ClashX & Airport Subscriptions: Complete Best Practice Guide 2025

• Automatic updates: refresh once and get every new node pushed by your provider
• Bulk management: import dozens of nodes at once instead of adding them manually
• Sync across devices: reuse the same link on Mac, iPhone, Windows, etc.
• Rules included: most subscriptions ship with ready-to-use rule sets
• Smart selection: built-in latency tests and load balancing

Highlights:

• YAML configuration file
• Includes Proxy Group definitions
• Built-in rule set
• Supports strategy groups and auto select
• Works natively in ClashX—no converter needed

Example link:

Highlights:

• Often ends with sub or link
• Only contains node data, no rules
• Must be converted to the Clash format
• Great compatibility across clients

Example link:

Highlights:

• Content is Base64 encoded
• Used mainly by Shadowsocks/ShadowsocksR
• Needs conversion before ClashX can use it
• Security is low because encoding ≠ encryption

Steps:

1. Click the ClashX icon in the menu bar
2. Choose "Config" → "Profiles" → "Manage"
3. In the pop-up, click the "Add" button
4. Paste your subscription URL
5. Optional: give the profile a recognizable name
6. Click "OK" to save
7. ClashX downloads the configuration and applies it automatically

Steps:

1. Click the ClashX icon in the menu bar
2. Open "Config" → "Open Folder"
3. Copy the YAML file you downloaded from the subscription into this folder
4. Back in the menu, choose "Config" → the file you just copied
5. The configuration takes effect immediately

Checklist:

• Proxy list: open "Proxy"—you should see the nodes from the subscription
• Rule mode: check "Outbound Mode" for "Rule"
• Connection test: pick a node and browse Google or YouTube
• Latency test: click "Test Latency" to view node status

Why refresh?

• Airports may rotate server IPs
• New nodes get added while old ones are retired
• Routes and policies are optimized frequently
• Rule sets evolve to match new websites

Suggested frequency:

• Stable airport: refresh once or twice a week
• New/unstable airport: refresh daily
• Connection issues: refresh immediately

1. Click the ClashX menu-bar icon
2. Go to "Config" → "Profiles" → "Manage"
3. Select the subscription you want to refresh
4. Click "Update"
5. Wait for the download notification (top right)
6. The new config takes effect automatically

How to set it up:

1. Open the config folder (Config → Open Folder)
2. Edit config.yaml
3. Add the auto-update snippet:

# subscription auto-update interval(hours)
update-interval: 24

# update on startup
update-on-start: true

Notes:

• update-interval: 24 means refresh every 24 hours
• update-on-start: true refreshes whenever ClashX launches

Naming rules:

• Use descriptive labels such as "Primary-HK" or "Backup-US"
• Add the expiry date, e.g., "AAA-2025.12"
• Tag the data cap, e.g., "BBB-500GB"

Usage tips:

• Main vs. backup: switch to the backup when the main line fails
• Scenario-based: separate work, streaming, and high-bandwidth plans
• Region priority: pick nodes closest to the service you need

Recommended services:

• FeiYang: https://sub.v1.mk/
• PinYun: https://id9.cc/
• Edge: https://bianyuan.xyz/

How to use it:

1. Open the conversion site
2. Paste your original subscription URL into the input box
3. Select "Clash" as the client
4. Optional: pick a ruleset (ACL4SSR, ConnersHua, etc.)
5. Optional: enable node filters (e.g., only HK/TW)
6. Click "Generate"
7. Copy the new Clash link into ClashX

Docker deployment (easiest):

# pull image
docker pull tindy2013/subconverter

# run container
docker run -d --name subconverter \\
  -p 25500:25500 \\
  tindy2013/subconverter

# access local converter service
# http://localhost:25500

Local access URL:

Useful parameters:

• target=clash – output Clash format
• url= – original subscription URL (URL-encoded)
• config= – specify a ruleset
• include= – keep nodes matching keywords
• exclude= – drop nodes matching keywords
• emoji=true – append country emojis
• udp=true – enable UDP support

Example: keep only HK and TW nodes

Core principles:

• Never share the link: It contains your credentials, so sharing equals giving away the account.
• Avoid exposing it in public: Blur or cover the URL in screenshots or demos.
• Reset the link regularly: If you suspect a leak, regenerate it in the provider dashboard at once.
• Store it securely: Keep the URL inside a password manager or another encrypted vault.

Security checklist:

1. Open the config folder (Profile → Open Config Folder).
2. Look for suspicious rules or scripts.
3. Confirm every node comes from a trusted provider.
4. Watch out for rules that inject ads or tracking scripts.

