REFERENCE / 25 TERMS

Clash Glossary

Map terms from the interface to configuration fields. Browse five groups covering cores, protocols, routing, traffic capture, and subscription formats. Each term has its own linkable anchor.

Set up Clash step by step → Browse the full cross-platform guide →

01 / ENGINE & CLIENT

Cores and Clients

The client provides the interface; the core handles connections. When troubleshooting, note the client name, core name, and active configuration separately.

mihomoProxy core / Clash.Meta: mihomo is a proxy core in the Clash ecosystem, previously known as Clash.Meta. It handles protocol connections, DNS, rule matching, and traffic forwarding. GUI clients such as Clash Verge Rev can bundle the core, but the client version and core version are separate. To check whether a field is supported, consult the documentation for the core actually running—not just the client name.

GUI ClientGUI / Configuration and OS Integration: A GUI client provides controls for managing subscriptions, choosing policies, reviewing connections, and toggling the system proxy, then passes configuration to the core. Some clients combine interface options, templates, and overrides into the active configuration, so editing the original subscription may not change behavior. If a setting reverts after restart, first check whether you edited the source subscription, a persistent override, or a temporary runtime copy.

Proxy Nodeproxies / Outbound connection details: A proxy node usually consists of a server address, port, protocol, and authentication parameters. In a full configuration, it commonly appears as an entry under proxies. The name shown in a list is only a label; it does not confirm the server's location, actual egress region, or availability. A node is not a policy group: a node describes a specific connection, while a policy group selects an outbound from several connections or other groups.

Latency TestTest URL / timeout: A client typically accesses a test URL through a selected proxy and records how long the request takes. Implementations may differ in how they handle connection reuse and timing. Results depend on the test URL, destination, network path, and timeout settings; they do not measure download bandwidth or represent access speeds for every website. A timeout only means that this probe did not finish in time. Check actual access and logs as well.

External Controllerexternal-controller / Management API: external-controller sets the listening address for the core management API. A GUI can use it to read connection logs, check status, or switch policies. The example 127.0.0.1:9090 is a local management endpoint, not a browser HTTP proxy address. Do not bind the management API to an externally accessible address unless access controls and network isolation are configured.

02 / PROTOCOL

Proxy Protocols

Distinguish the protocol an application uses to connect to a local proxy from the protocol the core uses to connect to a remote server. Similar names do not mean the settings or transport behavior are interchangeable.

HTTP ProxyHTTP / CONNECT: With an HTTP proxy, an application sends requests to a proxy listener. HTTPS usually uses CONNECT to establish a tunnel, after which the application negotiates TLS with the destination. Connecting to a local HTTP proxy does not mean the remote node also uses HTTP or that every link is automatically encrypted. Traffic uses the proxy only if the application is configured to do so.

SOCKS5TCP / UDP ASSOCIATE: SOCKS5 is a general-purpose proxy protocol that supports TCP and, when both the application and proxy support it, UDP forwarding. Whether DNS is resolved locally or by the proxy depends on how the application connects; some command-line tools distinguish these options with different URL schemes. Providing a SOCKS5 address alone does not ensure all DNS queries use the proxy or capture traffic from apps that do not support proxies.

Shadowsockstype: ss: Shadowsocks provides encrypted forwarding between a client and a proxy server. In mihomo node configuration, it is commonly written as type: ss. The server address, port, encryption method, authentication parameters, and optional plugins must match the server; the display name alone is not enough to restore a connection. Support can vary by protocol revision and encryption method, so check core capabilities and field values if import fails.

Trojantype: trojan / TLS: Trojan typically carries proxy traffic over TLS. In addition to the server address and authentication parameters, configure the certificate hostname correctly. The server connection address and certificate hostname can serve different purposes and should not be swapped arbitrarily. For certificate errors, check the system clock, certificate chain, and hostname. Skipping certificate verification weakens server identity checks.

Hysteria 2type: hysteria2 / QUIC: Hysteria 2 is a QUIC-based proxy protocol that relies on UDP connectivity. If the network blocks UDP, it may fail to connect even when TCP services on the same server work. Hysteria 2 configuration names are not interchangeable with those for the first-generation Hysteria. The protocol itself does not guarantee throughput; performance also depends on route quality, server resources, and network congestion.

03 / ROUTING

Rules and Routing

First confirm that the connection reaches the core. Then check rule order, the selected target, and rule data. Every name used in a rule must be defined.

Rule-Based Routingmode: rule / rules: In rule mode, the core checks connections against rules in order and sends each match to its specified outbound or policy group. For example, DOMAIN-SUFFIX,github.com,PROXY sends the domain and its subdomains to the target named PROXY. Changing rule order changes the result, but cannot fix an app that never reaches the core. Check the matched rule in the connection log when troubleshooting.

Policy Groupproxy-groups / select / url-test: A policy group combines proxies or other groups under an outbound name that rules can reference. select lets you choose manually, url-test selects based on periodic probes, and fallback switches according to member order and availability. Automatic selection depends on the test URL and check interval; it does not mean every website will use its individually fastest route.

