CLASH / GLOSSARY
First distinguish what intercepts traffic from which outbound route a rule selects, then look at DNS and subscriptions. This glossary groups 25 terms by where they appear in settings, and each entry has its own link.
Can't find a setting? Use your browser's find feature and search for its name or configuration key. For setup instructions, see Getting Started. If you already have an error, go straight to Troubleshooting.
01 / The App and Its Components
The client window provides controls; the core handles connections. Identify the running program first, then check whether it supports a configuration key.
The program that reads the configuration, matches rules, and establishes proxy connections, usually running behind the GUI. The original Clash and its later forks are not the same continuously updated program, so supported protocols and configuration keys vary. When troubleshooting a configuration that won't load, check the core name in About or the startup log—not just the client name shown in the window.
A proxy core continued from the Clash Meta project, compatible with Clash-style configurations and extended with protocols, DNS, and traffic interception features. Some older guides still call it the “Meta core,” so check the specific configuration fields they refer to. Even if a client supports mihomo, confirm which core version is actually running; updating the GUI doesn't necessarily update or switch the core.
An app with controls such as Configuration, Proxies, and Logs that starts the core, manages subscriptions, and configures the system proxy. It may merge ports, DNS settings, or overrides that aren't in the original subscription, so the file shown in an editor may not be the final runtime configuration. If a setting reverts after saving, check whether the client manages that field before deciding whether to change the GUI setting or the configuration file.
An interface that lets a client or dashboard read connection status, switch proxy groups, and adjust runtime settings—for example, one listening on 127.0.0.1:9090. It's a management endpoint, not a proxy port for browser traffic. Keep it accessible only from localhost in most cases. If remote management is necessary, configure authentication and access controls too; don't simply bind it to every network interface.
A local listening port that accepts both HTTP and SOCKS proxy connections. A common example is mixed-port: 7890, but use the value configured in your client. When setting a proxy manually in an app, enter the correct listening address and port—not the controller port. If you see address already in use, check whether another client is using the same port.
Next: Set up Clash ports and configure an app to use the proxy.
02 / How Connections Work
The protocol determines how a connection is established. Even when the protocol name matches, authentication, transport, and certificate settings must also line up—changing just the type isn't enough.
The app sends HTTP requests through the proxy. For HTTPS, it typically sends a CONNECT request to establish a tunnel, then completes the TLS connection with the destination site. The name “HTTP proxy” doesn't mean the connection between the app and proxy is encrypted. Browsers may follow system settings, while other apps may require manual setup; check whether the app supports proxy configuration.
A general-purpose proxy protocol that forwards TCP and can support UDP through UDP ASSOCIATE, depending on the app and server implementation. It doesn't provide encryption by default or determine where domain names are resolved. Some tools use socks5h to indicate that the proxy should resolve domain names. Check the tool's documentation for its exact syntax.
A proxy protocol that connects to a server using an agreed encryption method and password. In Clash configurations, its type is usually ss. The address, port, encryption method, password, and any plugin settings must match the server. If a connection fails after import, first check that the core supports the encryption method and plugin. Re-entering the password won't fix an unsupported protocol or mismatched settings.
A proxy protocol that typically uses TLS for an encrypted connection. In addition to the address, port, and password, check the server certificate and SNI. If you connect by IP address, you may still need to specify the domain used for certificate verification. For x509 errors, check the system clock, domain name, and certificate chain first; disabling certificate verification is not a lasting fix.
A QUIC-based proxy protocol that requires the network to allow the relevant UDP traffic. Being able to open TCP websites doesn't prove that its connection path is available. Hysteria 2 authentication and parameters aren't interchangeable with those of the original Hysteria; changing only the protocol name won't work. For repeated timeouts, check core support, the server address, and UDP reachability before tuning advanced bandwidth settings.
03 / Choosing an Outbound Route
Routing happens only after traffic is intercepted. To trace a connection, check both the matched rule and the proxy group’s current selection.
Choose an outbound route for a connection based on its domain, IP, process, or other criteria. rules are usually evaluated from top to bottom, and the first match wins. For example, DOMAIN-SUFFIX,example.com,DIRECT sends the domain and its subdomains direct. The fallback MATCH rule usually goes last; if it comes earlier, later, more specific rules won't be reached.
Groups multiple nodes or other proxy groups into an outbound option that rules can reference. Configure them under proxy-groups. select is typically for manual selection, while url-test selects based on test results. A proxy group doesn't create a new proxy server. Make sure the group name exactly matches the rule reference, then check the group's current selection—a matching group name alone doesn't confirm the full route is correct.
rule selects an outbound route based on rules; global typically sends traffic through the global proxy group; direct sends connections handled by the core directly. Mode determines how traffic is handled, not which apps are intercepted, so switching to global mode doesn't replace the system proxy or TUN. Compare modes briefly if useful, but note the original setting and restore the routing mode you need once you've identified the issue.
