Clash Glossary
Read a config file, hit a client error message, or flip through the advanced manual — you'll keep running into the same batch of terms. This table organizes 28 high-frequency terms into five categories, with 2–4 sentences each on what it is, where it shows up, and how it differs from neighboring concepts. Every term card has its own anchor, so you can link straight to a specific entry.
Lookup tips: for switch names you see in the client UI (TUN, Fake-IP, allow LAN), check "DNS & Traffic Handling" and "Config File Fields" first; for section names in a subscription's YAML you don't recognize, they're likely under "Rules & Proxy Groups"; for the abbreviation in a node's type column, check "Proxy Protocols." For step-by-step operations beyond the concepts, see the User Guide; for full field-level syntax and real-world examples, see the Advanced Manual.
Core & Clients
SECTION 01 · 6 ENTRIESTelling "core" apart from "client" is the first step in understanding the whole Clash ecosystem: the core handles traffic, the client makes the core usable.
mihomo
Core & ClientsThe current name of the Clash Meta core. After the original Clash core stopped updating, the community continued development on top of its syntax, expanding it with more protocols and rule types. Every mainstream GUI client (Clash Verge Rev, FlClash, Clash Plus, etc.) runs this core by default — "Meta core" or "Meta syntax" in tutorials refers to it.
GUI Client
Core & ClientsThe graphical shell layered on top of the core, handling subscription management, system proxy toggling, core process supervision, and visualized logs. The same config file is largely portable across different GUI clients, with differences mostly in layout and extra features. See the Client Comparison page for picking one.
external-controller (Remote Control)
Core & ClientsThe RESTful control interface exposed by the core, listening on 127.0.0.1:9090 by default. Web dashboards (metacubexd, yacd, etc.) use it to read connection lists, switch nodes, and view live logs. The paired secret field sets an access token, which must be configured before changing the listen address to a non-loopback one.
UWP Loopback Exemption
Core & ClientsWindows UWP apps (those installed from the Microsoft Store) are blocked from accessing the local loopback address by default, so even with the system proxy on, their traffic can't reach the local proxy port. Use a loopback exemption tool (EnableLoopback) to whitelist the app, or switch to TUN mode to intercept it at the network layer instead.
System Proxy
Core & ClientsOS-level HTTP/SOCKS proxy settings. Once the client turns this on, apps like browsers that honor system settings route their traffic to the local listening port. It's an "opt-in by the app" mechanism — programs that don't read the system proxy (some CLI tools, games) are unaffected, and TUN mode is needed to cover them.
Proxy Protocols
SECTION 02 · 6 ENTRIESEvery node in a subscription is tagged with a protocol. The protocol determines encryption, disguise, and performance on poor networks — the client side needs no manual setup, but knowing the type helps when troubleshooting nodes that won't connect.
Shadowsocks
Proxy ProtocolsA lightweight encrypted proxy protocol with a simple structure and low overhead, one of the oldest protocols in the ecosystem. mihomo supports its AEAD cipher suites and common plugins (obfs, v2ray-plugin). Often abbreviated as SS in node lists.
VMess
Proxy ProtocolsA transport protocol from the V2Ray ecosystem with user ID authentication and time validation, commonly paired with transport layers like WebSocket and gRPC plus TLS. Sensitive to local clock drift: a system time offset of more than about 90 seconds causes handshake failures, so if all nodes show red, check your clock first.
VLESS
Proxy ProtocolsA streamlined successor to VMess that drops the protocol's own redundant encryption layer, leaving transport security entirely to TLS, often paired with Reality and XTLS flow control to reduce fingerprinting. mihomo supports it natively without extra cores.
Trojan
Proxy ProtocolsA protocol disguised as standard HTTPS traffic: it reuses port 443 and a genuine TLS handshake, making it nearly indistinguishable from normal website access from the outside. Requires the server to hold a valid certificate, with very few client-side settings.
Hysteria2
Proxy ProtocolsA QUIC-based protocol with aggressive congestion control tuning for high-packet-loss links, standing out on poor cross-border connections. The trade-off is running entirely over UDP: on networks that throttle or drop UDP outright, these nodes degrade noticeably or become unusable.
TUIC
Proxy ProtocolsAnother lightweight QUIC-based protocol, supporting 0-RTT handshakes and UDP over stream for fast connection setup, common in latency-sensitive scenarios. Like Hysteria2, it's constrained by UDP network quality, and the two can act as fallbacks for each other in a proxy group.
Rules & Proxy Groups
SECTION 03 · 6 ENTRIESRules answer "where should this traffic go"; proxy groups answer "which node exactly to use once it's there." Together they form the backbone of Clash routing.
Rule Routing (Rules)
Rules & Proxy GroupsThe matching list in the config file's rules section. Types like DOMAIN-SUFFIX, IP-CIDR, and GEOIP are matched top-down, and the first hit stops the search. Rule order directly determines routing: put a broad rule before a specific one, and the specific one will never match. A MATCH rule usually catches everything else at the end.
