuration, the proxy list will be empty.

A subscription is usually a provider-generated HTTPS URL containing an account identifier and an encoded configuration response. After the URL is imported, Clash for Android downloads the profile and stores it locally. The profile may contain individual nodes, proxy groups, DNS settings, rule providers, and a final routing policy. In daily use, you normally update this profile rather than re-entering every node manually.

The everyday workflow has five separate actions: import the subscription, update the profile, select a node or group, choose a proxy mode, and enable the Android VPN connection. These actions are related, but they are not the same. Updating a profile does not automatically mean the VPN is active, and turning on the VPN does not guarantee that the current group is using a working node.

• Profile: the downloaded YAML configuration that contains nodes, groups, rules, and DNS options.
• Proxy group: a selectable policy such as a regional group, an automatic test group, or a fallback group.
• Node: one concrete outbound server and its protocol parameters.
• Mode: the routing behavior, commonly Rule, Global, or Direct.
• VPN connection: Android's system-level permission and tunnel state, which determines whether applications can actually enter the Clash service.

Import a Subscription and Update the Profile

The exact menu names depend on the Android client and its version. In most Clash for Android or mihomo-based clients, the relevant area is called Profiles, Configurations, or Profile management. The important idea is the same: create a profile entry from the subscription URL, download it, and activate that downloaded profile.

1. Copy the complete subscription URL from your provider's dashboard. Make sure the copied value begins with https:// when the provider supplies an HTTPS link, and avoid copying spaces or quotation marks.
2. Open Clash for Android and enter the profile or configuration management screen. Tap the add button, plus icon, or option for adding a remote profile.
3. Paste the URL into the subscription or remote profile field. Give it a short name such as Primary-Provider so it is easy to identify later.
4. Save the entry and tap the download, fetch, refresh, or update action. Wait until the client reports that the profile has been downloaded successfully.
5. Tap the new profile to make it active. Some clients download a profile but continue running the previously selected one until you explicitly select the new entry.
6. Open the proxy or groups screen and confirm that node names and policy groups are visible. If the list is empty, the profile may have failed to parse or the provider may have returned an error page instead of a Clash configuration.

For routine maintenance, return to the same profile screen and use Update rather than Add. Providers commonly change node addresses, ports, certificates, or traffic metadata. A stale profile can therefore fail even when the subscription URL itself is still valid. Updating also refreshes rule providers when the configuration is designed to fetch them remotely, although the precise behavior depends on the profile and client.

A successful download does not prove that every node works. The provider may have returned a valid configuration while one or more servers are offline, expired, overloaded, or blocked by the current network. Always test a selected node after updating, especially if websites stop loading immediately after a profile refresh.

Choose a Proxy Group and Switch Nodes

Open the Proxies screen after activating a profile. You will usually see policy groups rather than a flat list of servers. A group may be named Proxy, Global, Auto, Fallback, Streaming, Asia, Europe, or something similar. Tapping a group opens the nodes that belong to it. Tap a node to make it the current choice for that group, then return to the group list and confirm that the selected name or check mark has changed.

Do not confuse a group name with a server name. Selecting a node inside the Proxy group changes the outbound used by that group. If the active rules point to a different group, your selection may have no visible effect. For example, choosing a fast server under Streaming will not change ordinary browser traffic if the rules send that traffic to Proxy.

Manual Selection

Manual selection is the clearest option for beginners. Choose the group used by your rules, open its node list, and select a nearby or known-working server. A node with lower latency is not automatically better: latency tests may use a small HTTP request, while real browsing, video playback, or long-lived connections can expose bandwidth limits and instability that the quick test does not measure.

Automatic and Fallback Groups

An automatic group may periodically test members and select one according to its policy. A url-test group generally measures a configured URL and chooses a result based on latency, while a fallback group uses availability checks to move to another node when the current one fails. The names and display behavior vary by client, so read the group type in the profile if the interface exposes it.

Automatic groups are convenient, but they can produce unexpected changes. The fastest response to a test URL may not be the best route to a particular service, and a node can pass a small health check while suffering packet loss under sustained traffic. For troubleshooting, switch from an automatic group to a specific node. A fixed choice makes it easier to determine whether the problem comes from the node, the rules, or the Android tunnel.

• Use a manually selected node when diagnosing a connection problem.
• Use an automatic group when several nodes are reliable and you prefer hands-off selection.
• Use a regional group when the destination requires a particular exit location.
• Keep a second known-working node available before deleting or replacing the current one.

Change Proxy Modes and Start the Android VPN

Clash for Android commonly exposes three routing modes: Rule, Global, and Direct. The labels may appear in a home screen, settings panel, or mode selector. The selected mode controls how connections are assigned after they enter Clash; it does not change the nodes in your subscription.

For most users, Rule mode is the appropriate daily setting because it follows the profile's intended routing design. Global mode is useful as a diagnostic comparison: if a site fails in Rule mode but works in Global mode, the problem may be a rule match, DNS decision, or incorrectly selected policy group. If it fails in both modes, investigate the node, network, or VPN service instead.

