The 22 terms most often seen during configuration and troubleshooting, sorted into five bins: proxy protocols, core & clients, configuration & rules, operating modes, and networking basics. Each entry gives a definition plus practical usage notes—come back here whenever you hit an unfamiliar field. These terms carry the same meaning wherever they appear in the full documentation and setup guide.
A lightweight encrypted proxy protocol in wide community use since 2012. Client and server establish a connection using a pre-shared password and a specified cipher method, keeping configuration fields minimal and overhead low. Clash-family clients natively support its common cipher suites, making it one of the most frequently seen protocol types in subscription node lists.
A transport protocol defined by the V2Ray project, authenticating via a user UUID and pairable with transports such as WebSocket or gRPC, optionally layered with TLS. It has more configuration fields than Shadowsocks—any mistake in server, port, uuid, or network breaks the connection—and is common where traffic needs to look like ordinary HTTPS.
A protocol designed so proxy traffic looks like an ordinary TLS connection. The server typically listens on port 443 and checks a password; connections that fail verification are forwarded to a real website, lowering the odds of being flagged by active probing. It requires the server to hold a valid certificate, while client-side configuration stays fairly simple.
A QUIC (UDP)-based proxy protocol with built-in congestion control, tuned for high packet loss and long cross-border links. The mihomo core supports it natively, while the original Clash core cannot load this node type. Confirm your local network doesn't block the relevant UDP port before use, or the node will show as timed out.
A rule-based proxy core written in Go, responsible for listening on local ports, parsing config files, and dispatching each connection to an outbound per the rules. Every graphical client is essentially a shell around this core, adding toggles and subscription management. The original repository stopped updates in 2023 and now lives on through community forks.
A community-maintained fork of the Clash core, formerly named Clash.Meta. It adds support for protocols like VLESS, Hysteria2, and TUIC on top of the original core, plus more complete DNS and TUN implementations. Today's mainstream clients (Clash Verge Rev, FlClash, and others) ship this fork by default while staying compatible with the original config format.
A cross-platform graphical client built on the Tauri framework, bundling the mihomo core and covering Windows, macOS, and Linux. It offers subscription management, system-proxy and TUN toggles, and Merge/Script config enhancements—a common replacement since Clash for Windows stopped maintenance. Installers for each platform are on the client page.
The external-controller field in the config—the RESTful API address the core exposes, listening on 127.0.0.1:9090 by default. Web panels (like metacubexd) use it to read node latency, switch proxy groups, and view live connections. If you make the listening address reachable externally, also set a secret token so other devices on the LAN can't control it.
A URL provided by a service that returns a full config or node list when accessed. Clients re-fetch it on a schedule or on demand to sync added, removed, or changed nodes. The link itself acts as a credential—anyone who obtains it can consume your traffic quota—so it shouldn't be posted publicly. Import steps are on the setup guide.
The complete configuration unit a client loads, containing every section—ports, DNS, nodes, proxy groups, and rules. A client can store multiple profiles, but only one is active at a time; configs pulled from a subscription are also saved locally as a profile, and updating the subscription overwrites that file.
The text format Clash configs use, expressing hierarchy through indentation. Indentation must use spaces only—Tab characters aren't allowed. Misaligned indentation and a missing space after a colon are the two most common reasons a config fails to load. Back up the original file before editing by hand, and check the indentation near the reported line first when an error occurs.
The proxy-groups section of the config, organizing multiple nodes into a selectable outbound set. select requires manual choice, url-test auto-picks the fastest node from latency results, fallback switches over in order on failure, and load-balance spreads traffic across nodes. Rules usually point to a proxy group rather than a single node.
The matching list defined in the rules section, checked top to bottom against conditions like domain keywords, domain suffixes, IP ranges, or process names—the first match wins and decides whether that connection is proxied, direct, or rejected. The MATCH rule at the end catches everything else, and rule order directly shapes the outcome.
Two kinds of precompiled rule databases: GeoIP matches by IP ownership (e.g. GEOIP,CN matches all mainland China IPs), while GeoSite matches against a maintained domain list (e.g. GEOSITE,category-ads). Both compress thousands of rules into a single reference; the data files ship with the core and need periodic updates to stay accurate.
The client writes local HTTP/SOCKS proxy settings into the OS, so apps that respect those settings (browsers, most networked software) automatically send traffic to Clash's listening port. Some software ignores the system proxy setting, so its traffic isn't taken over—use TUN mode instead, or set the proxy address inside that software directly.
Creates a virtual network adapter in the system and routes all local IP-layer traffic into the core, independent of whether an app respects proxy settings—covering command-line tools, game clients, and similar cases. Enabling it requires administrator or root privileges, and pairing it with Fake-IP and DNS hijacking is recommended, or resolution issues become more likely.
A DNS response strategy: the core first returns a fake IP from a reserved range (198.18.0.0/16 by default) for a domain lookup, then matches rules by domain once the actual connection arrives, skipping the wait for real resolution. After switching between Fake-IP and traditional redir-host mode, clear the system DNS cache to avoid leftover mappings causing access issues.
Windows UWP apps (Microsoft Store apps) are blocked by default from connecting to the local loopback address, so they can't reach a local proxy port listening on 127.0.0.1. Use the CheckNetIsolation command or a client's built-in loopback-exemption tool to lift the restriction for that app; networking issues in Store or Xbox apps are often traced to this.
A case where the proxy is active but domain lookups still go directly to the local ISP's DNS, exposing the destination to the local network. It's usually caused by DNS requests not being taken over by the core; fix it by enabling TUN mode with DNS hijacking, or by using Fake-IP mode, then verify with a leak-test site.
The client sends a request to a designated test address (commonly http://www.gstatic.com/generate_204) and records the time in milliseconds. This reflects connection round-trip time, not download bandwidth—a low-latency node isn't necessarily the fastest. url-test proxy groups use this result to auto-pick the current outbound.
The mixed-port field in the config, accepting both HTTP and SOCKS5 proxy requests on the same local port—7890 is the common default. Regardless of which protocol an app is configured to use, it can point to this single port, saving the trouble of remembering separate HTTP and SOCKS ports.
Short for DNS over HTTPS and DNS over TLS, wrapping plaintext DNS queries in an encrypted channel. Clash's nameserver list supports the https:// and tls:// prefixes to use such servers directly, reducing the odds of resolution results being tampered with or eavesdropped on along the path.