When import does not become a tunnel

Updated is not connected. Connected is not the same IP in the browser and the terminal.

Paste the subscription URL from the dashboard or from the free profile page. If the fetch fails with a certificate error, set the device clock before you try a different URL. Subscriptions are fetched over HTTPS. A clock that is hours off fails validation and looks like a dead server.

If the client says the profile updated and the public IP did not change, the new list is not the active tunnel. Select a node and connect. Confirm with curl and with the browser. Two copies of the same subscription are worse than one. Delete the copy that does not move the IP.

On Windows, system proxy mode can move the browser and leave PowerShell on the ISP route. TUN mode is the mode that puts both on the tunnel. On Android, an app you excluded from the VPN stays on the carrier network. The browser you use for the test has to be outside that exclusion list. On iOS, Private Relay can present an Apple address after you thought the VPN exit was in use. Turn Private Relay off for the test.

After the IP matches the exit you picked, the import step is done. WebRTC and DNS are the next checks, in the leak testing guide. Platform steps live in the Hiddify setup guide.