After selecting the mode, use the main switch or VPN button to start the service. Android normally displays a VPN connection confirmation the first time. Accepting this request allows Clash to create a local VPN interface and capture application traffic according to the client's configuration. Only one VPN service can normally be active at a time, so disconnect other VPN clients, firewall VPNs, or traffic filters before testing.

Verify the Connection Before Changing More Settings

When the VPN switch is on, do not immediately change DNS, TUN, or rule-provider options. First verify the connection in a controlled order. Start with the Clash dashboard or traffic view, open a simple website, and check whether a request appears. Then compare behavior with the VPN stopped. This tells you whether the application is entering Clash at all.

1. Confirm that Android shows the VPN key or VPN indicator and that Clash reports a running service.
2. Open the client log and load one ordinary webpage. Look for the domain, selected policy group, outbound node, and final result.
3. Check whether the request is marked DIRECT, REJECT, or with the expected proxy group. A successful request through the wrong outbound can still indicate a rule problem.
4. Test one destination that should be direct and another that should use the proxy according to the active profile.
5. If the client includes a connection test, run it against the selected node, but treat the result as a diagnostic signal rather than proof that every application will work.

Keep the test simple. Avoid testing several browsers, messaging applications, and streaming services at once because their cached DNS results and background connections can make the log difficult to read. Close the application being tested, clear only its connection state if necessary, and create one new request after changing the node or mode.

Read the Most Useful Log Fields

The log may contain more information than a beginner needs, but four fields are particularly useful: the destination domain or IP, the matched rule, the selected policy, and the final outbound. If the destination is immediately marked DIRECT, changing proxy nodes will not affect it. If it is marked REJECT, the rule intentionally blocks it. If it reaches the chosen node and then times out, focus on node availability, transport compatibility, or the local network.

DNS behavior can also affect the result. With fake-ip enabled, applications or diagnostic tools may show an address from the reserved 198.18.0.0/16 range. That is an internal mapping used by the Clash DNS module and is not the actual public address of the destination. Do not treat such an address alone as evidence that the node is broken; inspect the request and DNS logs together.

Troubleshoot Import, Node, and Connection Failures

Most Android problems fall into one of three stages: the profile cannot be imported, the profile imports but nodes fail, or the node works but applications do not use it. Identifying the stage prevents random changes that hide the original cause.

The Subscription Will Not Import

Check whether the URL was copied completely and whether the Android network can reach the provider endpoint. A browser response that displays a login page, an HTML error page, or a quota warning is not a valid Clash profile, even though the URL itself opens successfully. Confirm that the subscription has not expired and that the provider has not reached a device, traffic, or request limit. If the provider offers multiple formats, select the Clash or mihomo-compatible format rather than a generic VPN export.

The Profile Imports but the Node List Is Empty

First confirm that the new profile is active. Then inspect whether the file contains proxy definitions and groups. Some providers return a profile whose nodes are hidden behind a converter or require a separate format parameter. An empty list can also appear when the client cannot parse syntax supported by a newer mihomo release or when the remote response was truncated. Updating the client to a current maintained build and downloading the profile again is more useful than repeatedly tapping the VPN switch.

A Selected Node Fails to Connect

Switch to a second node in the same group. If only one node fails, it may be offline, expired, overloaded, or restricted by the current network. If every node fails, check the subscription's remaining quota, the Android clock, the selected profile, and whether another VPN service is active. A substantially incorrect system time can invalidate TLS certificates and make otherwise valid HTTPS-based services fail.

The Browser Works but an App Does Not

Check Android battery restrictions first. Aggressive background limits can stop the Clash service when the screen is locked. Set the client to an unrestricted or allowed background mode where appropriate, and ensure the application is not excluded from the VPN's per-app list. Some applications use certificate pinning, their own DNS mechanism, UDP-based transports, or network security policies that do not behave like ordinary browser traffic. Use the log to determine whether the app's connection reaches Clash before changing the profile.

A Practical Daily Routine for Clash on Android

Once the initial setup works, maintenance should be simple. Update the profile only when needed or according to the provider's recommended interval. After an update, confirm that the expected groups still exist and that the active group has a usable node. Leave Rule mode enabled for normal use unless you have a specific reason to compare it with Global or Direct mode.

When performance changes, record the time, network type, selected node, and mode before making changes. Wi-Fi and mobile networks can have different filtering, MTU, DNS, and IPv6 behavior. A node that works on home Wi-Fi may fail on a mobile network without any change to the profile. Switching networks is therefore a meaningful test, not just a temporary workaround.

For privacy and account safety, keep subscription URLs out of backups that are shared with other people, remove unused profiles, and avoid importing unknown configuration files. A profile can contain routing rules, DNS endpoints, external rule-provider URLs, and credentials for proxy services. Review unfamiliar configuration sources before activating them.

If you need a clean starting point, stop the VPN, export or note only the information you are authorized to retain, remove the broken profile, and add the subscription again. Reinstalling the application is rarely the first solution; it removes useful logs while leaving an expired subscription, blocked provider endpoint, or incompatible node unchanged.