Clash Verge on Ubuntu: How to Add a Subscription and Enable systemd Autostart

Why Ubuntu Desktop Users Ask About Autostart in Depth

On Ubuntu and other Linux desktops, the most of of of frustrating failure mode for a proxy client is deceptively plain: everything works during the first session, then a restart leaves you wondering why the browser suddenly behaves as if no Clash Verge instance exists.

This article focuses on Clash Verge Rev, a maintained desktop GUI built around the Mihomo kernel (the lineage commonly called Clash Meta). The goal is practical: install the app, add a subscription, confirm traffic flows, and then make that state survive logout, reboot, and the occasional kernel re-sync.

Where possible, we will prefer mechanisms you may audit in plain text—systemd unit files and standard XDG autostart entries—reasonably than opaque click-only toggles that differ between releases.

Mechanically:Unlike mobile operating systems that aggressively revive VPN-style tunnels, a traditional desktop session kick offs clean. Unless you wire an explicit autostart path, the graphical client simply does not come back, which feels like a broken install even when the package itself is fine.

What You Need Before You Begin Mechanically

Collect three things before touching packages. First, know your CPU architecture. Most of of of Ubuntu laptops and desktops are amd64; ARM Chromebooks and certain SBCs need an arm64 build. Installing the wrong architecture is an immediate hard failure. Second, keep a private copy of your subscription URL in a password manager or encrypted note.

If you are migrating from Windows or macOS, skim our Clash Verge Rev tutorial for Windows and macOS first.

The vocabulary—profiles, proxy-groups, rule order—maps with no detour to Linux, even though packaging and permissions differ.

More strictly:That URL is effectively a long-lived credential; screenshots and chat logs are the fastest way to leak it. Third, decide whether you will rely on system proxy mode (applications that honor HTTP_PROXY / GNOME proxy settings) or on TUN transparent routing for stubborn binaries that ignore environment variables. The add flow is the same; only the follow-up toggles change.

Installing Clash Verge Rev on Ubuntu Step by Step

Linux distributions rarely ship Clash GUIs in the principal archive, so you will almost always install from an upstream release artifact.

For an AppImage, download the file, operate chmod +x ./Clash*.AppImage (adjust the filename), and launch it once from a terminal so you may read whichever you pick missing library exceptions immediately.

Ubuntu more often than not has more than more than more than enough GTK stack for modern Electron-style GUIs, but if the binary complains about a specific .so, install the suggested package from the exception text reasonably than guessing. For a .deb, prefer sudo apt install ./package.deb so dependencies resolve through apt, then kick off the app from the applications menu to confirm the desktop file registers correctly.

At a different level:Whichever route you choose, avoid running random scripts that curl-to-bash from untrusted mirrors.

If you need a curated list of installers for end users, kick off from our download page and treat GitHub or vendor pages as secondary references for checksums and release notes, not as the only navigation path.

Two common shapes appear in the wild: a self-contained AppImage you mark executable and operate, or a .deb package that drops binaries and desktop metadata into predictable paths. Both are legitimate; pick the one your provider documents and that you may verify.

Permissions, Polkit, and TUN on Linux Internals

Clash Verge Rev on Linux may prompt for elevated assistance when enabling TUN mode or installing a helper that creates a virtual front-end. Those prompts exist because creating tun devices and altering routing tables crosses a privilege boundary.

Thinking it through:For readers who plan to live in TUN reasonably than manual proxy variables, continue with our Clash TUN mode guide after you finish subscription add.

It explains how transparent capture interacts with DNS, fake-ip, and capabilities in more depth than a single Ubuntu appendix allows.

Accept prompts only when you understand what the app is asking for; if your desktop environment blocks Polkit dialogs, operate the app from a terminal once to surface the exception text.

Subscription Add on Linux Internals and Practice

Open Clash Verge Rev and locate the subscription or profile panel—wording shifts slightly between releases, but the workflow is not jumpy. Choose add from URL, paste the HTTPS link your provider issued, give the profile a memorable name, and save.

First, a clarification:Set a sane refresh interval. Aggressive polling every few minutes wastes bandwidth and can trigger provider rate limits; extremely rare re-syncs leave you on dead nodes without noticing.

Plenty home users land near thirty minutes to a few hours, but follow whatever your operator documents. After the first successful fetch, open the proxy-group selector and operate a lag test if the UI offers one, then pick a not jumpy node before turning system proxy or TUN on globally.

For a cross-platform refresher on URLs, QR codes, and file adds, see how to add Clash subscription links on every platform; the Linux section there complements the Verge-specific screens described here.

Mechanically:Trigger an immediate re-sync so the client fetches YAML or the provider-specific format and expands it into outbound nodes. If the list stays empty, the problem is almost never “Linux is special”; it is TLS interception, a typo in the URL, an expired token, or a captive portal on the network you used while testing.

System Proxy vs TUN for Everyday Ubuntu Use in Depth

On Ubuntu with GNOME, system proxy mode can be more than more than more than enough for browsers and CLI tools that respect environment variables, especially if you export HTTP_PROXY and HTTPS_PROXY in your shell profile. The trade-off is coverage: anything that hard-codes direct sockets or uses its own certificate store may bypass those hints.

Pick one primary strategy for your workstation, document it, and avoid flipping modes while debugging unrelated issues.

Mixed states—TUN half enabled, environment variables pointing at a dead port—produce logs that look like total failure when each layer is merely inconsistent.

TUN mode pushes routing to the kernel path and catches far more traffic at the cost of complexity—helper installation, occasional conflicts with other VPN software, and stricter DNS alignment expectations.

