Configuration reference · Organized by category

Clash Glossary

From proxy protocols and rule routing to the mihomo core and DNS settings, this glossary explains terms commonly found in the client interface and configuration files. Each entry covers what the term does and which relationships matter when reading a configuration.

5 categories 27 entries Useful for configuration and troubleshooting

Quick Index

Find terms by their common names

Both English abbreviations and Chinese names are retained in the index. Select an entry to jump directly to its explanation.

Protocol

Proxy Protocols

Protocols define how the client and server establish a connection, authenticate and transfer data. During setup, also verify that the core supports the protocol and its transport parameters.

Shadowsocks SS: A compact encrypted proxy protocol, commonly abbreviated as SS in Clash configurations. A node usually requires the server address, port, password and cipher; any mismatch can prevent a connection. Cipher compatibility also depends on the core version.

VMess vmess: A proxy protocol used by the V2Ray ecosystem, with authentication commonly represented by a user ID. VMess can use transports such as TCP and WebSocket, so checking only the server and port is not enough. The client’s network type, TLS settings and path must also match the server.

Trojan trojan: A proxy protocol designed around TLS connections. Clients usually require the server address, port, password and domain-related settings. Certificate name verification and SNI configuration affect whether the TLS connection can be established. When troubleshooting, distinguish authentication errors, certificate errors and unreachable networks.

VLESS vless: A proxy protocol with a streamlined authentication layer that does not provide a complete transport-security design on its own. Configurations usually combine it with TLS, Reality or a specific transport, so identical protocol names do not mean node parameters are interchangeable. Confirm that the current core supports the extensions used by the configuration.

Hysteria2 hy2: A QUIC-based proxy protocol optimized for networks with packet loss or significant bandwidth fluctuations. It uses UDP as its underlying transport, so stable UDP connectivity directly affects performance. Enter authentication, the TLS domain and bandwidth parameters according to the server configuration.

TUIC tuic: Another QUIC-based proxy protocol that supports multiplexing and other transport features. Node configurations typically include a user ID, password, congestion control and TLS-related fields. Older cores may not recognize newer configuration formats, so check core support first when an import fails.

Routing

Rules and Routing

Rules evaluate connection information from top to bottom and pass a match to the corresponding policy. The order, rule data and policy-group names together determine the final exit.

Rule Routing rules: A mechanism that identifies traffic by domain, IP, process or geographic data and sends it to a specified policy. Clash generally scans the rule list from top to bottom and stops at the first match. Placing a broad rule too early can prevent more specific rules from taking effect.

Policy Group proxy-group: A logical exit that combines multiple proxy nodes, other policy groups or DIRECT. Common types include manual selection, health checks, failover and load balancing. Rules usually reference the policy-group name rather than a specific node.

DIRECT direct connection: Indicates that traffic connects directly to the destination without passing through a proxy node. DIRECT is still affected by the local network, routing and DNS results. It can be used as the policy for an individual rule or as an option in a policy group.

MATCH fallback rule: The final fallback type in a rule list, receiving traffic that did not match any earlier rule. MATCH normally belongs at the end; rules written after it will not behave as expected. The policy it points to determines how otherwise unclassified connections are handled.

GeoIP IP geolocation rule: Matches according to the geographic information associated with the destination IP in a geolocation database. A domain connection may need to be resolved first to produce an address for GeoIP evaluation. Database freshness, resolution results and CDN routing can all affect the match.

GeoSite domain categories: Matches requests against predefined domain-category sets, such as software services or content categories. It works with domain collections, not the address-based geolocation checks performed by GeoIP. Available category names depend on the current geolocation data file and core support.

Core & Client

Cores and Clients

The graphical client provides the interface, while the core performs network processing. Understanding this boundary helps determine whether a capability depends on the interface version or the core version.

Clash Core core: The core program that reads configuration, creates proxy connections, evaluates rules and exposes a control interface. Graphical clients typically use that interface to read policy, connection and log data. Protocol support, DNS behavior and rule syntax are primarily determined by the core.

mihomo Clash.Meta: An open-source proxy core developed from Clash.Meta, with broad support for protocols, rules and DNS configuration. Some clients bundle mihomo, while other environments run it separately. When following a guide, check whether it targets original Clash syntax or mihomo extensions.

