First-Time Clash Setup: Windows, macOS, Android & iOS Install Guide and Common Pitfalls

Before You Install: System, Installer, Subscription Link

When setting up Clash for the first time, order matters more than speed. Get your system version, installer, and subscription link sorted first, and everything after goes smoothly. The workflow is nearly identical across all four platforms: install the client, import your subscription, pick a mode, and turn on the system proxy. The only real differences are each OS's permission prompts and background-process quirks.

• Check your OS version. Windows 10 or later, macOS 11 or later, Android 8.0 or later, and on iOS you'll need an Apple ID from a region where the app is available. Older versions may fail to install or crash repeatedly, so update your system first.
• Grab the installer. Pick the build for your platform from the download center. On Windows and macOS, favor a client built on the mihomo (Clash Meta) core that's still actively maintained—it supports more protocols and causes fewer headaches down the line.
• Have your subscription link ready. This is the full https:// URL your provider gives you. Import it into the client to load your node list. Without a subscription, even a perfectly installed client is just an empty shell.

Install Notes for Each Platform

Installing on any of the four platforms is straightforward—the real differences show up in the first-run permission prompts. Check the table below for your platform's key step, then read the platform-specific details.

Windows

For the installer version, just click through the setup steps. For the portable build, extract it to a path with no special characters, e.g. D:\Apps\Clash, then manually create a desktop shortcut—unusual characters in the path can cause certain components to misbehave. If Windows Firewall prompts appear on first launch, allow access on both Private and Public networks, or LAN sharing and TUN mode will run into trouble.

macOS

Open the dmg and drag the client into "Applications." If you see "cannot verify the developer" on first launch, don't keep double-clicking the icon—go straight to System Settings › Privacy & Security, find the prompt near the bottom, and click "Open Anyway." The first time you enable the system proxy, macOS will ask for your login password to install a privileged helper that manages proxy settings. This is normal and only happens once.

Android

After installing the apk, the first time you connect, Android will show a "VPN connection request"—you must tap Allow, since this is required by Android for all VPN-type apps; refusing means the proxy can never be established. Next, go to system settings and set the client to "unrestricted" battery usage, otherwise the process may get killed after the screen locks, which shows up as random disconnects.

iOS

The App Store in mainland China doesn't carry this kind of client, so you'll need an Apple ID from another region to download and install it. The first time you turn on the proxy, iOS will prompt "Add VPN Configuration"—tap Allow, and a VPN icon will appear in the status bar once the tunnel is up.

Importing Your Subscription: Getting the Node List to Show Up

A freshly installed client is empty—you need to import a subscription before any nodes appear. The menu labels differ slightly across platforms, but the steps are identical:

1. Copy the subscription link your provider gave you in full, start to finish, with no extra spaces or truncation.
2. Open the "Profiles" tab in the client and choose "New" or "Import from URL."
3. Paste the link into the address field, name the profile whatever you like, and confirm—the client will start downloading the config.
4. Once the download finishes, select this profile from the list to activate it, and the node page will show all available nodes.

From then on, the client refreshes your subscription automatically on a schedule; if nodes are added or removed, just tap update once. If import or update fails, check three things: the link may have expired or been reset by your provider; your current direct connection can't reach the subscription URL (switch to Global mode temporarily and try updating again); or your system clock is off enough to break the TLS handshake, so sync your system time and retry.

Proxy Mode and System Proxy: What to Pick First

Clash has three proxy modes. For your first setup, just remember: Rule for daily use, Global for troubleshooting, and Direct is essentially a temporary off switch.

• Rule: Traffic is routed by built-in rules—domestic sites go direct, sites outside mainland China go through a node. Fast and efficient with your node bandwidth; this is the setting to leave on day to day.
• Global: All traffic goes through whichever node is currently selected. Use this only temporarily, for troubleshooting or for services that need to be fully proxied.
• Direct: No traffic goes through the proxy at all—effectively an off switch, useful for A/B comparison testing.

Separate from the mode setting, there's an independent toggle: System Proxy. When it's on, apps that respect system proxy settings (most browsers and desktop software) automatically route through the client; when it's off, only apps manually pointed at 127.0.0.1 plus a port will use the proxy. Most clients default to a mixed port of 7890 or 7897, which corresponds to these lines in the config:

mixed-port: 7890
allow-lan: false
mode: rule

When configuring a proxy manually for a single app, use 127.0.0.1 for the address and the mixed port shown above. As for TUN mode (enhanced mode), it creates a virtual network adapter that captures all traffic system-wide—including apps that ignore the system proxy, like certain games and command-line tools. TUN requires installing an extra service component or granting elevated permissions, so beginners can skip it for the first week and revisit it once Rule mode is running smoothly.

Autostart and Running in the Background

A proxy tool is only useful if it's always running—if you have to launch it manually every reboot, you'll forget sooner or later. Here's how to set it up on each platform:

• Windows: Check "Launch on startup" in the client settings, along with "Silent start," so it minimizes to the system tray on boot without popping up a window.
• macOS: Enabling autostart adds the client to your login items—you can confirm it's listed under System Settings › General › Login Items.
• Android: Beyond the client's own autostart toggle, you also need to allow "autostart" at the system level and lock the app's card in the recent-apps view—this step is especially important on heavily customized Android skins, where skipping it means the process gets killed.
• iOS: There's no true autostart at the OS level—you'll need to open the proxy manually. Some clients offer an "on-demand connection" option that keeps the tunnel effectively always on.

Common Pitfalls: Symptoms and Fixes

These are the issues that come up most often during first-time setup—match your symptom below and apply the fix.

• Startup fails with a port conflict. Port 7890 or 7897 is already held by a leftover process. Fully quit the old client (including the tray icon), or change the mixed port to an unused value like 7899 in settings.
• System proxy is on, but the browser still isn't using it. Check whether a proxy-switcher extension is installed in your browser—these can override the system proxy setting. Disable the extension and test again, and make sure the client's port matches what the browser is pointed at.
• Subscription updates keep failing. Work through the checklist from the previous section: has the link been reset, do you need to switch to Global before updating, and is your system clock accurate?
• macOS asks for your password every time you restart. The privileged helper wasn't installed properly—look for a "reinstall helper" option in the client settings and run it once to fix this.
• Android disconnects after the screen locks. The app isn't on the battery whitelist, or its recent-apps card got swiped away by a one-tap cleaner. Go back into system settings and check each item.
• Store-bought UWP apps can't connect. UWP apps are restricted by the Windows loopback exemption and can't reach the local proxy by default. Use the client's built-in "UWP loopback" tool, check the app in question, and save.
• A specific site won't load in Rule mode. Switch to Global to check: if it works in Global, the domain is either hitting a direct-connect rule or your current node doesn't play well with it—try a different node, or add a dedicated rule for that domain.

Confirming Traffic Splitting Is Working

Once everything's set up, spend a minute verifying it. Confirm the system proxy is on and the mode is set to Rule, then follow these three steps:

1. With the proxy off, open any IP lookup page and note your current outbound IP.
2. Turn on the system proxy, select a node, and refresh the page—the displayed IP should now match the node's location.
3. Visit a domestic site and open the client's connection panel—you should see it hit a direct-connect rule instead of going through a node.

If all three checks pass, your first-time setup is complete. From here, day-to-day maintenance boils down to three things: switching nodes, updating your subscription, and occasionally confirming the mode is still set to Rule. For deeper issues, check out the advanced articles on rule-based routing and DNS.