Clash Glossary – Configuration, Rules, DNS, and Core Concepts

Category Navigation

Jump to the part of the setup related to your issue. Every term on this page has its own anchor, so the current URL can be copied for reference.

Quick Index Subscription Node Latency Rule-Based Routing Proxy Group YAML GeoIP DNS Leak Fake-IP TUN mihomo Mixed Port

01

Core Concepts

Understand how the client, subscription sources, proxy entries, and operating modes relate to one another.

Clash: Clash generally refers to an ecosystem of proxy tools that process network connections by rule, rather than a single graphical program. In practice, distinguish the graphical client, proxy core, and YAML configuration file because each has a different role. A client interface containing Clash in its name does not necessarily use the same core version or feature set.
Subscription Subscription: A subscription is a remote configuration endpoint generated by a service provider. The client uses its URL to retrieve proxy entries, proxy groups, and routing rules. A subscription link is neither a node nor a local configuration file. When an update runs, the client reads the remote content again, so direct changes to the generated configuration may be overwritten.
Node Proxy: A node is a server entry used to establish a proxy connection. It typically includes the protocol, server address, port, and authentication parameters. Whether a node connects successfully depends on correct parameters, network reachability, and protocol support. A proxy group references one or more nodes and determines which outbound route the current connection uses.
Configuration File Profile: A configuration file describes listening ports, proxy entries, proxy groups, rule order, and DNS behavior, commonly in YAML format. After importing a subscription, the client usually saves the remote content as a selectable profile. Switching profiles changes the rules and policies defined in them, not just the node list.
Proxy Mode Mode: Proxy mode determines how connections select an outbound route. Rule mode checks the rule list in order, Global mode sends connections to the current global policy, and Direct mode bypasses proxy forwarding. Rule mode is usually the starting point for daily use; other modes can be enabled temporarily when comparing rule behavior during troubleshooting.
Latency Latency: Latency is the time between sending a test request from the local device and receiving a response. The result shown by a client applies only to a specific test address, protocol, and network state, so it does not by itself represent download speed or connection stability. Different clients may use different test methods, making direct comparisons unreliable.

02

Protocols and Transports

Distinguish the local proxy entry point, the remote connection protocol, and the transport used to carry the connection.

HTTP Proxy: An HTTP proxy is a common way for applications to connect to a local proxy port. Browsers and operating system proxy settings usually support this entry point. It is not the same layer as the protocol used by a remote node. Traffic reaches the listening port only when the application reads the system proxy settings or has a proxy address configured directly.
SOCKS5: SOCKS5 is a general-purpose proxy protocol that can forward various TCP connections and, depending on the client and core implementation, UDP. Some applications let you enter a SOCKS host and port separately. Check whether the application resolves domains through SOCKS; otherwise, DNS queries may still follow the application's original path.
TLS: TLS provides encryption and server authentication for network connections. TLS options in proxy configurations commonly also involve the server name, certificate verification, and application-layer protocol negotiation. Certificate errors should not be addressed simply by disabling verification; first check the system time, server name, and configuration source.
WebSocket WS: WebSocket is a bidirectional communication protocol built on HTTP and can serve as a transport layer in some proxy configurations. Related fields often include a path and request headers, which must match the server-side configuration. WebSocket describes how data is carried; it does not determine rule matching or proxy group selection.
UDP: UDP is a connectionless transport protocol commonly used for DNS, real-time communication, and some game connections. Whether UDP can be forwarded through a proxy depends on the remote protocol, node settings, core capabilities, and traffic interception method. Enabling UDP in the client alone cannot add support that the server lacks.
Transport Layer Transport: In proxy documentation, the transport layer usually describes how data from the proxy protocol is carried, such as over TCP, WebSocket, or another transport. Transport parameters must correspond to the server configuration. This is separate from local traffic interception through the system proxy or TUN.

03

Configuration and Rules

Learn how rule order, proxy group behavior, and external configuration resources are organized.

Rule-Based Routing Rules: Rule-based routing determines which policy handles a connection according to its domain, IP, process, or network type. Rules are usually evaluated from top to bottom, and matching stops after the first hit. A broad rule placed too early can hide more specific rules below it, so order matters as much as rule content.
Proxy Group Proxy Group: A proxy group combines multiple nodes or other policies into one logical outbound route. A manual group lets the user choose the current item, a health-check group selects based on test results, and a fallback group tries alternatives in sequence when the current item is unavailable. Rules usually point to a proxy group name rather than a specific node.
YAML: YAML is the structured text format commonly used for Clash configuration files and relies on indentation to express hierarchy. Tab characters, incorrect indentation, and missing spaces after colons can all cause parsing failures. Before editing, distinguish lists, key-value objects, and plain strings; quote text containing special characters when needed.
Rule Provider: Rule Provider loads a rule set from a separate file or remote address. It can keep large rules outside the main configuration and update them on a schedule. The provider name must also be referenced correctly in the rules section; declaring a source alone does not automatically route traffic through it.
Proxy Provider: Proxy Provider loads proxy entries from a separate source so multiple proxy groups can reuse them. Unlike importing a complete subscription, it is usually part of a hand-written configuration. Filters, health checks, and update intervals affect which entries ultimately appear in the proxy groups.
GeoIP: GeoIP is a data and rule type that matches the geographic location associated with a destination IP. It works only after a domain has been resolved to an IP or when the connection directly targets an IP. The database must be compatible with the core, and location results may lag behind changes in address allocation.
GeoSite: GeoSite is a collection of domain rules organized by purpose or affiliation, allowing one category to reference many domains. It matches domain information, unlike GeoIP, which checks IP location. Category contents depend on the data file in use, so the same category name may differ across data sources.
FINAL / MATCH: FINAL or MATCH usually serves as the fallback at the end of a rule list for connections that matched nothing earlier. Different cores and configuration systems may use different keywords for similar behavior. Placing the fallback too early can disable later rules, so it generally belongs at the end of the rules section.

