CLASH / CONFIGURATION GLOSSARY
Subscriptions, rules, TUN, DNS. Understand the terms before changing your configuration.
5 topic groups · 25 terms · Copy a direct link from any entry heading
01 / PROJECTS
The core handles connections; the client provides the interface. Check their names and versions separately.
Clash was originally the name of a proxy core project that routes network connections based on rules. Today, the term is also often used broadly for the related client ecosystem. The original project and its later forks do not share the same maintainers, and they do not support identical protocols or configuration fields. When something is described as “compatible with Clash,” check which core it requires rather than relying on the file extension alone.
mihomo continues the Clash Meta development line, handling proxy protocol connections, rule matching, DNS, and traffic entering through TUN. It is a core, not a specific desktop or mobile app; multiple GUI clients can use the same type of core. When checking whether a feature is supported, note both the client and core versions.
A GUI client is the app you use to toggle settings, import subscriptions, choose policies, and view logs—for example, Clash Verge Rev or FlClash. It translates interface settings into core configuration and may also manage the system proxy, service permissions, and startup behavior. Even clients using the same type of core can store settings in different places and apply overrides in a different order, so don't copy every app setting when switching clients.
This is the management endpoint a GUI or dashboard uses to read connection details, switch policies, and update configuration. It is not a proxy port for browser traffic. 127.0.0.1:9090 is an example of a local listening address, not a mixed proxy port. For remote access, set an access secret and restrict network access to avoid exposing administrative controls.
Logs record the core's connections and errors, making them a direct clue when investigating DNS failures, proxy handshake failures, or rule matches. log-level controls how much detail is recorded; raise it temporarily while troubleshooting, then restore your usual setting once you reproduce the issue. Before sharing logs, remove subscription URLs, authentication details, and any domains you don't want to disclose.
02 / PROTOCOLS
A protocol describes how a connection works, not the quality of a route. Keep all required parameters when importing it.
Shadowsocks is an encrypted proxy protocol. A node typically needs a server address, port, password, and encryption method. The client and server must use compatible settings. Some configurations also include a plugin and plugin options, so copying only the address and password may not be enough to connect. Support varies across encryption methods; if import succeeds but the connection fails, first check whether the core supports the method in use.
VMess and VLESS are different proxy protocols; changing the type name in a configuration will not convert one to the other. VLESS does not provide encryption by itself—the connection's security depends on the layer used with it, such as TLS or REALITY. Check the user ID, transport type, server name, and related security settings one by one instead of only checking whether the server is online.
Trojan typically uses TLS to protect the proxy connection between client and server. In addition to the password, it depends on the correct server name and certificate validation. The server address establishes the connection, while the TLS server name is used for the handshake and identity verification; they may differ. If you see a certificate error, check the configuration and system time first rather than disabling certificate validation as a permanent fix.
Hysteria 2 is a QUIC-based proxy protocol, and establishing a connection depends on UDP being reachable on the current network. Its protocol and configuration are not interchangeable with those of the first-generation Hysteria, so confirm that the client identifies the type correctly when importing it. The protocol name does not guarantee speed: network restrictions, server load, and bandwidth settings all affect performance. Test it on the networks you normally use.
These are usually local endpoints that applications use to hand traffic to the client. They are not the protocols the client uses to connect to remote nodes. An HTTP proxy can also forward HTTPS connections through CONNECT; it is not limited to HTTP websites. A mixed port accepts both HTTP and SOCKS requests. If an app supports manual proxy settings, enter the configured address and actual port rather than assuming it is 7890.
03 / ROUTING
The route traffic takes depends on rule order, matching conditions, and the current proxy group selection.
Rule-based routing checks connections in configuration order and sends each match to the corresponding policy, commonly direct, proxy, or reject. Put more specific domain rules before broader ones, then use MATCH at the end to catch the rest. Traffic can still be routed by rules when TUN is enabled; traffic capture and outbound route selection are separate things.
Proxy groups organize nodes or other policies under a selectable outbound name, so rules can point to a group instead of a specific node. select is commonly used for manual selection, url-test uses test results to help choose, and fallback switches between options based on availability and order. Changing a group's selection usually affects new connections; existing long-lived connections may keep using the previous route.
