A step-by-step checklist for people installing a Clash-based client for the first time: system permission grants, subscription import, proxy mode selection, and the system proxy switch, plus the most common first-run pitfalls on each platform and how to fix them.
Clash-based clients (Clash Verge, Clash Plus, and other mihomo-core products among them) need to get through several independent but order-sensitive steps on first launch: granting system-level network permissions, parsing and importing a subscription, choosing a proxy mode, and deciding whether to enable the system proxy or TUN takeover. Get the order wrong, or skip a permission, and the symptoms usually show up as "no internet," "empty node list," or "browser won't load pages" — but the actual cause is often completely unrelated to whatever error message appears. This checklist follows the real install order so first-timers can avoid the usual detours, and it also doubles as a reference for troubleshooting later.
Worth stating up front: Clash itself doesn't provide any nodes. It's a rule-based proxy dispatch framework, and the actual connectivity comes from whatever subscription you import. The client's job is to parse the subscription, manage rules, switch nodes, and intercept system traffic — those four jobs map to the four sections below.
The exact permissions differ by platform, but the common failure mode is the same: without the right permission, the client opens fine, the UI looks normal, but the proxy simply doesn't take effect — often with no obvious error dialog. This is where most beginners get stuck.
A subscription is a remotely updatable piece of configuration, usually containing proxy node information and, optionally, a rule set URL. There are three common import methods, and the client's UI typically has an entry point for each.
After importing, check whether the node count matches what you expected, then check whether the rule set loaded along with it. Some subscriptions only include nodes with no routing rules, in which case the client falls back to default rules or you'll need to add a rule file manually.
The three most common causes of import failure: the URL itself is dead or expired; the network the client is currently on can't reach the subscription server (you need a working network path just to fetch the subscription in the first place — a bit of a chicken-and-egg problem that usually means switching networks temporarily or using a phone hotspot for the first import); and some subscription providers validate the client's User-Agent and reject requests from clients other than their own, in which case check whether the client has a "custom User-Agent" option in settings.
Once the subscription imports successfully, the client typically offers three core operating modes. For a first run, pick based on the criteria below rather than just picking whichever one is highlighted.
For a first install, staying in rule mode by default is recommended. If a specific site won't load, check the rule match for that site specifically rather than jumping straight to global mode, which just papers over real rule configuration issues.
Once rules and nodes are configured, there's one last step people tend to skip: selecting a node inside the client doesn't mean every other program on your system will route through it. There are two takeover methods here, with different mechanics and different use cases.
The client opens a local proxy port and points the system's network proxy settings at it. Most browsers and proxy-aware applications automatically follow the system proxy, but command-line tools, some game clients, and any app that doesn't read system proxy settings won't be covered — this is the usual explanation for "the browser works but this one app doesn't."
TUN mode creates a virtual network adapter that intercepts nearly all traffic at the network layer, regardless of whether an application reads system proxy settings. Coverage is more complete, at the cost of needing extra system permissions (see Step 1) and being somewhat more involved to configure and troubleshoot. If you're just trying to confirm your subscription and nodes work on a first install, get things running with system proxy mode first, then consider enabling TUN once that's confirmed working.
Running system proxy and TUN mode together usually doesn't cause conflicts — the client coordinates traffic internally — but if pages load unusually slowly or you see odd duplicate requests, try keeping only one takeover method active at a time to isolate the source.
Putting the four steps together, the recommended order from install to working setup is: install the client and confirm system permissions first (without rushing into TUN), then import the subscription and confirm the node count and rule set look normal, then select rule mode as the default operating mode, and finally enable the system proxy to verify that browsers and other everyday apps can get online normally. Once everything checks out, decide separately whether you actually need TUN mode to cover apps that ignore system proxy settings. Following this order covers the vast majority of sticking points during a first install.
If the permission or subscription issues above keep recurring, it's worth first confirming you're on the latest client build, then working through the configuration checks step by step.