Configuration Fields · Protocol Concepts · Settings and Limitations

Clash Glossary

Look up terms by setting or use case. Understand what each concept does, then check the relevant client fields, permissions, and effective configuration.

This page covers 25 common terms. Use these explanations to understand your configuration; menu names and feature support depend on the client and kernel version you use.

Kernels and Clients

The client provides the controls; the kernel handles connections. Check both when a feature behaves differently than expected.

Client: Client application; An application interface for managing subscriptions, selecting policies, and changing system settings. Desktop clients often also manage tray menus, startup behavior, and logs. The client organizes user actions; the kernel handles connections. Even apps with similar interfaces may use different kernel versions or merge configuration differently. When choosing a client, check operating system support, maintenance status, and the features you need.

mihomo: Proxy core; A proxy kernel developed from Clash Meta that handles protocol connections, rule matching, DNS, and other network tasks. It is not itself a graphical client. Whether a configuration loads depends on the running kernel version and its supported fields. Before using documentation for a new feature, check the kernel version in the client details or startup logs, then decide whether to change the configuration.

Clash Meta: Historical core name; The former name of the extended kernel in the Clash ecosystem, later developed as mihomo. Older guides, subscription options, and app names may still use Meta. The name alone does not indicate when an installer was released or guarantee support for all current mihomo features. When migrating an older configuration, check field compatibility rather than simply renaming a file or changing the client’s displayed name.

TUN Mode: Virtual network interface; A way to route traffic through a virtual network interface, including traffic from some apps that ignore system proxy settings. Enabling it typically involves administrator permissions, a virtual interface, routing, and DNS interception; coverage depends on the operating system and client implementation. If your connection drops after enabling TUN, check for route conflicts, other VPNs, and DNS settings before assuming the node has failed.

System Proxy: System proxy settings; A proxy address setting provided by the operating system so apps that honor it can send requests to the client's local listening port. Enabling the system proxy does not route all traffic through it; games, command-line tools, and some apps may use their own network settings. If regular websites stop loading after you quit the client, check whether the system is still pointing to a proxy port that is no longer open.

Proxy Protocols

The protocol must match the server. Connection performance also depends on the route, transport, and network conditions.

Shadowsocks（SS）: Shadowsocks; A proxy protocol that establishes connections using a pre-shared key and a specified encryption method. A node entry typically needs the server address, port, encryption method, and password. The client and server must use compatible protocol generations and authentication settings; changing another protocol's type to SS will not make that node work. If authentication fails, first check the subscription details and kernel support, then investigate network connectivity.

VMess: VMess protocol; A proxy protocol that authenticates with a user ID and supports different transport options. A node may also include parameters such as WebSocket, TLS, and the server name. Even with the same protocol type, mismatched transport settings can prevent a connection. When troubleshooting an older configuration, check all parameters and the system clock; do not compare only node names or copy a user ID on its own.

Trojan: Trojan protocol; A proxy protocol that typically uses a TLS connection and password authentication. Both the TLS handshake and protocol authentication must succeed. The server name, certificate validation, and password must match the server, so an accessible port does not mean the node is usable. For certificate errors, check the system clock, domain name, and certificate settings; disabling certificate verification should not be the default fix.

VLESS: VLESS protocol; A lightweight proxy protocol that separates authentication from transport security and does not encrypt data on its own. Its security depends on the transport settings used with it. TLS, REALITY, the transport type, and related parameters determine how the connection works, so the name VLESS alone does not guarantee compatibility. If fields are ignored or reported as unsupported after import, first check whether the current kernel supports that combination.

Hysteria 2 and TUIC: QUIC-based proxy protocols; Two distinct QUIC-based proxy protocols that require the network to allow the relevant UDP traffic, but do not share the same authentication methods or configuration fields. They can behave differently from TCP-based options on some lossy networks, but are not guaranteed to be faster on every route. Consider server support, UDP restrictions, and battery life on mobile devices, then test with your actual workload.

Comparing transport trade-offs? See the protocol and kernel reference.

Rules and Routing

Rules determine where a connection goes; proxy groups determine how an exit is selected. Start troubleshooting by checking which rule actually matched.

Routing Rules: Rule-based routing; A mechanism for choosing how to handle traffic based on its domain, IP address, or other connection attributes. Rules are generally matched from top to bottom, and the first match determines the outcome, so more specific conditions usually belong above broader ones. If an app takes an unexpected route, check the matched rule in the connection log before changing rule order or conditions—rather than repeatedly switching nodes.

Proxy Groups: Proxy group; A collection of nodes or other policies that can be selected manually, tested automatically, or used for failover. Rules can reference a group by name. This separates traffic categories from the actual exit: keep the rules and change the selection within the group. Each group type has its own switching conditions, and an automatic test reflects only its specified test target—not whether every app can connect successfully.

