Setting up Clash Verge on Windows 11 involves more than pasting a link and pressing Connect. You need a compatible client, a valid subscription URL, an imported profile, and a clear understanding of whether the client is using system proxy settings or a virtual network interface. This walkthrough takes you from a clean installation to practical connection checks, while explaining what to do if a step looks different in your version.
Clash Verge is a graphical client for proxy configurations; it is not the same as adding a conventional VPN connection in Windows Settings. Depending on the client version and configuration, traffic may be routed through Windows proxy settings or through TUN mode. Knowing which mode you have enabled helps you test the right thing and avoid assuming that every app is using the selected route.
Before you begin: prepare the client and subscription
Start with the subscription service’s setup instructions and the version of Clash Verge it recommends. Use a download source that the publisher identifies as its own, and avoid repackaged installers from download portals, file-sharing pages, or unsolicited messages. If Windows displays a publisher or security warning, pause and confirm that the file and publisher match the source you intended to use instead of dismissing the warning automatically.
You will also need a subscription link. It is a credential-bearing URL: someone who obtains it may be able to access or refresh your configuration, depending on the provider’s design. Treat it like a password. Do not post it in a public chat, paste it into a screenshot, or send it to a person offering unsolicited troubleshooting. If it is exposed, check whether your provider lets you regenerate or replace the link.
Before opening the client, check that Windows has a working internet connection without the proxy. If a browser is already configured to use another proxy, turn that setting off temporarily or record its current value so you can restore it. Running two proxy clients at the same time can create conflicting system settings, confusing connection tests, or traffic that takes an unexpected route.
5
Setup stages in this guide
1
Subscription URL to keep private
2
Common routing modes to distinguish
Have the subscription URL ready to paste, but do not copy it into a public document or save it in a plain-text note that other people can access. If you have not yet received a link, sign in to your service account and follow its client-specific instructions. A general Windows guide such as the new-user guide can also help you identify where the account’s setup information is provided.
Install Clash Verge on Windows 11
Download the Windows installer from the client publisher’s stated distribution channel. The exact file name and installation screens can change between releases, so use the publisher’s current instructions rather than following a screenshot for an older build. If the download is an installer, open it and follow the prompts. If it is a portable package, extract it to a folder you control and launch the application from there; do not run it from inside the compressed archive.
Windows may ask for permission to make changes when an installer or network component needs elevated access. Read the prompt and confirm that the application name is the one you intended to install. This permission is different from a firewall prompt: a User Account Control dialog is asking whether the program can make system-level changes, while a firewall dialog asks whether an app may communicate on particular network types.
After installation, open Clash Verge and let its initial screen finish loading. If it requests permission to install or start a service, check that the request comes from the client you installed and review the purpose described in its own documentation. Some configurations, particularly TUN mode, require a network driver or service and additional permissions. Do not enable a component simply because a tutorial says it is always required; first determine whether the routing mode you want actually depends on it.
If Windows Security blocks the installer, do not turn off protection globally to force the installation. Check the publisher, file source, and any warning details. If you cannot verify them, delete the file and obtain a copy through the client publisher’s identified channel. On a shared or managed computer, your organization may restrict driver installation or network settings; in that case, ask the administrator rather than attempting to bypass the policy.
Import a subscription link and confirm the profile
Open the profile or subscription area in Clash Verge. Labels and button positions vary across releases, but look for an action such as adding a profile, importing from a URL, or creating a remote configuration. Choose the URL-based option, paste the subscription link into the address field, and give the profile a recognizable name if the client offers that choice. Avoid entering the link in a search box or a browser address bar: a subscription URL is intended for the client to fetch the configuration.
Submit the URL and wait for the client to retrieve the profile. A successful import should produce a profile entry or a configuration view rather than an empty result. Select the newly imported profile if it is not already active. Some clients fetch the configuration when you import it; others show an update action. If an update control is available, use it to refresh the profile and check whether the client reports a successful fetch.
Do not assume that every subscription provider uses the same configuration format or menu structure. A service may provide a URL intended for a particular compatible client, and an unrelated link may return a web page, an authorization error, or data the client cannot parse. Use the subscription URL specifically issued for Clash-compatible clients, or consult the provider’s client instructions. If there are several link types, do not guess based only on a label such as “copy.”
If import fails, first check for accidental spaces or line breaks at the beginning or end of the pasted link. Then confirm that you copied the complete URL and that your internet connection works without Clash Verge. If the provider requires you to sign in before revealing the link, make sure you copied the subscription address rather than the account page address. A link can also be expired, revoked, or restricted by account status; importing it repeatedly will not repair those conditions.
Keep the profile name generic if you share screenshots with support. The URL itself may contain a unique token, and some configuration pages show server names or account-specific identifiers. Before sharing an image, crop or obscure sensitive information and inspect the full image for copied text, browser tabs, notifications, and other personal details.
Import check: The profile should appear in Clash Verge and be selectable. If the client cannot fetch or parse it, verify the exact URL and the provider’s supported format before changing Windows network settings.
Choose a server and understand the routing mode
Once the profile is active, open the proxy or server selection area. Depending on how the provider structured the configuration, you may see individual locations, groups, or automatic selection options. Choose an available location that suits the service or website you want to use. A group may choose a route according to rules in the configuration; an individual selection gives you a specific listed option. The menu names and available choices come from the imported profile, so they may differ between subscriptions.
Next, inspect the client’s operating mode. In a system-proxy mode, Clash Verge changes the Windows proxy settings so applications that honor those settings can send traffic through the client. Some programs, including some games, command-line tools, and applications with their own network configuration, may ignore the system proxy. A connected indicator in Clash Verge does not by itself prove that every program is routed through it.