Graphical Client GUI client: An application that provides visual controls for importing configurations, choosing policies, viewing logs and managing the system proxy. Different clients can use the same core while differing in layout, update process and platform integration. Client and core upgrades may also be separate processes.

TUN Mode virtual interface: A mode that takes over IP traffic through a virtual network interface and typically covers more traffic than the system proxy. It can handle applications that ignore system proxy settings, but also involves routing, DNS and system permissions. If connectivity fails after enabling it, check interface creation, route installation and DNS settings in the logs.

Profile

Configuration and Subscriptions

Configuration describes how the core operates, while a subscription delivers or updates configuration content. A successful import only means the file can be read; it does not mean every node and rule will work correctly.

Subscription subscription: A configuration endpoint provided by a service. Clients use its subscription URL to fetch nodes and policy-related content. Updating a subscription retrieves remote data again, but whether local overrides remain depends on the client’s configuration-management method. Expired links, access restrictions or incompatible response formats can cause updates to fail.

Configuration File profile: A YAML document describing proxy nodes, policy groups, rules, DNS and listening ports. A complete configuration must keep names and references consistent; for example, a policy named in a rule must exist in the policy groups. After editing, validate the syntax before reloading the configuration.

Node proxy: A single proxy exit defined in a configuration, usually including the protocol, server address, port and authentication details. A node name is mainly for display and policy-group references, not a measure of connection quality. Usability depends on correct parameters, server status and the current network path.

YAML .yaml: The structured text format commonly used for Clash configurations, using indentation to express hierarchy. Tabs, incorrect indentation, missing colons or unsuitable special characters can make a file unparsable. Keep indentation consistent at each level and distinguish lists from key-value objects when editing.

Provider external collection: A configuration mechanism for loading proxy nodes, rule sets and other content from a separate file or remote URL. Proxy Provider manages node collections, while Rule Provider manages rule collections; their purposes differ. Update intervals, cache paths and reference names must all correspond correctly in the main configuration.

Network

Networking Basics

Whether a proxy works depends on more than the node: application proxy settings, name resolution, listening ports and operating-system routing also matter. Troubleshoot by checking each layer of the path in order.

Latency latency: The time between a test request leaving the client and its response arriving, usually measured in milliseconds. It reflects only the selected test address, test method and current network conditions, not download speed. Results from clients using different test targets are not directly comparable.

System Proxy system proxy: HTTP or SOCKS proxy settings supplied by the operating system for applications to read. Browsers and similar applications usually follow them, while some terminal tools, games and self-managed network programs may ignore them. If the proxy still has no effect, first check whether the application reads system settings.

DNS domain name resolution: The system that converts domain names into IP addresses, an important step before most network connections are established. Clash can select the DNS server, listening method and query path according to its configuration. Resolution results affect domain rules, GeoIP checks and the final connection address.

DNS Leak DNS leak: A condition where domain queries are sent through an unintended resolution path while application traffic follows the expected route. Common causes include an application specifying its own DNS, the system continuing to use its original resolver, or TUN and DNS hijacking settings not working together. Check who sends each query, where it goes and what result it returns.

Fake-IP enhanced mode: A mode in which the DNS module first returns mappings to reserved addresses, then the core restores the target domain from those mappings and applies routing rules. This helps keep domain information identifiable during connection handling. Some LAN devices and specialized applications do not work well with mapped addresses and can be excluded with filter rules.

Mixed Port mixed-port: A setting that accepts both HTTP and SOCKS5 proxy connections on the same local listening port. Each application only needs to connect using a supported proxy type. If another program already occupies the port, the core usually reports the listening failure in its logs.

Conceptual Relationships

Processing flow from subscription to connection

Load the configuration The client reads YAML content from a local file or subscription and passes it to the core for parsing.
Open an entry point The system proxy, mixed port or TUN mode sends application traffic into the core.
Identify the destination DNS, domain and destination IP information provide the conditions needed for rule matching.
Match the rules Rules select a policy group in order, while MATCH handles connections that did not match earlier rules.
Select the exit The policy group ultimately selects a node or DIRECT and establishes the connection accordingly.