Configuration reference · 25 common terms
Start by distinguishing the client from the core, then learn how subscriptions, rules, and traffic capture work. Terms are grouped by setup task below, and each card can be shared directly using its URL anchor.
How the software works
The interface handles user actions; the core handles execution. To troubleshoot compatibility, check the client name, core type, and configuration format separately—not just whether the installer says Clash.
The core handles connections, DNS resolution, and rule matching, and determines which protocols and configuration fields are available. Client interface toggles usually translate into core settings or control commands. If you see an unsupported protocol or unknown field, check the core type and version first instead of repeatedly importing the same subscription.
A GUI client provides interfaces for managing configurations, choosing proxies, setting the system proxy, and viewing logs, so you do not have to edit every file by hand. It typically uses a proxy core; the two are not the same thing. Some features may still require system permissions or helper services even if they appear in the interface. For help choosing one, see the client comparisons for platform differences.
This name usually refers to the early Clash core and its configuration system, not every app with Clash in its name. Later forks retain some configuration conventions while adding protocols and fields the original may not support. When migrating an older configuration, check proxy types, DNS settings, and rule data sources individually; the same file extension does not guarantee compatibility.
mihomo is a proxy core developed as a continuation of Clash Meta. A GUI client can use it, or it can run independently on a server or router. It handles connections, rules, DNS, and traffic capture; support depends on the version. When a tutorial mentions Meta, use the context to tell whether it means the core’s former name or a client product.
YAML is the text format commonly used for Clash configuration. Indentation defines field hierarchy, and lists organize multiple proxies or rules. Use spaces, not tabs, and take care with quotes around values that contain special characters. Valid syntax is only the first step: the current core must also support the field names and their combinations. Review the configuration check results after editing.
Connection Settings
A protocol defines how the client communicates with the server; transport and security settings may be configured separately. The protocols below are not ranked by speed. Compatibility between server settings and core support is what matters first.
A proxy is a set of server parameters a client can connect to, usually including an address, port, protocol, and authentication details. Region names in a list are labels only; they do not guarantee the actual exit location or access to every service. If a connection fails, check the parameters, account status, and network reachability first. Never show full proxy credentials in a public screenshot.
Shadowsocks, often abbreviated as SS, is a proxy protocol. Its configuration typically includes a server address, port, password, and encryption method. Encryption methods, protocol variants, and plugins have different core support requirements. If import reports an unsupported encryption method or plugin, check the client’s capabilities and your provider’s documentation; changing the proxy name will not fix it.
VMess is a proxy protocol whose configuration typically includes a user ID and connection transport parameters. WebSocket and TLS describe related transport or security settings; they are not the same as VMess itself. The path, hostname, and security settings must match the server. An inaccurate system clock can also affect authentication, so check the logs to identify the cause.
VLESS is a lightweight proxy protocol that does not encrypt payloads on its own and is often combined with security mechanisms such as TLS or REALITY. A successful connection also depends on compatible transport settings, parameters, and core version. A subscription parsing successfully does not guarantee every combination will work. If the logs report an unsupported field, check which core the client uses instead of disabling security settings to test the connection.
Trojan typically uses TLS to protect connections and a password for authentication; its configuration also includes settings such as the server name. A certificate verification failure is different from an incorrect password, so check the system clock, server name, and account details separately. Skipping certificate verification is not a suitable long-term fix because it changes the connection’s security boundary.
Where traffic goes
Routing rules determine where connections that reach the core go. If a website uses the wrong policy, first check which rule matched, then see which proxy group that rule references and what the group currently selects.
Rule-based routing sends connections to a specified proxy group, direct connection, or reject policy based on domains, IP addresses, or other conditions. Rules are usually checked from top to bottom, and the first match takes effect, so both order and content matter. Rule mode only determines where traffic goes after it reaches the core; it does not capture traffic from every app. Traffic capture is controlled by the system proxy, TUN, or the app’s own proxy settings.
A proxy group organizes proxies or other policies, usually as a selection list in the client. Manual selection, automatic testing, and failover are different group types, and test addresses and switching conditions affect the results. Changing a group does not mean every connection will use the same proxy. Check which group the matched rule references, then see what that group currently selects.
