Import a subscription link or local config, then confirm the client shows valid proxy groups before switching to rule mode. A successful subscription update only confirms that the config was fetched and parsed; it doesn't mean every proxy can connect. Choose a working policy, enable the system proxy, and test whether traffic reaches the core.
Use TUN only if you need to route apps that ignore system proxy settings. Before enabling it, note your existing ports, DNS, and routes. After making changes, test the browser, target apps, and DNS resolution separately. If a rule doesn't match as expected, check the target domain and policy in the connection log. Don't change the subscription, DNS, and operating mode all at once.
Save your custom rules and subscription source before upgrading or switching clients. Updates may overwrite subscription files, and clients handle overrides, merging, and persistence differently. After migrating, check mixed-port, proxy group names, DNS enhanced mode, and launch-at-startup settings instead of assuming the old setup still applies.
For step-by-step help, read the Clash setup guide. For timeouts, subscription failures, or DNS issues, see Troubleshooting. If Fake-IP, TUN, or rule sets are unfamiliar, check the glossary to learn what each setting does.