GLOSSARY · 25 terms covered

Clash Glossary

The terms you'll keep running into while configuring and using Clash, sorted into five practical categories: core concepts, proxy protocols, routing rules, DNS & networking basics, and client features. Each entry notes the common English spelling or config field name so you can cross-reference the client UI and your config.yaml.

Quick Lookup · Jump Straight to a Term

Core Concepts

6 terms

Know the names before you unbox the tool. These are the terms you'll bump into before you even install a client — get them straight and everything else clicks.

Clash

Rule-based proxy core

A rule-based proxy core that routes network requests, and the namesake of the whole client ecosystem. The core itself has no GUI — clients like Clash Verge Rev and Clash Plus wrap an interface around it. Nodes, subscriptions, and proxy groups are all concepts defined by its config schema.

mihomo

Formerly Clash Meta

A community-maintained fork that took over after the original Clash repo went quiet, formerly named Clash Meta and renamed mihomo in 2023. It builds on the original rule system with support for newer protocols like Hysteria2, TUIC, and VLESS, plus rule providers — most mainstream GUI clients bundle it today. The core section of the download page offers a standalone executable for server and router users.

Subscription URL

Subscription

A URL generated by your provider that the client fetches to pull in a batch of nodes and group info. Paste it into the client and hit update, and the node list populates the interface — updating regularly keeps nodes current. Treat it like an account credential: never post it publicly or leave it visible in screenshots.

Node

Proxy Node

A single proxy server capable of forwarding traffic — one proxy entry in the config. Each node includes an address, port, protocol, and authentication details, typically shown in the client as a name, protocol type, and latency. Switching nodes changes where your traffic exits and which route it takes.

Config File

config.yaml

The single text file that defines everything the client does, typically named config.yaml. Port settings, DNS, the node list, proxy groups, and routing rules all live here — updating a subscription essentially replaces the nodes and groups sections. Manual edits require reloading the config or restarting the client to take effect.

YAML

The markup language config files use, relying on indentation rather than braces to express structure. It's extremely sensitive to indentation and the space after a colon — one extra space can break parsing. Back up the original file before hand-editing so you can roll back if something breaks.

Proxy Protocols

6 terms

The ss, vmess, vless prefixes in a node's config describe the transport protocol. Knowing the protocol matters more than knowing the node's display name.

Shadowsocks

An earlier, widely adopted encrypted proxy protocol, abbreviated SS, written as ss: in configs. Lightweight and supported across nearly every platform. For the cipher, choose an AEAD option like chacha20-ietf-poly1305 or aes-128-gcm.

VMess

A transport protocol from the V2Ray project, written as vmess: in configs, authenticating users via UUID. Supports transports like WebSocket and TLS and can disguise traffic as ordinary website traffic. A large share of subscription nodes use this protocol.

VLESS

A lighter protocol introduced in later V2Ray iterations, written as vless: in configs. It drops VMess's built-in encryption, handing security off to an outer TLS layer, and is often paired with transport schemes like XTLS or Reality. Requires a newer core such as mihomo.

Trojan

A protocol that disguises proxy traffic as normal HTTPS traffic, written as trojan: in configs. It reuses a real website's certificate, so its traffic pattern closely resembles ordinary browsing — deployment requires a domain and certificate.

Hysteria2

HY2

A high-speed QUIC (UDP)-based protocol, written as hysteria2: in configs, requiring a recent mihomo build. It tends to hold up better than TCP-based protocols on lossy connections like mobile data or long-haul international routes. Some networks throttle UDP, which can make this protocol unusable.

TUIC

Another QUIC-based proxy protocol, written as tuic: in configs, designed for low latency and high concurrency with tunable congestion control. Like Hysteria2, it depends on unobstructed UDP — if a network blocks UDP, it won't connect.

Routing Rules

4 terms

Whether a connection goes through the proxy, connects directly, or gets blocked — this set of mechanisms makes that call.