Proxy Group
Rules & Proxy GroupsOrganizes multiple nodes into one selectable unit. Common types: select (manual pick), url-test (auto speed test), fallback (failover), and load-balance. Rules usually point to a proxy group rather than a single node, so swapping nodes doesn't require editing rules.
url-test
Rules & Proxy GroupsAn auto speed-testing proxy group: on an interval, it pings the address specified by url and always uses the lowest-latency node. The tolerance parameter sets a switching threshold to avoid bouncing between nodes with similar latency and repeatedly rebuilding connections.
rule-providers (Rule Sets)
Rules & Proxy GroupsExternalizes rules into subscribable remote files, which the client auto-fetches on an interval and references in the rules section via the RULE-SET type. This decouples rule maintenance from the main config — most community-maintained routing rule sets are distributed this way. See the Advanced Manual for syntax details.
GeoIP / GeoSite
Rules & Proxy GroupsPrecompiled databases for IP ownership and domain categorization. GEOIP,CN matches mainland China IP ranges; GEOSITE,category-ads-all matches an ad-domain set. These database files exist independently of the core and can be updated separately; stale data can cause a few sites to route incorrectly.
DIRECT / REJECT
Rules & Proxy GroupsTwo special built-in core policies that don't need to be declared in the config. DIRECT means connecting to the target with no proxy at all; REJECT means blocking the connection outright, commonly used against ads and telemetry domains. Rejecting a necessary domain by mistake often shows up as a feature stuck "loading forever" — worth checking during troubleshooting.
DNS & Traffic Handling
SECTION 04 · 5 ENTRIESRouting accuracy and privacy boundaries largely come down to the DNS stage. This group of terms explains what happens to traffic before it ever reaches rule matching.
Fake-IP
DNS & Traffic HandlingOne of the DNS enhancement modes: responses return a virtual IP from a reserved range (default 198.18.0.0/16), with real resolution deferred to the outbound node side. The upside is skipping local resolution waits and keeping poisoned DNS from affecting routing decisions; the downside is that LAN apps relying on real IPs (printer discovery, LAN gaming) need to be excluded via fake-ip-filter.
Redir-Host
DNS & Traffic HandlingThe traditional mode opposite to Fake-IP: DNS returns the real resolution result as normal, and the core then matches rules against that resolved IP. Behavior is intuitive and compatibility is good, but routing breaks if the resolution is poisoned. Newer mihomo builds have deprecated this mode; Fake-IP is recommended for most use cases.
DNS Leak
DNS & Traffic HandlingThe proxy is on, but domain resolution requests still go straight to the local ISP's DNS, exposing browsing intent to the local network. Avoid it by enabling the core's DNS and configuring an encrypted upstream (DoH/DoT) in nameserver, or use TUN mode to take over port 53 traffic entirely. Check whether you're leaking with an online detection site.
TUN Mode
DNS & Traffic HandlingThe core creates a virtual network adapter and intercepts all local traffic at the network layer, independent of whether an app reads system proxy settings — it can cover CLI tools, games, and UWP apps. Requires administrator or root privileges, usually paired with Fake-IP and auto-route. See the User Guide for the first-time authorization steps on each platform.
Domain Sniffing (sniffer)
DNS & Traffic HandlingRecovers the target domain from the TLS handshake's SNI field or the HTTP Host header, letting traffic that arrives as a raw IP (typically connections under TUN that bypassed the core's DNS) still match domain-based rules. Turning it on noticeably improves routing accuracy at the cost of a small amount of extra parsing overhead.
Config File Fields
SECTION 05 · 5 ENTRIESOpen a config pulled from a subscription and the first dozen or so lines are these fields. Understand them, and most "just change one value" problems don't need outside help.
YAML
Config File FieldsThe format Clash config files are written in, using indentation to express hierarchy, and indentation must use spaces only. Copying a config from a webpage and picking up a stray tab character, or misaligned list-item indentation, is the most common cause of "config parse failed" errors. Open configs with a YAML-aware editor before editing.
Subscription
Config File FieldsA hosted config URL provided by a service; the client periodically fetches it to get node and rule updates — essentially a URL that returns a full or partial Clash config. A subscription link is equivalent to a credential and shouldn't be posted publicly. See related blog posts and the FAQ for troubleshooting update failures.
proxy-providers
Config File FieldsAn externalized node field: it pulls a node list from one or more remote addresses, updates on an interval, and is referenced into proxy groups with use. Following the same logic as rule-providers, this is the standard way to merge multiple subscriptions into one self-maintained config.
mixed-port
Config File FieldsA mixed listening port: the same port accepts both HTTP and SOCKS5 proxy requests, so the system proxy and third-party software can all point to it without configuring two separate ports. Common defaults are 7890 or 7897; if startup reports the port is in use, change this value or close the process holding it.
allow-lan
Config File FieldsControls whether other devices on the LAN can connect to this machine's proxy port. When enabled, phones, TVs, and consoles can point their proxy server at this computer's LAN IP and share the same routing setup. Keep it off on public networks like cafés or airports to avoid strangers' devices piggybacking on the port.
The glossary answers "what is this"; for "how do I configure it," pick a path based on what you need: installing the client and importing a subscription for the first time — follow the User Guide step by step; writing custom rules, tuning DNS, or merging multiple subscriptions — go straight to the Advanced Manual and look up chapters as needed. No client yet? Grab an installer for your platform from the Downloads page first.