GeoIPGEOIP,CN,DIRECT: GeoIP uses an IP address database to determine the location associated with a destination address, often for choosing direct or proxy routing. It does not classify traffic by company location or domain suffix. CDN routing and database updates can change the result. Resolving a domain to an IP may also trigger a DNS lookup; no-resolve prevents that IP rule from initiating a lookup, but does not mean DNS is unnecessary for the connection as a whole.

Rule Providerrule-providers / RULE-SET: A rule provider stores a set of domain, IP, or other rules separately. Declare it with rule-providers, then reference it in rules with RULE-SET. The payload format must match settings such as behavior and format, and the provider name must match exactly. A successful download only confirms that content was retrieved; it does not guarantee a supported format or that any connection will match.

MATCHCatch-all rule / Final match: MATCH handles connections that did not match earlier rules and usually belongs at the end of the rule list. If MATCH,PROXY appears at the top, later rules cannot handle connections it has already matched. PROXY is a custom target name, not a built-in reserved value, so a proxy or policy group with that exact name must exist. DIRECT and REJECT are built-in outbounds.

Further reading: Configuration files and rules →

04 / TRAFFIC CAPTURE

Traffic Capture Modes

Traffic entry, DNS resolution, and outbound rules work together. The state of a single toggle cannot confirm that the entire connection path is working as intended.

System ProxyOperating system proxy settings: The system proxy registers a proxy listener with the operating system so apps that honor the setting can connect to the local proxy. Some command-line tools, games, and apps with their own network stacks ignore it, so a working browser does not mean every app is covered. Before closing the client, make sure the system proxy setting is restored; otherwise, apps may keep trying to connect to a local port that is no longer listening.

TUN Modetun.enable / Virtual network interface: TUN captures IP traffic through a virtual network interface and related routes, including traffic from some apps that ignore system proxy settings. Actual coverage depends on automatic routing, exclusions, system permissions, and DNS settings; enabling tun.enable does not guarantee that every connection is captured. stack selects the network stack implementation, not the rule mode. After enabling TUN, rules can still send traffic direct or through a proxy.

mixed-portLocal HTTP + SOCKS proxy port: mixed-port lets a single local port accept both HTTP and SOCKS proxy connections, for example mixed-port: 7890. It serves a different purpose from a remote node port or management API port, and these ports are not interchangeable. Apps must use the correct proxy type and listener address. To allow other devices to connect, also review the listening address, LAN access permissions, and firewall settings.

Fake-IPdns.enhanced-mode: fake-ip: Fake-IP mode returns synthetic addresses to apps and maintains a mapping to the corresponding domains, allowing the core to recover the destination domain when a connection is made and apply routing rules. These addresses are not the destination server's real public IPs. DNS queries and subsequent connections must follow the configured traffic-capture path. Some apps that depend on real DNS answers may need entries in fake-ip-filter, but avoid adding broad exclusions without evidence.

DNS LeakResolution path / Unexpected resolver: A DNS leak usually means that queries take an unexpected network path or use an unintended resolver, exposing domain lookup information to an unintended party. Browser Secure DNS, system resolvers, and the core's DNS settings may all be involved; a resolver appearing in a different region does not by itself prove a leak. First establish the intended path, then check whether queries reach the core, how upstream DNS traffic is routed, and whether the app uses its own encrypted DNS.

How it works: TUN Mode vs. System Proxy →

05 / SUBSCRIPTION & CONFIGURATION

Subscriptions and Configuration Files

Identify the input first, then choose how to import it. A full configuration, a proxy provider, and a share link are different kinds of data.

Subscription URLRemote configuration / Scheduled updates: A subscription URL fetches a proxy list or full configuration from a remote server and often contains credentials that identify your account, so treat it as sensitive information. The same HTTPS URL format can return YAML, an encoded list of share links, or another format; the URL suffix alone cannot establish compatibility. After importing, check that the configuration is enabled and policy groups appear, then test a connection. A successful update and working nodes are separate conclusions.

YAMLIndentation / Keys, values, and lists: YAML is a common serialization format for mihomo configuration. It uses spaces for indentation and - for list items. Tabs, duplicate keys, and special characters in unquoted values can cause parse errors or change their meaning. A file that parses is not necessarily a valid configuration; also check field types, core support, and the policy names referenced by rules.

Configuration Fileconfig.yaml / Runtime settings: A configuration file defines runtime settings such as local listener ports, DNS, proxies, policy groups, and routing rules. config.yaml is a common filename, but the extension alone does not determine whether the contents are usable. A GUI client may merge templates and overrides before startup, so the original subscription may differ from the active configuration. Keep a recoverable copy before editing, then check startup logs to avoid mistaking a load failure for a network problem.

Proxy Providerproxy-providers / use: A proxy provider loads entries from a local or remote source with proxy-providers; policy groups then reference it with use. It usually provides node data only, not DNS, listener ports, or routing rules from a full configuration, so do not assume it can be enabled on its own. Provider update intervals may also be managed separately from the client’s full subscription refresh schedule; check each at the relevant level.

Subscription ConversionPayload conversion / Target format: Subscription conversion transforms an input payload into a format the target client can read. Some converters also apply policy-group and rule templates. Conversion cannot supply missing authentication parameters or make a core support protocol fields it does not support. Third-party conversion services can usually access the full subscription URL, so consider the credential exposure risk before using one. First check whether the client can import the original format directly.