A database and rule mechanism that matches connections by the geographic region associated with an IP address—for example, GEOIP,CN,DIRECT. Database results describe an IP address's registered or estimated region, not a user's physical location. CDN IPs can also change with the network. For unexpected matches, check the data format used by the current core, loading logs, and update source rather than judging by the region shown on a website.
A set of matching criteria stored as a separate resource, declared with rule-providers and referenced by a RULE-SET rule for easier maintenance and updates. A rule set defines which connections match; the rule that references it determines the outbound route. Ensure the file format, behavior, and contents are compatible. A successful download doesn't guarantee the resource can be loaded.
More: Choose a proxy mode · Update GeoIP data and troubleshoot unexpected matches.
04 / DNS and Traffic Interception
Domain resolution and traffic interception are separate processes. A page loading successfully doesn't mean every DNS query followed the expected path.
The system that resolves domain names to IP addresses, often before a connection is established. The client's dns settings affect only requests that use its resolution path. Browser encrypted DNS, app-specific resolution, and system caches can all change the result. If you see no such host, first determine whether the failed lookup was for the destination domain or the proxy server, then check the corresponding resolution path.
A DNS mode that first returns a virtual IP for mapping, then lets the core use that mapping to recover the domain and handle the connection. This preserves domain information and can reduce some resolution delays. Common virtual addresses come from 198.18.0.0/16; they aren't the website's real server addresses. If an app bypasses the core after receiving a virtual IP, the connection may fail. Evaluate compatibility filters for specific domains rather than broadly expanding exclusions.
Uses a virtual network interface and routes to intercept IP traffic, including traffic from some apps that ignore the system proxy. Configuration is usually under tun. TUN needs system permissions and coordinated routing and DNS; enabling it doesn't guarantee that all device traffic goes through the proxy. When using another VPN, check for route conflicts. Verify interception in the connection log, not just by checking whether the switch is on.
A domain query that should have followed a specified path is instead sent to another resolver, such as a DNS server on the local network. Check the operating system, browser, client, and how the test page performs its queries; the resolver's reported country or region alone isn't enough to confirm a leak. To troubleshoot, align browser and system DNS settings first, then review query and connection logs to verify each path.
Registers a local proxy address with the operating system for apps that honor system settings. It doesn't force all network packets through the proxy. Command-line tools, games, and apps with their own network settings may ignore it; configure them separately or consider TUN. If the browser can't connect after you close the client, check whether the system still points to a proxy port that's no longer listening.
05 / Subscriptions and Files
A successful import only confirms that the data was read. Also verify that the configuration is enabled, its references are intact, and its outbound options work.
A way to fetch and periodically update proxy details or a complete configuration from a specified URL. Different providers may return different content and formats. A full Clash configuration usually includes nodes, proxy groups, and rules; a subscription containing only nodes may not work as a complete configuration. Links can include access credentials, so redact the full URL before sharing screenshots or logs. After an update, confirm that this configuration is enabled.
A proxy server configuration the core can connect to, typically including the protocol, server address, port, and authentication details. A node's display name is just a label; a region or route name doesn't prove its actual location, speed, or availability. Nodes can be defined under proxies or loaded through a proxy provider. Before sharing a configuration for troubleshooting, remove credentials—not just the display name.
The client connects to a test URL through a selected outbound route and records how long it takes. The result may include connection setup, handshaking, and response time—not just network round-trip time. Low latency doesn't mean fast downloads, and a successful test doesn't guarantee that every destination is reachable. Compare nodes using the same test URL and conditions. If a test times out, check the logs to distinguish a connection failure from a DNS issue or an unreachable test target.
A structured text format commonly used for Clash configurations, with hierarchy represented by indentation, colons, and list markers. Use spaces, not tabs, for indentation. config.yaml is a common filename, but that doesn't mean the current core supports every key in the file. After editing, check syntax, proxy group names, and resource references. Subscription-managed files may be overwritten at the next update, so use the client's supported override mechanism for persistent changes.
A way to load proxy entries separately with proxy-providers and reference them from a proxy group using use. Unlike importing a complete subscription configuration, this lets you update outbound proxy details while keeping the main configuration's rules and group structure intact. If the download succeeds but the proxy list is empty, check the resource format, reference name, and filters. Don't use a rule-set file as a proxy provider.
Next: Import a Clash subscription link · Troubleshoot proxy node timeouts.