TUN mode creates a virtual network interface so the client can handle traffic that may not follow Windows’ ordinary proxy settings. It can require a service, driver, or administrator permission, and its behavior depends on the client version and configuration. TUN is not automatically the right choice for everyone. If your goal is to test a browser that respects the system proxy, begin with the simpler mode supported by your setup; enable TUN only when you need its broader routing behavior and understand the permission request.
When you need help finding a service that fits your devices and intended use, the VPN for China information page is one place to review the available service details. The important setup principle remains the same regardless of provider: use a compatible profile, select a route deliberately, and verify traffic from the application you actually intend to use.
Do not enable multiple proxy clients or manually edit Windows proxy values while Clash Verge is managing them. If you need to change clients, disconnect the first one and restore its settings according to its instructions before starting another. Conflicting proxy values can make a working profile appear broken, or cause some applications to use one route while others use another.
| Mode | How traffic is directed | What to check | Typical consideration |
|---|---|---|---|
| System proxy | Uses Windows proxy settings for applications that follow them | Check that the client’s system-proxy control is enabled and inspect Windows proxy settings | Some applications may use their own network settings instead |
| TUN | Uses a virtual network interface to handle a broader range of traffic | Check the TUN status, required service or driver, and any permission errors | May require elevated permission and more careful troubleshooting |
Handle Windows network prompts carefully
When you turn on the system proxy or TUN mode, Windows may display a permission prompt, or the client may request permission to install or start a network component. Read the prompt before approving it. Confirm that the requesting program is Clash Verge or a component associated with the installation you just performed, and check what the request is asking to change. If the displayed publisher or application is unfamiliar, cancel and investigate instead of approving by habit.
A Windows Defender Firewall prompt may ask whether an application can communicate on private or public networks. These choices describe network profiles, not whether you want to route traffic through the proxy. Select only the access that the client’s instructions say is needed for your intended use. Do not enable public-network access simply to make a connection icon turn green. If you are uncertain, deny the request for now, consult the client documentation, and approve a narrower option only if it is required.
Windows Settings also has its own proxy controls. If the client uses system-proxy mode, you can inspect the relevant proxy page in Settings to see whether the client has changed the expected values. Avoid manually replacing a local address or port with a value copied from an unrelated guide: those values are specific to the client configuration. When disconnecting, use Clash Verge’s control to turn off its system proxy so that Windows returns to the expected state.
If you already approved a prompt but are unsure what it changed, note the current mode and status before making further changes. Disconnect through the client, check whether ordinary browsing works, and review the client’s own settings. Changing several firewall, proxy, and TUN options at once makes it harder to identify the cause if something stops working.
- ✅ Read the application name and requested permission before approving a prompt.
- ✅ Use one proxy client at a time while testing.
- ✅ Keep the subscription URL private and remove it from screenshots.
- ❌ Do not disable Windows security protections to force an unknown installer to run.
- ❌ Do not assume that a connected indicator means every application uses the selected route.
Verify the connection and troubleshoot in a useful order
Start with the client’s own status. Confirm that the intended profile is selected, a server or group is active, and the client reports a connected or working state. Then open a fresh browser tab and load a page that has not already been cached. A page that was open before connection may continue to display old content, which is not a reliable test of the current route.
Next, check the exit location using a reputable IP-checking service that you choose yourself. Compare the displayed location with the route you selected, allowing for the fact that geolocation databases are not always precise. If the location is unexpected, check the selected proxy group and whether it has switched to a different member. Do not interpret a geographic mismatch alone as proof that the connection has failed.
Test the actual application you care about as well as the browser. If a browser works in system-proxy mode but another application does not, that application may ignore Windows proxy settings or have its own proxy configuration. If you are using TUN, check that the TUN component is running and that the client has not reported a driver or permission error. Change one setting at a time, reconnect, and repeat the same test so that you can tell which change affected the result.
If the profile does not update, confirm that the subscription link is still valid and that the network can reach the provider. If the profile updates but no route works, select a different available entry from the imported configuration and check whether the client shows an error. If browsing fails only while the system proxy is on, disconnect it and confirm that Windows’ ordinary connection works again. This separates a general internet problem from a proxy configuration problem.
When troubleshooting, record the client version, Windows edition if relevant, selected mode, profile name, and the wording of any error. Do not include the subscription URL or account credentials in a support request. If you need to share logs, review them first for tokens, addresses, or other identifying details. When in doubt, ask the service provider which log fields are safe to send.
Use the setup safely in daily use
Keep Clash Verge and its configuration current through the publisher’s stated update process. A client update may change menu names or how a feature is configured, so recheck the active profile and routing mode after updating rather than assuming every setting stayed the same. Store the subscription URL in a password manager or another private location if you need to retain it, and avoid leaving it in the clipboard after setup when sharing the computer.
Before switching to another network, such as moving from home Wi-Fi to a hotspot, check whether the client reconnects and whether the chosen route remains active. Reopen the site or application after the network changes and make a fresh request. If you no longer need the proxy, disconnect using the client’s controls and confirm that Windows proxy settings have returned to the state you expect. This is especially useful before using a work network or troubleshooting a separate connection problem.
Clash Verge setup is complete when the subscription profile has imported, the intended route is selected, the chosen routing mode is active, and a fresh request from your target application behaves as expected. Keep those checks separate: profile import, client connection, Windows routing, and application behavior are different stages. If one fails, troubleshoot that stage first instead of reinstalling the client or changing every network setting at once.