Browse 25 common terms in five categories. First distinguish the core, client and traffic entry points, then learn how rules, DNS and configuration files fit together. Each term has its own anchor, so you can share a direct link to its explanation.
For step-by-step setup, see the getting started guide. For a complete walkthrough of configuration, read the user guide.
The interface manages settings; the core applies them. Whether a toggle takes effect also depends on permissions, the active configuration and whether traffic reaches the core.
mihomo is a proxy core developed from the Clash Meta branch. It parses configuration, matches rules, handles DNS and establishes proxy connections. A graphical client can manage it, or it can run independently from the command line. Check the version of the core actually in use and its documentation to confirm that a field is supported; the client name alone is not enough.
Compare: Graphical Client →A graphical client provides an interface for importing subscriptions, selecting proxy groups, toggling the system proxy and viewing logs. Clash Verge Rev is one example. A client may also manage the core process and merge interface settings into the subscription configuration. The original subscription may therefore differ from what the core receives; check the active runtime configuration when troubleshooting.
Browse the client list →The system proxy registers a proxy address and port with the operating system, and apps that honor this setting connect through it. The local loopback address is a common proxy endpoint. This does not capture all device traffic, and apps with their own network settings may ignore the system proxy. If only some apps cannot connect, check their own proxy settings before considering TUN.
Compare: TUN Mode →Service mode lets a client use a background system service to start or manage core tasks that require elevated permissions. Desktop clients commonly use it for features such as virtual network interfaces. Installing the service may require administrator approval, but it does not automatically enable the system proxy, TUN or launch at startup. After installation, check each feature toggle, the core status and the relevant logs.
The external controller API lets a graphical client or dashboard read status, switch policies and manage connections. Its configuration field is usually external-controller. This is an administrative interface, not a proxy port for routing browser requests. It should usually listen only on the local machine and require authentication. Before allowing LAN access, consider permissions and firewall rules.
A node is more than a server address. Its protocol, authentication, transport and network support must work together, and test results need to be interpreted in context.
A proxy node is a set of parameters for connecting to a remote proxy service, usually including the server address, port, protocol, authentication details and transport options. Its name is just a label; any location or route description in the name is no substitute for testing. A node may perform differently with different destinations, so check connection logs and actual access results to assess whether it works.
A proxy protocol defines how the client authenticates with a remote service and forwards data. Common protocols include Shadowsocks, VMess, VLESS and Trojan. The same server address does not make protocols interchangeable; preserve the password, user ID and all other protocol-specific parameters. If importing or handshaking fails, first confirm that the core supports the protocol, then check whether conversion dropped any node fields.
The transport determines how data is carried, such as directly over TCP or through WebSocket. TLS can encrypt a connection and verify the server's identity. These are distinct from the proxy protocol; the server name, certificate and transport path must all match the server configuration. For certificate errors, check the system time, server name and certificate chain first. Disabling verification is not a long-term fix.
UDP forwarding carries UDP-based app traffic through a proxy, commonly for real-time communication, gaming and some DNS requests. A browser loading a webpage only confirms that the connection used for that request works; it does not prove UDP forwarding is working. The client configuration, proxy protocol, remote service and network path can all affect the result, so test with the app you need to use.
A client's latency test usually measures how long it takes to reach a specified test URL through a node; it may not match the network round-trip time measured by ICMP. The target site, connection reuse and network fluctuations all affect the result, so values from different test URLs are not directly comparable. A lower test time does not guarantee higher download speeds. If a test times out, check whether the test target is unreachable or the entire node is unavailable.
First check which rule a connection matched, then which proxy group that rule points to, and finally which node is selected in that group.
Rule-based routing selects a connection policy based on conditions such as the domain or destination IP. Standard rules are matched from top to bottom, and the first match determines where the connection goes. For example, DOMAIN-SUFFIX,github.com,PROXY sends matching domains to the policy named PROXY, provided that policy exists. Put specific rules before broader ones, and use MATCH at the end to handle the remaining traffic.
Proxy groups organize multiple nodes or other groups into entries that rules can reference, so rules do not need to point to a single node. Use select to choose manually, url-test to choose based on test results, and fallback to try entries in order until one is available. Group names are user-defined; a name containing “Auto” does not guarantee automatic testing. Check the group type and its members.
Rule mode selects a policy according to the ruleset. Global mode usually sends connections that have reached the core to the global policy, while direct mode connects to the destination directly. Clash global mode does not capture app traffic; switching modes will not change the route of connections that never reached the core. When troubleshooting routing, you can briefly compare modes, but also check which member the global policy currently selects.