04

Networking and DNS

Understand domain resolution, system traffic interception, and common DNS path issues.

DNS: DNS converts domain names into IP addresses that can be reached. Clash configuration can specify DNS servers, caching, listening addresses, and enhanced modes, allowing domain information to participate in rule matching. System DNS, browser secure DNS, and client DNS may coexist, so troubleshooting requires confirming the actual query path.
DNS Leak: A DNS leak occurs when an application's resolution request bypasses the intended proxy or encrypted resolution path and is sent to another resolver. It does not necessarily mean that proxy connections have completely failed; it means the DNS query path differs from what was expected. Common checks include browser-level resolution, system network interface settings, TUN routes, and the nameserver setting in the configuration.
Fake-IP: Fake-IP is a DNS enhanced mode in which the core first returns a mapped address to the application, then restores the original domain during connection handling and applies routing rules. This helps preserve domain information and centralize traffic interception. Some local network services or applications that require real IP addresses may need to be excluded.
Redir-Host: Redir-Host mode returns the real resolved address to the application while using resolution records to assist subsequent routing. Unlike Fake-IP, the application sees the actual IP rather than a mapped address. Refer to the core documentation for exact support and field names.
System Proxy: A system proxy points the operating system's proxy address to Clash's local listening port. Browsers and other applications that follow system settings then connect through the client, although some applications may ignore those settings. System proxy is suitable for ordinary desktop use; traffic it cannot cover may require TUN.
TUN Mode: TUN mode takes over system traffic through a virtual network interface, including traffic from applications that do not read system proxy settings. Enabling it usually involves routes, DNS interception, and system permissions, so it can introduce a wider range of failures than a standard system proxy. Check the virtual interface, routing table, firewall, and other network tools for conflicts.
Nameserver: Nameserver is a list of DNS resolvers used by the configuration to perform DNS queries. Different core versions may distinguish default resolution, proxy-node domain resolution, and fallback resolution. Entering reachable addresses is only the first step; also confirm whether requests follow the intended direct or proxied path.
IPv6: IPv6 is a newer Internet addressing protocol with address formats and routing systems different from IPv4. The client, operating system network, node, and destination service must all support it for IPv6 connections to work fully. Disabling IPv6 in one place can change DNS responses and rule-matching behavior.

05

Platforms and Core

Distinguish the graphical interface, underlying core, listening ports, and operating-system-specific mechanisms.

mihomo: mihomo is a continuously maintained proxy core implementation in the Clash ecosystem. It handles configuration parsing, rule matching, DNS processing, and connection forwarding. A graphical client can invoke mihomo, but the client version and core version are separate. Whether a configuration field works depends on the core version and its corresponding documentation.
Graphical Client GUI Client: A graphical client provides subscription import, profile switching, proxy group selection, log viewing, and system integration on top of the proxy core. It translates user actions into configuration changes or core control commands. Even when different clients use similar cores, their interface entry points and platform capabilities may differ.
Mixed Port: Mixed Port accepts both HTTP and SOCKS proxy connections on one listening port, reducing the number of ports that local applications need to distinguish. It is only a local entry point and does not represent the remote node protocol. After changing the port, update the system proxy and any applications where the port was entered manually.
UWP Loopback Restriction: Windows UWP applications may be subject to local loopback restrictions by default, preventing them from connecting to a proxy port running on a local address. Other desktop programs may work normally while a specific Store app bypasses the proxy. The usual approach is to allow loopback access for the target app, then verify the connection again.
Service Mode: Service Mode usually refers to a system service installed by a desktop client to perform network operations requiring elevated privileges. TUN, launch-at-startup, or system-level route changes may depend on this component. If the service is missing, stopped, or incompatible, the client interface may still open while the related features fail to work.
Core Core: The core is the program that actually handles proxy connections, DNS resolution, rule matching, and traffic forwarding. The graphical client mainly manages the core and displays its status. When a configuration field is unrecognized, startup fails, or a protocol is unsupported, check both the client logs and the capabilities of the current core.