First-Time Clash Mobile Setup: Android APK and iOS Installation Checklist

Before you install: understand clients, subscriptions, and network access

Setting up Clash on a phone involves three separate steps: install a client, load a working configuration, and allow the client to route network traffic. A successful installation only means the app opens. A successful import means the configuration can be read. A VPN indicator means a tunnel has been established. None of these alone confirms that proxy traffic is working.

Android supports APK installs; iOS does not. On iOS, use a compatible client and its supported distribution method. Clash is a name used across a proxy core and configuration ecosystem, not a single official mobile app available on every platform. Android clients using the Clash Meta (now called mihomo) core may also differ in capabilities from iOS clients that support only some Clash configuration formats.

• Client: Provides configuration management, proxy group selection, connection logs, and controls for routing device traffic.
• Subscription: Provides configuration or proxy node details. Subscription URLs often contain credentials, so protect them like account passwords.
• Rules and proxy groups: Rules determine which policy handles a request; the policy group then selects an outbound connection.
• VPN/TUN: Receives device traffic. This is a traffic-routing method, not a proxy node or a guarantee of a working connection.

Installing an Android APK: grant permission to the app that opens it

1. Choose the right architecture and allow the install source

Check the download page for available clients and installation instructions. Most recent Android phones use ARM64, typically arm64-v8a; older devices may need armeabi-v7a. If you’re unsure, check your device’s processor details or choose a universal package if the project offers one. Don’t mistake a package for x86 emulators for a universal phone build.

1. After downloading the APK, open it from your browser’s downloads or a file manager.
2. If Android blocks the installation, tap “Settings” in the prompt and enable “Allow from this source” for the app you’re using.
3. Return to the installer to finish, then open the client.
4. If you won’t install apps from this source again, return to the same settings and revoke its permission.

A common path is Settings → Apps → Special app access → Install unknown apps. Some manufacturers put this under Security or Privacy; you can also search Settings for “Install unknown apps.” The key is to grant permission to the app that opens the APK. If you open it in a file manager, allow installs for the file manager—not just the browser.

2. Check the error before troubleshooting

Don’t clear app data at the first sign of a conflict. Uninstalling may delete local subscriptions, overrides, and proxy group selections. Work phones may also be subject to organization policies that regular app settings cannot bypass.

Installing on iOS: check the client’s source and format support

On iOS, follow the client project’s instructions for installing through the App Store, TestFlight, or another supported method. Availability in the store depends on your account’s region and the app’s listing status; TestFlight slots and builds may also expire. An app’s ability to proxy traffic doesn’t mean it can fully load mihomo configurations.

1. Use the client selection guide to check platform support, configuration formats, and installation options.
2. After opening the app, find the subscription import option and check whether it accepts full Clash configurations or only extracts proxy nodes.
3. The first time you connect, read the system’s “Add VPN Configuration” prompt. Verify that the request comes from the client you just installed, then approve it.
4. To review the configuration, go to Settings → General → VPN & Device Management.

If the import shows proxy nodes but not the original proxy groups and rules, check the client’s documentation first. The import method may have kept only the nodes, rather than applying the configuration as-is. Use a rule configuration method supported by the client instead of pasting the same URL again.

Import your first subscription: download, select, and check proxy groups

Depending on the client, the menu may be called “Configuration,” “Profiles,” or “Subscriptions.” The steps below describe what to do without assuming that every client uses the same menu names. For your first setup, import just one subscription from a source you trust to avoid switching between multiple configurations.

1. Copy the full URL. Copy the subscription URL from your account dashboard, including any parameters after the question mark. Spaces, line breaks, or trailing punctuation added by a messaging app can cause errors.
2. Add a remote configuration. In configuration management, choose the option to add by URL, enter a recognizable name, and download or update it.
3. Check the parse result. Look for syntax errors, unknown fields, or unsupported protocol warnings. Downloading and parsing are separate steps.
4. Select the configuration. Some clients don’t activate a newly added configuration automatically. Select it, then load or reload it.
5. Check proxy groups. Find the group used by the active rules and select an available node or a suitable automatic selection group.

If you still can’t connect after importing a subscription, first identify which of two cases applies: an empty node list usually points to the URL, account status, or format; nodes are present but requests fail, so check the proxy group, node availability, and traffic routing. For HTTP 401 or 403, check credentials, access restrictions, and account status first—repeatedly refreshing won’t fix them.

A subscription URL opening in a browser doesn’t mean the client can import it. The browser may display a sign-in page, an error page, or HTML when the client expects configuration data. Check the response type and error details, and never show the full subscription URL in a public screenshot.