GeoIP matches by IP address location, while GeoSite uses categorized domain data. They match different types of data and depend on separate sources. An IP's registered location does not directly indicate the user's location or where a service is hosted; CDN-backed sites especially require domain-based rules for accurate routing. Updating Clash GeoIP data is separate from updating subscriptions. If a category looks wrong, check the data source, its last update and the rule order.
Rule providers store large sets of matching conditions. Define them with rule-providers and reference them in the main ruleset with RULE-SET. The ruleset's behavior type, file format and contents must be compatible; a domain list cannot simply be loaded as an IP list. Updating a ruleset refreshes its conditions but does not change its position in the main ruleset or create a missing proxy group.
Domain resolution and the path a connection takes into the core are related, but neither can replace the other.
DNS resolution translates domain names into IP addresses and other records. A core can use its own resolver to support rule matching and establish connections. The operating system, browser and apps may each use different resolvers, and a browser's encrypted DNS setting may bypass the system resolver. After changing the core's DNS settings, check which resolver actually made the request and whether the result came from an old cache.
Fake-IP returns a virtual address from a reserved range and maps it to the domain, allowing the core to route by domain when a connection is made. These addresses are not the remote website's real IP and should not be compared directly with public IP geolocation data. Some apps that require real addresses or resolve names themselves may need exceptions. Use fake-ip-filter to add domain-specific exclusions, then reconnect to verify the result.
TUN mode uses a virtual network interface and routing rules to send more app traffic to the core, including traffic from apps that cannot be configured to use a proxy directly. The traffic it captures still depends on routes, system permissions, exclusions and DNS settings; enabling it does not guarantee that every protocol is forwarded correctly. When using another VPN or virtual network adapter at the same time, watch for route conflicts. If problems arise, disable them one at a time to compare.
A DNS leak occurs when a query takes an unexpected resolution path—for example, when a domain that should be handled through the proxy is queried by a local network resolver. First define the expected policy: a domain deliberately set to resolve directly is not necessarily a problem just because the resolver's location differs. To check for a Clash DNS leak, consider the resolver, browser encrypted DNS settings, system settings and connection logs rather than relying only on the country or region shown by a test site.
A mixed port provides HTTP and SOCKS proxy access on the same listening port, commonly for local apps. The corresponding configuration field is mixed-port. Use the port from the active configuration; example values in a tutorial may not match your client. If you allow LAN connections, also check the listening address, authentication and firewall settings to avoid exposing a local proxy to other networks.
Distinguishing the downloaded source, local edits and the final runtime configuration helps prevent lost settings after a subscription update and explains why some changes do not take effect.
A subscription URL retrieves nodes or a complete configuration. Clash proxy provider subscriptions are commonly generated by the service provider and may contain an access token that identifies your account. Treat the URL as sensitive; do not include it in public screenshots, logs or forum posts. Updating a subscription refreshes its source content but does not switch the active proxy group. After importing, confirm that the profile is enabled, the group has selectable members and the traffic entry point is configured correctly.
YAML is a common configuration format that uses indentation, key-value pairs and lists to describe data. Clash configurations often use filenames such as config.yaml. Indent with spaces; incorrect nesting, duplicate keys or special characters that need quoting can cause parsing errors. A successful parse only confirms that the structure is readable. Also check that the current core supports the fields, referenced policies exist and the runtime logs show no errors.
Subscription conversion transforms node details or a complete configuration into a format another client can read. It is often used when the source and target client use different formats. Conversion may drop protocol parameters, proxy groups, rules or DNS settings; it does more than change the file extension. A remote conversion service processes your original subscription, so check that it is trustworthy and consider using a compatible format provided directly by the source instead.
Overrides and merging add to or modify the configuration without changing the original subscription. They are useful for local ports, DNS settings and custom rules, and can prevent subscription updates from overwriting local changes. Clients may handle object merging, list replacement and rule appending differently, so do not assume steps for one client apply to another. After editing, inspect the merged configuration, especially custom rule order and referenced proxy group names.
A profile is a local file or subscription record saved by the client. The runtime configuration is what the core receives after profile selection, overrides and merging. The source shown in an editor, the file on disk and the core's current state may differ; changes may also need to be applied again. When troubleshooting, confirm which profile is enabled, then check the runtime configuration and logs instead of repeatedly editing an inactive file.