GeoIP uses an IP geolocation database to identify the region associated with a destination address, and can be used for direct or proxy routing. Results depend on the database and the resolved IP; they do not directly indicate a website’s brand, place of registration, or a user’s location. Websites using CDNs may resolve to addresses in different regions. If routing is unexpected, check the resolved address, database update status, and rule order.
GeoSite is a collection of domains organized by service or topic that rules and DNS policies can reference, reducing the need to enter domains one by one. Labels and coverage depend on the data source, and identically named labels from different sources may not contain the same domains. Before using one, check that the core supports the relevant fields, the data file loads, and the referenced category exists.
MATCH handles connections that did not match any earlier rule and is usually placed last as a fallback. For example, MATCH,PROXY sends traffic to the policy named PROXY, which must be defined in the configuration. Placing the fallback rule earlier may prevent later rules from taking effect. Choose direct or proxy routing for the fallback based on your needs.
Traffic capture and DNS
These settings answer two questions: how app traffic reaches the client and how domain names are resolved. Turning on a setting does not complete the whole setup; also check permissions, routes, listening addresses, and the DNS path.
The system proxy writes the client’s listening address and port to the operating system’s proxy settings, so apps that follow those settings send requests to the client. Some games, command-line tools, and apps with their own network settings may ignore them, so a working browser does not mean other programs will work too. If the network remains inaccessible after quitting the client, check whether the system still has proxy settings pointing to a local port.
TUN captures traffic through a virtual network interface and routing settings, including traffic from some apps that ignore the system proxy. Actual coverage depends on routes, exclusions, system permissions, and the client implementation; it does not mean every connection will use the proxy. TUN may conflict with other VPNs, virtual adapters, or security software. For troubleshooting, first reduce the number of network-capturing programs running at the same time.
mixed-port lets a single listening port accept HTTP and SOCKS5 proxy requests. Apps still need to use the correct proxy type. The port number can be changed, so check the value in your current configuration. To connect a phone through a computer, also configure allow-lan, the listening address, and firewall rules, and allow access only from trusted devices on your local network.
Fake-IP assigns virtual addresses to DNS queries and stores their mapping to domain names so the client can recover the domain and apply routing rules to later connections. A returned virtual address is not the website’s real server address, so it cannot be used to determine the exit location. Some apps that rely on real DNS results may need exclusions; old DNS cache entries can also affect what you see after changing modes.
A DNS leak usually means a query took an unexpected path and was handled by an unintended resolver; it does not necessarily mean the proxy has stopped working. System DNS, encrypted DNS built into browsers, and client resolution settings can all affect the query path. Check app settings and logs to confirm where queries actually go; a region shown on a test page alone is not enough to draw a conclusion.
Import and Maintenance
Subscriptions retrieve content, configurations define behavior, and speed tests are only one factor in choosing a proxy. After importing, activate the configuration, check the proxy groups, and make sure app traffic is reaching the client.
A subscription is a link-based way to retrieve or update proxies and configuration. Some services provide a complete configuration, while others provide only a proxy list. The link format must be compatible with the client; after import, select and activate the configuration. Subscription URLs may contain account credentials, so protect them like passwords—never post the full link in public forums or give it to an untrusted conversion service.
A configuration file describes runtime behavior such as listening ports, proxies, proxy groups, rules, and DNS. Clients may also call it a configuration or Profile. Importing a file only saves its contents; check that it is selected as the active configuration. Direct edits to a file generated from a remote subscription may be overwritten on update, so use the client’s override or merge feature for lasting customizations.
Latency is the response time measured by a client using a specific test method, usually shown in milliseconds. Test methods can vary between clients, and results depend on the test address, timeout, and current network conditions. Low latency does not mean high download speeds. If a test times out, check actual website access and the logs; when choosing a proxy, also consider the destination service, region, and connection stability.
A traffic multiplier is a billing factor a subscription service uses to calculate proxy usage, not a measure of speed or performance. For example, a 2× multiplier may deduct twice the amount of data transmitted, but the provider’s accounting method determines the actual charge. A multiplier in a proxy name is only an indication. Check your account details and usage records; a higher multiplier does not mean a faster proxy.
A proxy provider loads a collection of proxies from a remote or local source. It is defined by proxy-providers and referenced by proxy groups. The provider fetches proxies; the group determines how to select and use them, so a provider is not the same as a full configuration subscription. To troubleshoot, check whether the download succeeded, the data format is compatible, and the proxy group references the correct provider name.