The client manages settings; the core handles connections. Protocols, rules, and DNS each serve a different purpose.
This page groups 25 terms into five layers of Clash configuration. Each entry explains what a term means, where it applies, and what it is commonly confused with. Start with a keyword in your configuration, then check the related settings. Interface labels and feature support vary between clients.
For step-by-step connection instructions, see the Clash setup guide. For platform permissions, installation, and TUN settings, consult the cross-platform guide. Each glossary heading has its own anchor, so you can share a direct link to a specific term.
First distinguish the interface, the program that handles traffic, and the system proxy settings—then decide where to make a change.
Clash originally referred to a rule-based proxy core, but the name is now also used for the ecosystem of clients built around its configuration format. Clients can differ in their core, protocol support, and maintenance status, so the name alone does not tell you what they can do. When following a guide, check both the client name and the core it actually runs.
mihomo is an open-source proxy core derived from Clash Meta. It handles connections, rule matching, DNS, and more. It is not another name for a desktop interface; different clients can integrate the same core. Check the documentation for your running core version to see which configuration fields it supports.
A client is usually a graphical app for managing subscriptions, choosing policies, viewing logs, and adjusting system settings. Its interface switches do not expose every core feature; some settings must be configured in a profile or through an override. Updating the client and updating its bundled core may also be separate operations.
The proxy core is the program that receives connections and applies the configuration. A graphical client typically communicates with it through a control interface. Successfully importing a subscription only means the client has retrieved the configuration—it does not confirm that the core loaded it. If startup fails, check configuration parsing and port-listening logs, not just the client's connection toggle.
The system proxy registers HTTP, SOCKS, or other proxy endpoints with the operating system. Only apps that honor this setting send their connections through the client. Some games, command-line tools, and apps with their own networking stack may ignore it. If a browser works but other apps do not, first check which traffic is covered, then decide whether TUN is needed.
The protocol determines how the client communicates with the server; it does not indicate connection quality. Each setting below must match the server.
Shadowsocks is an encrypted proxy protocol. A node configuration typically includes a server address, port, encryption method, and password. The client and server need compatible settings, and some extensions require additional options. The protocol describes how a connection works; it does not indicate a node's speed, reliability, or operator trustworthiness.
VMess is a proxy protocol whose configuration typically includes a server, port, user ID, and transport. WebSocket and TLS settings are part of the connection setup and must match the server. If a connection fails, check the system clock as well. Two configurations are not equivalent just because their node names match.
VLESS is a lightweight proxy protocol commonly used with security mechanisms such as TLS or REALITY. The user ID, transport, and security settings must match the server; a server address alone is not enough to connect. VLESS and VMess are different protocols, so changing only the type field will not convert one configuration into the other.
Trojan typically carries proxy traffic over TLS. Its configuration requires a server address, port, password, and relevant TLS settings. The server name and certificate verification affect whether a connection can be established, and the server IP may differ from the certificate's domain. If you encounter a certificate error, check the name, system time, and server settings rather than disabling verification.
Hysteria 2 is a QUIC-based proxy protocol that uses UDP, so the network must allow UDP traffic. Authentication, TLS, and bandwidth-related settings depend on the server and network. Hysteria and Hysteria 2 are not interchangeable, and the client must support the specific protocol in use.
Once a connection reaches the core, its destination is determined by match conditions, rule order, and the target policy.
Routing rules direct connections to a policy based on conditions such as domain, destination IP, or process. Rules are usually checked from top to bottom, and the first match determines where the connection goes, so specific rules should come before broader ones. Unlike global mode, rule-based routing can send different connections direct or through different proxies at the same time.
A proxy group combines nodes or other policies into a target that rules can reference. Manual selection, connectivity testing, and failover are different group types with different selection behavior. Once a rule references a group name, you can usually change the node in that group without rewriting the rule—but the name must match the configuration.
GeoIP classifies destination IP addresses by region or other categories using a database, and can be used in GEOIP rules. A database result does not necessarily identify the country where a website is based or the origin of content behind a CDN. For matches that require domain resolution, check how the no-resolve option and rule order affect DNS lookups.
GeoSite is domain data organized into categories, allowing sites in the same category to use a shared policy. Category names and coverage depend on the data source; not all databases contain the same sets. If matching behaves unexpectedly, check the data actually loaded, the category name, and any rules listed above it before changing the proxy group.
MATCH is a catch-all rule for connections that did not match earlier rules, and usually belongs at the end of the rule list. It specifies a target policy, such as DIRECT or the name of a defined proxy group. If MATCH comes first, later rules typically never get a chance to match. Sending unmatched traffic through a proxy does not put the whole configuration in global mode.
Domain resolution and getting traffic into the core are related, but they are separate paths.
DNS resolves domain names to records such as IP addresses and is an important step before most network connections. The system, browser, and proxy core may each use a different DNS path, so changing one does not necessarily affect the others. To troubleshoot resolution, first identify what made the request, which resolver handled it, and how the connection to that resolver was routed.
Fake-IP mode returns a virtual address to the app while the core keeps a mapping between that address and the domain. When the app connects to the virtual address, the core can recover the domain and apply routing and proxy rules. The address is not the website's real IP. For apps that rely on real DNS results, investigate exceptions and logs one at a time.
TUN mode uses a virtual network interface and routing settings to send IP traffic from more apps through the proxy core. Creating the interface and changing routes often require extra permissions, and exclusions and platform-specific implementations affect which traffic is captured. TUN is not the same as global mode: captured connections can still be routed direct or through a proxy according to the rules.
A DNS leak occurs when a DNS request does not follow the intended network path—for example, when a request that should go through a proxy is sent directly to a local network resolver. Seeing a particular provider on a DNS test page does not, by itself, reveal the entire path. Check system DNS, browser Secure DNS, core settings, and connection logs together, then test again after making changes.
DoH, or DNS over HTTPS, sends DNS queries over HTTPS, changing how DNS requests are transported. It does not automatically route queries through a proxy or replace routing and DNS policy settings. If the DoH endpoint is a domain name, also consider who resolves that domain in the first place to avoid a DNS dependency loop.
A configuration must be parsed, loaded, and applied before policies can be selected and connections verified.
A subscription is typically a URL that periodically provides nodes or a complete configuration; its contents depend on the provider. A node subscription is not the same as a full configuration, which may also include proxy groups, rules, and DNS settings. Subscription URLs may contain access credentials, so redact them before sharing logs or screenshots. After an update, check whether local changes were overwritten.
A node is a set of parameters for connecting to a proxy server, usually including an address, port, protocol, and authentication details. The name shown in a list is just a label and may not reflect the server's actual location. Importing a node does not prove the service is available: test connectivity and confirm that the proxy group has selected it.
The node latency shown by a client is usually the time taken to request a test URL through that node; it is not necessarily an ICMP ping. The test target, timeout, and connection reuse can all affect the result, so figures from different clients may not be directly comparable. Lower latency does not necessarily mean faster downloads—test the services you actually use.
YAML is a common text format for Clash configuration. Indentation defines structure, and hyphens mark list items. Use spaces, not tabs, and align colons, quotes, and fields at the same level carefully. Valid syntax does not guarantee a working configuration: missing policy names or fields unsupported by the core can still cause loading or runtime errors.
A profile is the unit a client uses to store and switch between configurations. It can come from a local file or a remote subscription. When several profiles are listed, usually only the active one affects the current session; editing another profile will not immediately change connections. Some clients also apply overrides or merged settings, so troubleshoot the final active configuration rather than only the original file.