Rule-based routing

Rules

Clash's core operating mode: each connection is matched against the rule list top to bottom to decide whether it's proxied, direct, or blocked. Matching stops at the first hit, so order matters. The list usually ends with a MATCH catch-all rule for anything that didn't match earlier.

Proxy Group

proxy-groups

A configuration unit that bundles several nodes into a single selectable exit, defined under proxy-groups. Common types include manual select, auto-testing url-test, fallback, and load-balance. Rules reference the group name, not individual nodes, so switching nodes never requires touching your rules.

GeoIP

GEOIP / GEOSITE

A database that classifies IP addresses by country or region, written in rules as GEOIP,CN. Paired with GEOSITE for domain-based classification, it covers most direct-vs-proxy routing needs. The database needs periodic updates, which mainstream clients handle automatically.

Rule Provider

rule-providers

A way to store a category of rules — say, every domain for one service — as a separate file or remote URL, referenced via rule-providers. Cleaner than dumping thousands of rules into the main config, and it can auto-update. Only the mihomo core supports this field; the older Clash core doesn't recognize it.

DNS & Networking Basics

4 terms

Terms from the domain-resolution layer. Plenty of "connected but can't load pages" problems trace back to this layer.

DNS Leak

When the system or browser bypasses the proxy and sends DNS queries straight to the ISP's resolver. The fallout: browsing history gets exposed on the local network, and routing decisions can misfire. Filling out the client's DNS settings (nameserver, hijack listener) lets it intercept every query — see the DNS leak deep dive for detection and fixes.

Fake-IP

fake-ip

One of the client's DNS modes: a domain first resolves to a placeholder address in the 198.18.0.0/16 range, with actual rule matching applied once the connection is established. This skips the wait for a real DNS lookup, speeding up page loads. A handful of incompatible services (some LAN services, NTP) need to be added to fake-ip-filter.

nameserver

nameserver / fallback

The config field under the DNS section that specifies upstream resolvers, used to resolve both node domains and direct-connection domains. fallback handles domains that need proxy resolution, while default-nameserver only resolves the nameserver's own address. Public DNS works fine by default — see the DNS deep dive for a field-by-field breakdown.

Latency

The millisecond value shown in the node list, measuring how long an HTTPS handshake to that node takes. It reflects connectivity, not download speed — a low-latency node isn't necessarily high-bandwidth. Latency is good for a first pass; real-world performance also depends on packet loss and bandwidth, explained in node speed testing explained.

Client Features

5 terms

A row of toggles in the settings page, each mapping to a specific capability of the core.

TUN Mode

tun

A mode where the client creates a virtual network adapter, capturing traffic from almost every app on the system — including software that ignores system proxy settings (games, CLI tools). Requires administrator privileges to install the adapter driver, and the OS will prompt for authorization the first time it's enabled. If you only need to browse the web, system proxy is enough — see the user manual for how it works and when to use it.

System Proxy

Writes the client's local port (7890 by default) into the OS proxy settings, so any app that honors system proxy settings automatically routes through Clash. The toggle usually sits on the client's main screen. Turn it off before quitting the client, or some apps will lose their connection.

LAN Sharing

allow-lan

Lets other devices on the same network — phones, tablets, TVs — use this machine as a proxy server, controlled by the allow-lan field. Once enabled, other devices just point to this machine's LAN IP and port. Not recommended on public networks.

Launch at Startup

Launch at Login

Automatically starts the client after you log in, so you don't have to open it manually every day. The toggle is usually in settings; on Windows it uses startup items, on macOS it uses login items. Pair it with minimize-to-tray so it runs quietly in the background after boot.

External Controller

external-controller

The client's local management API, on port 9090 by default, set via the external-controller field. Web dashboards like Yacd and metacubexd use it to switch nodes and inspect connections. If you're not using a dashboard, leave it restricted to local access — don't expose the port to your LAN.

Can't find the term you're after?

For issues like connected-but-no-internet, high latency, or subscriptions not updating, browse FAQ by category; for how each config field works, check the user manual; for a first-time setup, walk through the setup guide.