Clash Glossary
Run into an unfamiliar term while reading a tutorial or editing a config file? Use this page to look it up by category. Every entry is organized under one of five directions — proxy protocols, cores and clients, rule routing, network and DNS, and config file fields — with two to four practical sentences per term, noting how it relates to the mihomo core's capabilities.
Proxy protocols
The transport protocol behind a node's type field. The protocol determines how traffic is encrypted and disguised, which directly affects core support.
Shadowsocks Proxy protocol
A widely used early encrypted proxy protocol that transports SOCKS5 traffic between client and server using symmetric encryption. Designed to be lightweight and low-overhead, with few config fields and mature cross-platform implementations. Written as ss in Clash config, typically paired today with an AEAD cipher.
VMess Proxy protocol
A transport protocol designed by the V2Ray project that relies on a UUID for authentication and requires client and server clocks to be roughly in sync. Supports various disguise and transport-layer combinations, such as WebSocket plus TLS. Natively supported by the mihomo core, written as vmess in config.
VLESS Proxy protocol
A streamlined successor to VMess that drops the built-in encryption layer and hands encryption duties entirely to the TLS transport, lowering handshake overhead. Often deployed alongside XTLS or REALITY. Not supported by the original Clash core — you need the mihomo core to parse it.
Trojan Proxy protocol
A protocol that disguises proxy traffic as standard HTTPS access, relying on a real TLS certificate for the handshake, so its traffic pattern closely resembles a normal website visit. Configuration only needs a server address, port, and password. Written as trojan, and supported by mainstream clients and cores alike.
Hysteria2 Proxy protocol
A high-speed transport protocol built on QUIC (UDP) that uses custom congestion control to sustain throughput on lossy links. Suited to long-distance, high-latency, or weak-network conditions. An mihomo extension protocol not available in the original core; written as hysteria2 in config.
Cores and clients
The core handles traffic forwarding and rule matching; the client handles the graphical interface and subscription management. Understanding this split makes choosing software and troubleshooting much clearer.
mihomo Core and client
The de facto standard core in the Clash ecosystem today, maintained as a continuation of the Clash Meta project. Compared with the original core, it adds support for protocols like VLESS and Hysteria2, more rule types, and fuller DNS capabilities. Mainstream clients such as Clash Plus, Clash Verge Rev, and FlClash all bundle this core.
Original Clash core Core and client
Refers to the original open-source clash core and its closed-source Premium variant, both of whose repositories have since been archived and are no longer updated. Old config files mostly load fine under mihomo, so migration is easy. When picking a client, confirm its core is mihomo to avoid missing newer protocols.
GUI client Core and client
A desktop or mobile app that wraps a graphical interface around the core, providing entry points for subscription management, node switching, the system proxy toggle, and TUN mode. The core handles traffic forwarding while the client handles the human interface — one wraps the other rather than replacing it. The same config file works across different clients.
Subscription Core and client
A URL provided by a proxy service or self-hosted server that returns config content containing all node information when accessed. Clients pull this URL periodically to sync node changes automatically, without manually entering each server's parameters. A subscription link is equivalent to an account credential and shouldn't be shared publicly.
Subscription conversion Core and client
A service or tool that converts a node subscription in one format into Clash YAML config, commonly implemented as subconverter. When a subscription source only offers a format meant for other clients, a conversion endpoint can generate a full config complete with a rule template. Public conversion services do handle your subscription content, so self-hosting is recommended for sensitive use.
Rules and routing
The core difference between Clash and ordinary proxy tools: which outbound each connection uses, based on what conditions, is entirely decided at this layer.
Rule routing Rules and routing
Clash's core mechanism: matching each connection to a different outbound policy based on conditions such as domain, IP, or process. Rules are matched top to bottom, and matching stops at the first hit. The order of the rules list in config directly determines the final routing outcome, so check ordering first when routing behaves unexpectedly.
Proxy group Rules and routing
A selectable group made up of multiple nodes or other groups, with types including manual select, auto-testing url-test, fallback, and load-balance. A rule's outbound usually points to a proxy group rather than a single node, so switching nodes just means switching within the group.
Rule provider Rules and routing
An external rule file referenced via the rule-providers field, supporting both HTTP subscription and local paths, updated automatically at the interval given. After moving a large rule set out of the main config, referencing it with a single RULE-SET line greatly reduces maintenance overhead.