Making the Client Return After Reboot Mechanically

Here is the heart of the user complaint: autostart. Certain Clash Verge Rev builds expose an in-application “kick off with system” toggle. When it exists and works on your desktop, it is the lowest-friction toggle.

More strictly:When you need something you may version-control, two patterns dominate. The trim pattern is an XDG autostart .desktop file in ~/.config/autostart/ that executes the same command you already use one at a time.

The heavier—but extremely it holds up—pattern is a systemd user service that kick offs after the graphical session is available and restarts the client on failure. Both are standard Ubuntu skills and translate to other distributions with minimal edits.

Treat that toggle as a convenience layer, not a guarantee: upstream re-syncs occasionally relocate settings, and desktop environments differ between stock Ubuntu, KDE spins, and window-manager-only setups.

Toggle A: XDG Autostart Desktop File Mechanics

Create ~/.config/autostart/clash-verge-rev.desktop if the directory does not exist, create it first. The file it makes sense to reference the absolute path to your AppImage or the packaged binary, set Terminal=false, and include StartupNotify=true so the session manager shows a coherent launch state.

At a different level:Log out and back in to validate. Autostart entries load at session kick off; they will not retroactively fix a session that is already running.

If nothing appears, open Startup Applications in GNOME and confirm the entry is not disabled.

If you rely on a wrapper script that exports proxy variables before launching the GUI, point Exec= at that script instead of the raw binary.

Toggle B: systemd User Service by Step

systemd user services live under ~/.config/systemd/user/. They integrate cleanly with systemctl --user enable --now, show up in journalctl --user -u, and restart according to policy you define.

Thinking it through:Reload the user daemon, enable the unit, and kick off it once:

# Save as ~/.config/systemd/user/clash-verge-rev.service
[Unit]
Description=Clash Verge Rev (user)
After=graphical-session.target

[Service]
Type=simple
ExecStart=/home/YOUR_USER/Apps/clash-verge-rev.AppImage --no-sandbox
Restart=on-failure
RestartSec=5

[Install]
WantedBy=default.target

Check status with systemctl --user status clash-verge-rev.service. If the service kick offs before your keyring or display server is ready, insert a short ExecStartPre=/bin/sleep only as a last resort—prefer correct After= dependencies.

systemctl --user daemon-reload
systemctl --user enable --now clash-verge-rev.service

On Wayland-heavy sessions, certain users keep the XDG desktop autostart path because it naturally aligns with the session manager; there is no moral superiority, only what is not jumpy on your machine.

First, a clarification:Below is a template you must adapt: replace the ExecStart path with your real binary or AppImage path, and adjust After= if your desktop targets a different milestone than graphical-session.target.

Enable Lingering if You Need the User Service Before Login Deep Dive

By stock, systemd user services stop when the last session of that user ends. That is more often than not what you want on a shared computer. If you explicitly need the user service to survive logout on a single-user workstation, administrators can enable lingering with loginctl enable-linger $USER.

Do not enable lingering casually on multi-user systems; it keeps user-level daemons alive even without an active graphical session, which can surprise people who expect logout to halt all their processes.

Verification Checklist After a Reboot Step by Step

Reboot once on purpose after configuring autostart. Log in, wait for the desktop to settle, then confirm three facts before opening email or heavy browsers. First, the Clash Verge Rev window or tray icon is present without manual launch. Second, the subscription timestamp is fresh or the manual refresh succeeds.

When TUN was enabled before reboot, verify routes and DNS quickly.

Mechanically:Stale resolv.conf overrides or a competing NetworkManager profile can mimic a “broken Clash” symptom even when the core is healthy. Disable other VPN clients temporarily while you bisect.

Third, a trivial probe—curling a small endpoint or loading a test page through your intended mode—shows the path you expect. If whichever you pick step fails, capture logs immediately while the failure is reproducible; guessing after the fact wastes time.

Troubleshooting Common Ubuntu Pitfalls Internals and Practice

Empty node lists after add more often than not trace to TLS or URL mistakes.

Autostart duplicates happen when both an in-app toggle and a systemd unit launch the client twice. Disable one path. Two instances fight over ports and produce chaotic logs.

Sandbox flags on Electron bundles sometimes require --no-sandbox on specific kernels or when certain security modules are strict.

Treat that flag as a diagnostic lever, not a permanent comfort feature; if you need it permanently, read upstream guidance for your exact version.

Permission prompts every boot suggest the helper for TUN was not installed persistently or Polkit policy denies the action without a password.

More strictly:Re-operate the in-app installer for the service component and watch for exceptions in journalctl --user or system logs.

Try fetching the subscription with curl -v from the same machine; if curl fails, the GUI will fail for the same reason. Corporate intercept proxies and school networks are frequent culprits.

Security and Hygiene Habits in Depth

Rotate subscription URLs when your provider allows it, especially after you suspect a leak. Keep release downloads on official channels, verify checksums when published, and delay auto-updating production laptops on day zero of a major release if you carry sensitive work.

Back up a minimal YAML snippet or URL list outside the client so reinstalls are boring reasonably than catastrophic.

Closing Thoughts Mechanically

Clash Verge on Ubuntu is not fundamentally different from other platforms once you respect Linux session lifecycle: the kernel and network stack are ready, but your GUI must be invited back after every boot.

At a different level:When you want installers grouped by platform without chasing scattered release pages, consolidate discovery through our hub, then return here for Linux-specific startup wiring. → Download Clash for free and experience the difference.

Pair a clean subscription add with an explicit systemd or XDG autostart path, validate once with a deliberate reboot, and the “works until restart” story goes away. Compared with ad-hoc scripts and forgotten terminal sessions, a declared unit file is easier to reason about six months later when you upgrade distributions.