Check usage regularly:

• Review the usage chart in your provider dashboard.
• Reset the link immediately if usage spikes unexpectedly.
• Enable quota alerts so you get notified before running out.
• Know your normal consumption pattern to spot anomalies.

Build a multilayer defense:

• Enable 2FA: Turn on two-factor authentication for your provider account.
• Unique password: Use a strong password that you don’t reuse elsewhere.
• Routine audits: Review login history every month.
• Device limits: Use device quotas provided by the service.
• Separate subscriptions: Keep critical devices on dedicated links.

Possible causes:

• Network connection problem
• Subscription link expired or blocked
• Provider servers under maintenance
• Invalid subscription format

Fix it by:

1. Verify your network connectivity.
2. Open the URL in a browser to see if the config downloads.
3. Log in to the provider dashboard to check for a new link.
4. If it changed, remove the old subscription and add the new one.
5. Clear ClashX cache and try again.

Troubleshooting steps:

1. Ensure ClashX is running (icon in the menu bar).
2. Check that the correct mode is selected (Rule or Global).
3. Test latency and switch to a responsive node.
4. Review logs (Profile → Show Logs) for errors.
5. If every node is down, the config file may be broken.
6. Redownload or use another converter.

What it means:

• Too few nodes: Filters may have removed most entries.
• Too many nodes: Multiple subscriptions might be merged.
• Sudden drop: The provider probably retired some nodes.

How to fix it:

• Review converter filters and rules.
• Check the provider dashboard for the official node count.
• Regenerate a link without filters if you need every node.

Possible causes:

• Rules route the domain directly.
• DNS resolution issue
• Selected node can’t reach that service.

Try this:

1. Switch to Global mode temporarily to test.
2. If Global works, it’s a rules issue.
3. Add a custom rule to force the domain through proxy.
4. Or switch DNS to a reliable public resolver.

Symptoms:

• Errors appear after switching profiles
• Rules become chaotic when multiple configs coexist
• ClashX fails to start normally

Fix it by:

1. Use only one subscription at a time.
2. Avoid mixing configs from different sources in one folder.
3. Remove unused legacy files.
4. Reinstall ClashX and add the subscription again.

ClashX matches rules from top to bottom:

1. User-defined rules (highest priority)
2. Rules from the subscription file
3. GEOIP rules
4. Final MATCH fallback

Steps:

1. Open the profile folder (Profile → Open Config Folder).
2. Open the active YAML in a text editor.
3. Locate the rules: section.
4. Insert your rules at the top of the list.
5. Save the file and ClashX reloads automatically.

Example: Force certain domains through proxy

rules:
  # custom rules - Highest priority
  - DOMAIN-SUFFIX,openai.com,Proxy
  - DOMAIN-SUFFIX,chatgpt.com,Proxy
  - DOMAIN-KEYWORD,google,Proxy

  # Below are the original rules from the subscription
  - DOMAIN-SUFFIX,google.com,Proxy
  # ...

Force direct connection:

# CN websitesDirect
- DOMAIN-SUFFIX,taobao.com,DIRECT
- DOMAIN-SUFFIX,jd.com,DIRECT

# IP  segment Direct
- IP-CIDR,192.168.0.0/16,DIRECT
- IP-CIDR,10.0.0.0/8,DIRECT

Pin traffic to specific nodes:

# Netflix use US Node
- DOMAIN-SUFFIX,netflix.com,US-Node

# gaming use Hong Kong Kong Node
- DOMAIN-SUFFIX,steam.com,HK-Node

Block ads and trackers:

# Block common ad domains
- DOMAIN-SUFFIX,googleads.com,REJECT
- DOMAIN-SUFFIX,doubleclick.net,REJECT
- DOMAIN-KEYWORD,analytics,REJECT

rule-providers:
  reject:
    type: http
    behavior: domain
    url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/reject.txt"
    path: ./ruleset/reject.yaml
    interval: 86400

rules:
  - RULE-SET,reject,REJECT
  # otherRules...

Notes:

• type: http – fetch rules over HTTP
• behavior: domain – rule category (domain/ipcidr/classical)
• interval: 86400 – update interval in seconds
• Rules refresh automatically without manual edits.

Key takeaways

• Subscription type: Prefer Clash-native links; convert others via Subconverter.
• Management: Update regularly, name profiles clearly, and automate refreshes.
• Security: Protect links, avoid untrusted converters, and monitor usage.
• Troubleshooting: Check logs, test latency, and re-add the profile when needed.
• Advanced use: Customize rules and leverage rule providers for maintenance.

• ClashX config syntax breakdown
• Advanced proxy group setup
• DNS hardening and anti-pollution setups
• Using the Script feature
• Configuring TUN mode