GeoIP classifies IP address data; GeoSite classifies domain collections. They are not interchangeable. An IP's registered location does not always match the service's actual location, and a CDN may resolve the same domain to different regions. Matching depends on the data source, its freshness, and core support. If traffic is routed incorrectly, check the specific rule and data first rather than relying on the node name.
Rule sets keep a collection of rules in a separate file. The main configuration declares the source with rule-providers, then references it with RULE-SET. This makes classification data easier to update, but does not choose an outbound route by itself—the referencing rule still needs a target policy. Different formats and behavior types have different requirements, so a successful download does not guarantee that the current declaration can parse the file correctly.
The latency shown by a client often comes from a connection or request test to a specified URL, not a traditional ICMP Ping. It reflects the time to reach that particular target at that moment; it is not the same as download speed, video stability, or reachability across all websites. When comparing nodes, use the same test target where possible and check how your actual apps perform. A timeout may also mean the test site itself is unreachable.
04 / NETWORK STACK
First check how traffic enters the core, then how domains are resolved. A successful connection doesn't mean DNS queries took the expected path.
The system proxy points the operating system's proxy setting to the local client, mainly affecting apps that follow that setting. Some command-line tools, apps with their own network stack, and games may ignore it, so a working browser does not mean every program is covered. Before closing the client, make sure the system proxy has been reset; otherwise, apps may keep sending requests to a local port that is no longer listening.
TUN sends traffic that matches routing conditions into the core through a virtual network interface. It's commonly used to cover apps that ignore system proxy settings. It usually requires appropriate permissions or service support, and coverage can also be affected by routes, exclusions, and other VPNs. Enabling TUN does not mean every connection will use a proxy; once traffic enters the core, rules can still send it direct or forward it through a proxy.
DNS looks up records such as the addresses associated with a domain and is an important step before most connections are established. The resolver used and the network path taken can affect the response and subsequent rule matching. DNS query routing and website traffic routing are separate concerns. If a problem persists after switching nodes, DNS caching or resolver settings may still be affecting the result.
Fake-IP mode returns virtual addresses to apps and stores an address-to-domain mapping in the core. When a connection arrives, the core can recover the domain for routing. These addresses are not the websites' real server addresses, so seeing them does not mean DNS is broken. Some apps that require real addresses or local network discovery may need to be added to a filter list. After changing DNS mode, clear app and system caches if necessary.
A DNS leak means queries are taking a path other than the one intended; seeing a resolver in a particular region is not enough to draw that conclusion. Browser secure DNS, the system resolver, IPv6, and app-specific DNS can each use a separate path. Before testing, decide which queries should go direct and which should use the proxy, then check connection logs alongside test results. Encrypted DNS does not automatically mean queries are going through the proxy.
05 / CONFIGURATION
Subscriptions provide content; configuration determines how the client runs. Keep update sources separate from local changes where possible.
A subscription is usually a resource URL that can be fetched repeatedly to retrieve a configuration or node list. The client can download it again when the provider updates its content. Similar-looking links may return a complete YAML file, a Base64-encoded list, or a single protocol link, so choose an import method that matches the format. A subscription URL is often tied to account access. Treat it as sensitive and don't share it in public screenshots or with untrusted online conversion tools.
A node is a set of parameters needed to connect to a remote proxy, typically including a server address, port, protocol, authentication details, and transport options. A node's name in the interface is only a label; it does not prove the actual exit region, bandwidth, or service quality. Seeing a node list after importing a subscription only means the configuration was read—you still need to select a policy and verify the connection.
YAML represents data using key-value pairs, lists, and indentation. The Clash ecosystem commonly uses it to describe ports, nodes, proxy groups, rules, and DNS. Use spaces for indentation; incorrect nesting, duplicate keys, or missing list markers can cause parsing failures or unexpected results. A file being valid YAML does not mean the current core supports every field in it. After editing, check the core's load messages too.
A proxy provider defines a separate node source with proxy-providers, which proxy groups can reference to keep node updates separate from the main configuration. It serves a different purpose from a rule provider and does not mean you can paste in any complete subscription file. If nodes are missing, check the source format, fetch results, and proxy group references instead of repeatedly clicking Update.
A configuration override applies local changes on top of a subscription's original content, letting you keep settings such as ports, DNS, or custom rules. Clients may replace fields, merge lists, or process scripts differently, so don't assume every override mechanism works the same way. If your changes disappear after an update, check whether you edited the original file that gets downloaded again, then review the final runtime configuration and override order.