Quick Reference / 25 Common Terms

Clash Glossary
Configuration Fields and Networking Concepts

Look up terms by where they appear in settings: distinguish the client from the core, then explore protocols, rules, DNS, and configuration sources.

Each term has its own anchor, so you can copy and share a direct link. This glossary explains meanings and limitations. New users can follow the setup guide; for help choosing a protocol, see the protocol guide.

Chinese terms mapped to configuration fields Support depends on the core in use

Interface and Connection Handling

Cores and Clients

The same interface can use different cores. Whether a subscription works depends on both how the client imports it and which protocols the core supports.

GUI ClientGUI client: An app with an interface for managing subscriptions, choosing policies, and toggling the proxy. Clash Verge Rev and FlClash are examples. The core usually handles rule matching and connection forwarding, so the client version is not the same as the core version. If a setting is missing from the interface, the core may still support it through a configuration file or override.

Proxy Coreproxy core: The program that reads configuration, accepts connections, matches rules, and establishes outbound connections. To check whether a protocol or field is supported, verify the name and version of the core that is actually running—not just the name of the installer. Replacing the core on its own can also affect the client's control interface and configuration compatibility. Check the client's support notes before updating.

mihomoformerly the Clash.Meta project: A proxy core renamed from the Clash.Meta project, extending the original Clash configuration system with additional protocol, DNS, and traffic-capture capabilities. Older documentation may use Meta as the project's former name, but that does not mean every older build includes current features. If a field is rejected, check the documentation for your version. See the protocol and core reference.

Proxy Nodeproxy entry: A common client term for a set of proxy server connection parameters, usually including a server address, port, protocol, and authentication details. A node's list name is just a label; it does not prove the server's location, available bandwidth, or service quality. The same server may appear as multiple nodes when configured with different protocols or ports.

Latency Testlatency / url-test: The client sends a request to a test URL through a selected proxy and records how long it takes. Implementations may differ in whether they time connection setup, the TLS handshake, or the response. Results depend on the test URL, connection reuse, and current network conditions; they do not measure download speed. For a meaningful comparison, use the same test conditions and consider how the proxy performs in the target app over time.

How Proxy Connections Work

Proxy Protocols

A protocol defines how a client and server exchange data. Even protocols with the same name can use different transport, security, and authentication settings, so matching names alone is not enough.

Shadowsocks（SS）type: ss: A family of protocols centered on encrypted proxy transport. Common node parameters include the server, port, encryption method, and password. Authentication requirements may vary by encryption method and protocol generation, and any plugins must be supported by both client and server. If a node fails to connect after import, check each parameter rather than guessing its implementation from its name.

VMesstype: vmess: A proxy protocol in the V2Ray ecosystem that commonly identifies users with a UUID and supports different underlying transports. A valid UUID is only one connection requirement; TLS, server name, path, and transport settings must also match the server. A badly incorrect device clock can affect authentication, so check the system time before troubleshooting the connection parameters.

Trojantype: trojan: A protocol that carries proxy traffic over a TLS connection and typically authenticates users with a password. The server address is used to establish the connection; the server name may be used for the TLS handshake and certificate verification, and the two values do not have to be the same. For certificate errors, check the name, validity period, and device clock first. Do not leave certificate verification disabled as a long-term fix.

VLESStype: vless: A lightweight proxy protocol in the Xray ecosystem. VLESS does not provide encryption on its own and is typically deployed with security mechanisms such as TLS or REALITY. The core in use must support the node's transport, flow control, and security settings. Do not treat VMess settings as VLESS configuration by changing the type name; use the complete parameters supplied by the server.

Hysteria2 and TUICtype: hysteria2 / type: tuic: Two QUIC-based proxy protocols that generally require the network to allow UDP traffic. Their authentication methods and configuration fields are not interchangeable. Performance depends on packet loss, congestion control, server resources, and configuration; the protocol name alone cannot tell you which will be faster. If the network restricts UDP, check that first. For more details, see the protocol selection guide.

After Traffic Enters the Core

Rules and Routing

Rules decide where a connection goes; proxy groups determine which specific outbound route it uses. If traffic takes the wrong route, check the matched rule first, then the proxy group's current selection.

Rule-Based Routingrules / mode: rule: The process of choosing direct, proxy, or another policy for a connection based on its domain, destination IP, process, or other conditions. In rule mode, rules are usually checked from top to bottom, and the first match determines how the connection is handled. Put specific rules before broader ones. After changing custom Clash rules, check the matched rule in the connection details rather than relying only on whether a page opens in the browser.

Proxy Groupproxy-groups: A configuration unit for organizing nodes or other proxy groups. It lets rules refer to a stable name instead of binding directly to individual nodes. Manual selection groups commonly use select, automatic testing groups use url-test, and failover groups use fallback. Automatic selection follows its configured test logic; it does not guarantee the highest throughput for every website.