GeoIP: IP geolocation database; A rule criterion that maps destination IP addresses to categories such as geographic regions using an IP database. For example, GEOIP,CN,DIRECT matches addresses classified accordingly in the database. The data may be out of date, and a single service may use IP addresses in multiple regions, so GeoIP cannot replace all domain rules. If routing is still wrong after updating the data, check the actual DNS results and rules that take precedence.

GeoSite: Categorized domain datasets; A collection of domains grouped by service or purpose that can be referenced by GEOSITE rules, reducing the need to maintain domains one by one. Available categories depend on the loaded data file, and not all data sources offer the same collections. GEOSITE categorizes domains, while GeoIP categorizes IP addresses. If a category is missing, check the data source and update logs.

DIRECT, REJECT, and MATCH: Actions and catch-all rule; DIRECT and REJECT are actions that respectively connect directly or reject a connection. MATCH is a rule type for matching the remaining traffic and usually belongs at the end. In the example MATCH,PROXY, PROXY is typically a policy name defined in the configuration, not an automatically available node. Referenced names must match their definitions exactly.

Networking and DNS

DNS resolution, traffic routing, and node connections are separate steps; check each one independently.

DNS: Domain Name System; A system that resolves domain names into network addresses and other records. Apps typically get a resolution result before initiating a connection. A client's DNS settings affect request paths, resolution results, and some rule decisions, but changing resolvers does not directly increase node bandwidth. If a domain is unreachable but its IP address works, start by checking DNS logs, caches, and whether the app uses its own DNS.

Fake-IP: Synthetic address mapping; A DNS mode in which the kernel returns synthetic addresses to apps and maintains a mapping between those addresses and domain names. These synthetic addresses are not the destination service's real public IPs. When a connection returns to the kernel, the mapping can preserve the domain name for routing. Some LAN services and apps may require real DNS results; if compatibility issues arise, configure filters as needed and check for stale DNS cache entries.

DNS Leak: DNS leak; When DNS requests bypass the intended resolution path and reach other resolvers. Before assessing a leak, clarify which resolver is expected to handle requests and which path they should take. Secure DNS in a browser, an app's built-in resolver, and system DNS can all change where requests go. The resolver location shown by a test site is only a clue, not proof of a leak; check logs and actual network settings as well.

Latency: Latency; The time a test target takes to respond using a particular method. A client's URL test may include connection setup and an HTTP response, so it is not the same as an ICMP ping. Results depend on the test URL, caching, network conditions, and timeout settings, so different tools' results are not directly comparable. Lower latency generally helps interactive response but does not directly predict sustained download speed or video stability.

Allow LAN: Allow LAN access; A setting that lets other devices access the proxy listener on this machine, often corresponding to allow-lan. It does not automatically route the entire LAN through the machine. Access also depends on the bind address, firewall, proxy port, and Wi-Fi client isolation. Enable it only on trusted networks, and limit access with authentication and appropriate network rules to avoid exposing the listener unnecessarily.

Subscriptions and Configuration

A subscription provides content, configuration defines how it runs, and overrides determine how the final configuration is merged.

Subscription: Subscription; A way to fetch or update a set of nodes or a complete configuration from a link. The content may be a list of protocol links or a YAML file containing rules and proxy groups. The client must support the relevant format; a successful download does not guarantee that the content can be imported. Subscription links may contain access credentials, so avoid sharing them in screenshots, logs, or support requests. Set auto-update intervals according to the provider's requirements.

Node: Proxy endpoint; An entry containing the connection parameters for a proxy endpoint, usually including its protocol, server address, port, and authentication details, and sometimes transport and TLS settings. A node name is only a label; it does not prove the server's location, route quality, or current availability. Changing the display name will not improve a connection. Troubleshoot using the full parameters, server status, and network path.

YAML: YAML configuration format; A text format for representing data such as mappings, lists, and scalar values, commonly used in Clash configuration to define proxies, rules, and DNS. Indentation, field hierarchy, and data types all affect parsing; the same line can mean different things at different levels. Use spaces for indentation and keep a backup when editing. Even valid syntax must still pass the kernel's checks for supported fields and valid references.

Configuration Overrides: Configuration override; A mechanism for merging or modifying specified fields while loading a subscription configuration. It can preserve local DNS, routing rules, or listener settings and reduce repeated edits after updates. Clients may differ in how they handle merge order, appended lists, and replaced fields, so features with the same name may not produce the same result. After making changes, inspect the effective configuration and confirm it remains as expected after the next subscription update.

Proxy Providers and Rule Providers: Proxy providers / Rule providers; proxy-providers and rule-providers load node collections and rule collections separately, keeping resource updates independent of the main configuration. A collection must still be referenced by a proxy group or rule to be used; merely declaring it does not affect traffic. If updates fail, distinguish main subscription logs from provider logs, then check the format, path, update interval, and local cache.