GeoIP Rules and routing
A rule type that matches a connection's destination country or region using an IP geolocation database, typically written as GEOIP,CN,DIRECT. Matching happens only after the destination IP is known, so it's often placed near the end of the rule list as a fallback. The database file is downloaded automatically by the core, and the update URL can be set in config.
GEOSITE Rules and routing
A rule type that matches against a precompiled domain category database, sourced from a community-maintained domain classification project. A single GEOSITE rule can cover hundreds or thousands of domains in one category, dramatically shortening the rule list. An mihomo-enhanced capability not available in the original core.
Network and DNS
How traffic gets taken over and how domains get resolved is the root cause behind most tricky issues. This group of concepts comes up most often during troubleshooting.
Node Network and DNS
An entry in the proxies list of the config file representing a single proxy server, including protocol type, address, port, and authentication info. Each selectable server line in the client interface corresponds to one node. Node quality is determined by the physical route and server end, not by the client software itself.
Latency test Network and DNS
A probe request the client sends to a specified test URL, with the resulting time shown in milliseconds next to each node. The number reflects the round-trip time of a single HTTP handshake — useful only for comparing nodes against each other, not the same as actual download speed. The url-test proxy group relies on this result to automatically pick the current best node.
DNS leak Network and DNS
The situation where, even after the proxy is enabled, domain resolution requests still go directly to the local ISP's DNS, exposing browsing intent. A common cause is UDP port 53 traffic not being taken over under system proxy mode. Enabling Clash's built-in DNS together with TUN or Fake-IP mode avoids this.
Fake-IP Network and DNS
A response mode of Clash's built-in DNS: it immediately returns a fake IP from a reserved range for a domain query, deferring the actual resolution until the connection is established. This skips the wait for an upstream DNS response and avoids tampered resolution results. Apps that depend on a real IP need to be excluded via fake-ip-filter.
TUN mode Network and DNS
A way of taking over all system traffic at the network layer by creating a virtual network interface, without depending on applications honoring proxy settings on their own. Command-line tools, games, and UDP traffic are all included in routing. Requires administrator or root privileges to enable, configured via the tun.enable field.
System proxy Network and DNS
The traditional approach of registering an HTTP/SOCKS proxy address in OS network settings, which applications read and honor on their own. Simple to implement and requires no special privileges, but apps that don't honor the setting will simply bypass the proxy. Complements TUN mode — pick whichever fits the situation.
Domain sniffing Network and DNS
A feature that resolves the real domain from SNI or Host in passing TLS/HTTP traffic, then uses that domain rather than the IP for rule matching. It fixes domain rule mismatches under Fake-IP or plain-IP connections. Enabled in mihomo via sniffer.enable.
Config file fields
The most frequently seen top-level fields in config.yaml. Understand what their values mean, and you can read almost any subscription config.
YAML Config field
The text format used by Clash config files, expressing hierarchy through indentation, with a space required after every colon. Indentation must use spaces only — mixing in tabs will break parsing outright. When an edit throws an error, check indentation levels and colon spacing first.
mixed-port Config field
The listening field that accepts both HTTP and SOCKS5 proxy protocols on a single port, with a common default of 7890. Browser extensions and command-line tools can share this one port without needing separate settings. When sharing the proxy on a LAN, other devices are pointed at this same port number.
allow-lan Config field
A toggle for whether other devices on the local network may connect to this machine's proxy port. Setting it to true lets phones or TV boxes on the same network point their proxy at this computer. When enabled, remember to open the port in your firewall, and add authentication via the authentication field if needed.
mode Config field
A global field that determines the traffic handling strategy: rule means route by rules, global means everything goes through the proxy, direct means everything connects directly. rule is recommended for everyday use. The mode-switching button in a client's interface changes exactly this field.
proxy-providers Config field
A field for importing a node collection via subscription, supporting multiple sources with automatic periodic updates, and able to coexist with a hand-written proxies list. Combined with a proxy group's use reference, it enables combining and consistently grouping multiple subscriptions.
external-controller Config field
The listening address field through which the core exposes a RESTful control API, with a common value being 127.0.0.1:9090. Web control panels use this interface to read the connection list, switch nodes, and view logs. If it's bound to a non-local address, be sure to set a secret access key as well.
Put these concepts into a real config
Terminology is just an index — hands-on practice is what makes it stick. The two pages below cover the practical use of these concepts at different levels of depth.
First-time users should start with the install and subscription import tutorial to set up the client step by step; for deeper DNS tuning, proxy group design, and rule provider management, check the advanced configuration guide; if you haven't installed a client yet, head to the client download page and pick your platform.