Outbound Moderule / global / direct: Determines how the core selects an outbound policy: rule mode matches traffic against rules, global mode uses the global policy, and direct mode connects straight to the destination. The mode only affects connections that have already entered the core; it cannot bring apps that bypass the proxy into it. The global policy also needs to be configured correctly. Switching to global mode does not mean all device traffic will use a particular proxy node.

GeoIPGEOIP / IP database: A mechanism that uses an IP address database to match regions or predefined address sets. Results depend on the destination IP and the local database. A match does not identify the organization behind a domain or prove the server's physical location. Content delivery networks may resolve a domain to addresses in multiple regions. Coverage of private IP ranges also depends on the data file, so region labels should not be treated as permanent facts.

Rule Setrule-providers / RULE-SET: A data source that keeps domain entries, IP addresses, or complete matching rules separate for easier maintenance and updates. After defining rule-providers in the configuration, reference the relevant name in rules for it to affect routing. The data format must match settings such as behavior. A rule set loading successfully does not mean it will match before other rules.

DNS Resolution and Traffic Entry

DNS and Networking

DNS handles name resolution; the system proxy and TUN provide different ways for traffic to enter the core. These settings are related, but enabling one does not configure the others automatically.

DNSDomain Name System: A system that resolves domain names to IP addresses and other records, helping apps locate the services they need. The operating system, browser, and proxy core may each use different resolvers, and a browser's secure DNS setting can create a separate path. To check whether resolution follows the intended path, review the actual DNS settings and connection logs rather than relying only on the server name shown by a lookup tool.

Fake-IPenhanced-mode: fake-ip: The core returns a synthetic address for a domain and stores the mapping between them. When the connection reaches the core, it can recover the domain from that mapping before matching rules and choosing an outbound route. A synthetic address is not the target server's real public IP, so it cannot be used to determine the server's location. Apps that depend on real DNS results may need filtering or compatibility settings. After changing modes, check for stale DNS cache entries.

TUN Modetun / virtual network interface: Routes eligible IP traffic to the core through a virtual network interface, often to handle apps that do not follow the system proxy. Enabling it usually requires the appropriate permissions, driver, or background service, depending on the platform and client. Routes, exclusions, and other VPN software still affect which traffic is captured. If something goes wrong, check these conditions instead of repeatedly toggling the setting.

System Proxysystem proxy: Registers a proxy address and port with the operating system for apps that follow its settings. Browsers often use the system proxy, but command-line tools, games, and apps with their own networking stack may need separate configuration. It does not capture all traffic. If the network stops working after the client exits, check whether the system proxy still points to a local port that is no longer listening.

DNS LeakDNS leak: When DNS queries that should follow the intended resolution path are sent to another resolver, potentially exposing domain lookups to an unexpected service. Check the resolution paths used by the system, browser, core, and IPv6; an outbound IP check alone is not enough. Direct DNS is not always a leak: judge it against the intended policy, including whether the domain is supposed to resolve directly.

Where the Configuration Comes From

Subscriptions and Configuration Files

A subscription is a way to fetch content; a configuration file tells the core how to run. Clients may convert or override content between the two, so check the final effective configuration when troubleshooting.

Subscriptionsubscription URL: A remote endpoint that lets a client fetch and update nodes or configuration. Its URL may return a complete Clash configuration, a node list, or another format. Opening the link in a browser does not guarantee the client can import it in its current format; check the content type and core support. Subscription URLs often contain access credentials, so redact them from screenshots and logs before sharing.

YAML Configuration Fileconfig.yaml / .yml: A text file that uses YAML syntax to describe core settings, often including ports, nodes, proxy groups, DNS, and rules. Indentation defines nesting, while list items, quotation marks, and field types affect parsing. Use spaces rather than tabs when editing. Valid syntax does not guarantee that a field is supported; distinguish YAML parsing errors from core configuration validation errors.

Proxy Providerproxy-providers: A mechanism for loading a set of nodes from a separate file or remote source, keeping node updates separate from the main configuration. It usually supplies nodes, not a complete running configuration with DNS, ports, and rules. Proxy groups must reference it in the appropriate way. If a proxy provider file does not show a full policy interface when imported, it may have been treated as a complete configuration rather than being empty.

Mixed Portmixed-port: A setting that lets a single listening port accept both HTTP and SOCKS proxy requests, giving different apps one port to use. When configuring an app's proxy manually, make sure the address and port match what the core is actually listening on. Another process occupying the port can prevent the configuration from starting. Access from other devices also depends on allow-lan, the bind address, and firewall settings; changing the port alone does not enable sharing.

Configuration Overrideoverride / merge / patch: A mechanism clients use to merge, replace, or process selected fields when loading a subscription configuration. It's useful for retaining local settings such as ports and custom rules. Array and object merge order varies by client; the final overridden configuration determines actual behavior. Direct edits to generated subscription files may be overwritten on the next update. Check how the client persists changes and back up local edits before proceeding.

Back to term categories ↑