First connection: VPN permission, rule mode, and DNS

Approve only the system permissions requested by your client

Android clients typically use the system VPN service to receive device traffic. Implementations that use TUN may manage related settings automatically. When you tap Start, check the app name in the system permission prompt. If another proxy, work VPN, or VPN-based filtering app is running, stop it before testing this client.

On iOS, personal VPN connections can also conflict with other tunnels. If the connection fails, check the system VPN status and client logs; don’t keep toggling auto-connect in two apps. Follow your organization’s network policies on managed devices.

Start with rule mode

• Rule mode: Uses the rules in the active configuration to choose an outbound connection. It’s a good way to check whether the subscription is working as expected.
• Global mode: Typically sends traffic routed through the client to the global policy. You still need to select the outbound connection that policy uses.
• Direct mode: Typically connects routed traffic directly. It can’t verify whether proxy nodes are working.

Modes affect only traffic that reaches the client. If an app is excluded from the VPN, switching between rule and global modes won’t add it. For your first test, avoid complex per-app routing and start with a simple, repeatable connection check.

Don’t copy desktop instructions for ports and DNS

When a phone routes traffic through a VPN, you usually don’t need to set a manual proxy in Wi-Fi settings. The commonly cited 127.0.0.1:7890 is just an example of a local proxy address; use the port in your active configuration. 127.0.0.1 always refers to the current device, not another computer.

For your first connection, keep the DNS settings provided by the subscription or recommended by the client. If a page reports a DNS lookup failure, check DNS logs, Android Private DNS, and your browser’s Secure DNS settings. Don’t disable certificate verification as a general fix, and don’t assume DNS requests are taking the expected route just because the VPN icon is visible. For configuration field details, see the DNS technical reference.

Android background access and iOS auto-connect: configure separately

Android: check the foreground service, then adjust battery restrictions

After connecting, return to the home screen and check whether the client keeps its running notification as expected. Notification permission controls whether status alerts are visible; having a notification doesn’t mean the system won’t stop the app. If the connection drops when the screen locks, check the app’s background permissions.

• A common path is Settings → Apps → select the client → Battery. Set background usage to “Allow” or “Unrestricted”; the exact labels vary by Android version and manufacturer.
• Some manufacturers also have separate “Auto-start” or “Background power management” settings. Allow the app there too; locking it in Recent apps is only an extra measure.
• Temporarily turn off system-wide battery saver for a comparison test before deciding whether to keep the app exempt from battery optimization.
• Auto-start at boot, connect automatically when the app opens, and always-on VPN are separate settings. Enable each only if you need it.

Android’s “Always-on VPN” and “Block connections without VPN” are also separate options. The latter blocks network access when the tunnel is unavailable. Until you’ve verified the initial setup, leave blocking disabled so it doesn’t interfere with subscription updates or troubleshooting.

iOS: don’t use Android battery-exemption steps

On iOS, the VPN tunnel extension has a different lifecycle from the regular foreground app. Background App Refresh isn’t required to keep a tunnel running, and there’s no need to copy Android’s Recent apps locking steps. Follow the client’s instructions for options such as on-demand connection and reconnecting after network changes, and verify the connection in the system VPN status.

Verify the installation: test in the foreground, with the screen locked, and after switching networks

Use the steps below to test the setup; the timings simply keep the process consistent and aren’t a performance guarantee. Change one thing at a time and note where a failure occurs. That makes troubleshooting easier than changing ten settings at once.

A node latency test reports only the result of a specific probe. A successful probe doesn’t mean every site or protocol works, and a page loading doesn’t prove it matched the intended rule. When troubleshooting, check the connection logs for the requested domain, matched rule, and final outbound connection. Before sharing logs, redact subscription tokens, account details, and unnecessary browsing history.

Four checks that are easy to miss during setup

1. System time: Enable automatic date and time. A significantly incorrect clock can cause HTTPS certificate errors, which may look like subscription download or proxy connection failures.
2. Active configuration: After adding a subscription, make sure it’s the active configuration—not an empty configuration bundled with the app.
3. Auto-update: Run a manual update first, then set an interval based on your provider’s recommendations. Updating a configuration won’t extend a subscription or reactivate an expired account.
4. Local backup: Before reinstalling the app or clearing its data, save any configurations, overrides, and settings you need. Store backups containing credentials somewhere secure.

Your initial setup is complete when the configuration parses, the active policy has a working outbound connection, VPN routing is authorized, rules match as expected, and access recovers after locking the screen or switching networks. Once these checks pass, add per-app routing, custom rules, or auto-connect settings one at a time. For the next steps, see the mobile installation and setup guide.