Common Clash Terms

mihomo is a proxy core that evolved from Clash Meta. It reads configuration, matches rules, handles DNS, and forwards connections. Several graphical clients in the Clash ecosystem integrate this core, but a client's name is not the name of its core. To check whether a protocol or configuration field is supported, identify the core actually running and its version—not just the client name.

The client provides interfaces for importing subscriptions, selecting nodes, toggling the system proxy, and viewing logs; the core carries out the network behavior defined by the configuration. A client update may update the core too, or change only the interface. If a new field has no effect, startup fails, or a permission warning appears, first determine whether the error comes from configuration parsing, the core, or system integration.

A node is a set of parameters needed to connect to a proxy server, typically including the server address, port, protocol, authentication, and transport settings. Nodes with different names may use the same server; the name alone says nothing about location or connection quality. When sharing logs or screenshots, redact passwords, keys, and other credentials in node details—not just the displayed name.

A latency test typically records how long it takes to reach a specified probe address through a node. It is not the same as an ICMP ping or download speed. A throughput test measures how much data can be transferred over time and is also affected by the target server, congestion, and device performance. For a fair comparison, use the same test address and network conditions. A single timeout does not prove that a node is permanently unavailable.

A mixed port accepts both HTTP proxy and SOCKS proxy connections on the same listening port. Applications still need to be configured for a proxy type they support. The port number is an entry point on the local device, not a remote node port, and does not prove that the core started successfully. Access from other devices also depends on the bind address, the LAN access setting, and the system firewall.

With an HTTP proxy, an application connects to the proxy server and sends requests through it. When accessing an HTTPS website, it typically uses the CONNECT method to establish a tunnel. A website using HTTPS does not mean the connection between the application and the proxy server uses TLS. When configuring a remote HTTP proxy, check separately whether the proxy connection is encrypted, whether authentication is required, and whether the application supports the connection method.

SOCKS5 is a general-purpose proxy protocol that supports TCP forwarding and defines a UDP association mechanism. The protocol does not provide transport encryption, and not every application or proxy implementation supports UDP. Whether a domain is resolved locally or by the proxy depends on the address type sent by the application. Using the same SOCKS5 address therefore does not guarantee that every application follows the same DNS path.

Shadowsocks carries proxy traffic between the client and server using an agreed encryption method and authentication settings. The address, port, cipher, and password or key must match the server; ciphers are not interchangeable. Some deployments also require plugins or additional transport settings. If a node fails to connect after import, check its full definition instead of repeatedly changing its name.

Trojan is commonly deployed with proxy connections carried over TLS. Configuration typically includes the server address, password, and server name used for TLS. The connection address may differ from the domain on the certificate, so check settings such as SNI as well. If certificate validation fails, first check the device time, domain, and certificate chain; skipping certificate validation is not a safe long-term fix.

Hysteria 2 is a QUIC-based proxy protocol that relies on UDP, so network restrictions on UDP can directly affect connectivity. Authentication, TLS, and optional obfuscation settings must match the server. Version 1 and version 2 also require different configuration. If only this type of node times out, check the UDP path first, then use the core logs to identify the handshake stage.

In rule mode, routing checks connection conditions in order and sends matching connections to the specified policy. For example, DOMAIN-SUFFIX,example.com,PROXY sends the domain and its subdomains to the policy named PROXY. A broad rule can catch traffic before a more specific one, so if traffic takes the wrong route, check which rule the connection log actually matched—not just whether a particular rule exists.

A proxy group organizes multiple nodes or other policies into an outbound option that rules can reference. select lets you choose manually, url-test selects based on probe results, and fallback switches between candidates based on availability and their order. Automatic testing depends on the probe address and settings; it does not guarantee the same result for every website. Changing a group selection may not affect connections that are already established.

GeoIP uses an IP database to determine the region associated with a destination address. A common rule is GEOIP,CN,DIRECT. Whether a domain connection triggers an additional lookup depends on core behavior and settings such as no-resolve. Database results may also be affected by IP reassignments or CDN routing. GeoIP is useful for matching a region, but an IP's registered location does not necessarily identify where a website operator is based.

A rule provider separates a set of matching conditions from the main configuration. Declare its source with rule-providers, then reference it with RULE-SET. The content must match the declared behavior type and file format; for example, a domain list and a classic ruleset are not interchangeable. A successful update only confirms that the content was retrieved. Whether it affects a connection still depends on where it is referenced in the main rules list.

MATCH catches connections that did not match any earlier rule, so it belongs on the last line of the rules list. Its target can be a proxy group, DIRECT, or REJECT, depending on the desired default behavior. If it appears before domain rules, those rules usually will not get a chance to handle the connection. After changing the order, start a new connection to verify which rule matches.

DNS resolves domain names to IP addresses. Queries may go through the system resolver, a client’s built-in resolver, or a browser’s Secure DNS. The path taken by a DNS query is separate from the outbound route used to connect to a website. If a domain fails but its IP address works, check the resolution result and whether the resolver is reachable. Direct IP access can still fail because of HTTPS certificates or virtual hosting.

Fake-IP returns a mapped address in response to a DNS query. When the connection reaches the core, the original domain is recovered from the mapping and used for further processing. This preserves domain information and can reduce reliance on resolving real addresses locally in some situations. For LAN services or apps that rely on real DNS results, adjust fake-ip-filter as needed. After changing modes, also account for DNS caches in the system and apps.

A DNS leak usually means domain queries have bypassed the intended resolution path—for example, an app still sends queries to the resolver used by the original network. Check system DNS, browser Secure DNS, IPv6, and the traffic covered by TUN. A test page's reported resolver location is only a clue, not conclusive evidence based on a region name alone. When needed, use logs or a packet capture to confirm where queries are actually sent.

TUN mode receives IP traffic through a virtual network interface, allowing the core to handle traffic from apps that do not actively use the system proxy. Actual coverage depends on system permissions, routes, exclusions, and DNS settings. Enabling TUN does not automatically support every type of network traffic. When running alongside another VPN, check for route conflicts; the virtual interface itself is not a remote encrypted tunnel.

The system proxy tells apps that follow operating system settings where to find the local proxy; it does not force every app to use it. A browser may follow the setting, while command-line tools, games, or apps with their own proxy options may use a different route. If only certain apps produce no traffic logs, first check their own proxy settings. If a client exits unexpectedly and connections stop working, check whether an old proxy address remains set in the system.

A subscription provides updateable nodes or configuration through a remote URL, but the format varies by service. Some links return a complete Clash configuration; others return only a node list and require a client that can import it. Subscription URLs may contain access credentials, so protect them like passwords. If an update fails, first determine whether the issue is a network request, account status, or content parsing.

YAML is a structured text format commonly used for Clash configuration. Indentation represents hierarchy, and hyphens mark list items. Use spaces for indentation; values containing special characters may need quotes, and duplicate keys can cause errors or overwrite values. Valid YAML syntax only means the text structure can be parsed—it does not guarantee that field names, references, or node settings are correct. Have the actual core validate the configuration.

A configuration file typically defines settings such as listening ports, nodes, proxy groups, rules, and DNS. External providers can supply additional content. A client may save multiple files, but the core uses the currently selected configuration and any changes merged by the client. If edits have no effect, confirm the file was saved, selected, and reloaded successfully; do not check only what appears in the editor.

A proxy provider separates node sources from the main configuration. It can load nodes from a remote URL or local file, which a proxy group references with use. It supplies proxy candidates, while rule-providers supplies matching conditions; they serve different purposes. If a provider downloads successfully but the group shows no nodes, check the file format, the provider name referenced by the group, and any node filters.

A configuration override stores local changes outside the base configuration or subscription, then merges them into the final configuration during an update or load. It is often used to preserve custom DNS, ports, and rules, but clients can use different merge orders and may replace arrays instead of appending to them. After setting an override, check the final active configuration. The presence of an override file alone does not mean custom rules have reached the core.