GLOSSARY

Clash Glossary

21 frequently-used terms organized into five categories. Each entry runs 2-4 sentences, covering only the precise meaning of the term in a Clash context and the key points for writing it into a config. Every card has an anchor you can link to directly from a tutorial or a support thread. For the full range of values for every field, see the YAML manual.

Inclusion criteria: terms that appear in the client UI, config files, or error messages, and that a newcomer is likely to get stuck on the first time they see them. Overly obscure protocol parameters are excluded — nobody remembers them anyway.

01 · CORE

Core Concepts

Subscription, node, proxy group, core — understand how these four relate to each other and you already understand most of how Clash works.

Subscription subscription: A URL provided by a proxy service or a self-hosted server; the client fetches it periodically to retrieve a full node list and config. The content might be a Base64-encoded node list or an entire Clash YAML file. Updating a subscription only refreshes node information — whether it overwrites local manual edits depends on the client's merge strategy.
Node proxy: The connection parameters for a single proxy server, including server address, port, protocol type, and encryption method. In the config file's proxies section, each node is one entry. A node's quality is determined by its route, server load, and protocol characteristics — not necessarily by the region named in its label.
Proxy Group proxy-groups: Groups multiple nodes by purpose and defines how one is picked: select for manual selection, url-test for automatic latency-based selection, fallback for sequential failover. Once a rule matches, traffic is handed to the proxy group, and the group's own logic decides which node ultimately handles it.
mihomo core: The core currently used by mainstream Clash clients, kept alive by the community after the original Clash core stopped receiving updates; it was formerly known as Clash.Meta. Compared to the old core, it supports more protocols (Hysteria2, TUIC, and others) and finer-grained rule types. GUI clients like Clash Verge Rev and ClashX Meta are all shells built around it.
Latency Test url-test: The client sends a request to a designated test URL and records how long it takes to complete, in milliseconds. This number reflects handshake and round-trip time — not bandwidth — so a low-latency node won't necessarily give you smoother video. The test URL, the handshake method used, and result caching all affect the number shown in the panel.

02 · PROTOCOL

Protocols & Transport

The common values of the type field in a node entry, and the transport layers they're often wrapped in.

Shadowsocks ss: A lightweight encrypted proxy protocol with a simple structure and low performance overhead — one of the earliest protocols Clash supported. Common config fields are cipher (encryption method) and password. In a node entry, type is set to ss, and the cipher must match the server exactly or the connection fails outright.
VMess vmess: The native protocol of the V2Ray project, authenticated by UUID — the client and server UUIDs must match exactly. Often paired with WebSocket and TLS to disguise proxy traffic as ordinary HTTPS. It has more fields than most protocols; in modern deployments alterId is usually fixed at 0.
Trojan trojan: A proxy protocol that mimics HTTPS behavior and requires a valid TLS certificate, giving its traffic pattern the appearance of a normal website visit. Key config fields are password and sni. If the server certificate doesn't match the SNI, the handshake will be rejected.
Hysteria2 hysteria2: A high-throughput protocol built on QUIC/UDP, tuned for congestion control on high-loss, long-distance links, commonly seen on cross-border routes. It requires a modern core such as mihomo to be recognized — loading a config with this node type on an old Clash core will throw an error. If UDP is blocked on the network, this protocol won't work at all.
WebSocket Transport ws: A common transport-layer disguise that wraps proxy data inside a WebSocket connection and layers TLS on top, making it look from the outside like an ordinary web long-lived connection. Because it runs on the standard port 443 and can be relayed through a CDN, it's often used to improve connection survivability. In a node entry it corresponds to network: ws and ws-opts.

03 · RULES

Rules & Routing

The rules section decides where every connection goes — it's what sets Clash apart from an ordinary system-wide proxy tool.

Rule-Based Routing rules: The config file's rules section is matched top-to-bottom, and matching stops at the first hit — later rules are never consulted. Common types include DOMAIN-SUFFIX (domain suffix), IP-CIDR (IP range), and GEOIP (IP geolocation). The order in which rules are written directly determines the routing outcome; the same set of rules in a different order can behave completely differently.
GeoIP GEOIP: A rule type matched by IP geolocation, relying on a local database file (typically Country.mmdb). A typical rule is GEOIP,CN,DIRECT, sending connections that resolve to a mainland China IP straight out without a proxy. The database needs periodic updates — a stale one can misroute newly allocated IP ranges.
GeoSite GEOSITE: A rule type matched against a domain category database that pre-packages thousands of domains into categories like google or cn, letting one rule cover an entire category of sites and dramatically shortening the rule list. The category database and the GeoIP database are two separate files, each maintained and updated independently.
DIRECT / REJECT built-in policies: Two built-in policies that require no definition. DIRECT connects to the target without going through any proxy; REJECT blocks the connection outright, and is commonly used to block ads and telemetry domains. Both can appear as the action in any rule, just like a regular proxy group.
MATCH fallback rule: The final catch-all entry at the end of the rule list, matching any traffic not caught by earlier rules, written as MATCH,PROXY. Without it, unmatched traffic falls back on whatever the core's default behavior is, making routing outcomes unpredictable. When troubleshooting "some sites go the wrong way," check what the fallback rule points to first.

04 · CONFIG

Config Fields

The fields you run into in the first few lines of config.yaml, plus the two switches that most affect day-to-day experience.

YAML config.yaml: The text format Clash config files use, expressing hierarchy through indentation and extremely sensitive to whitespace. Indentation must use spaces, never tabs, and a space is required after every colon. Most "config failed to load" errors trace back to a YAML syntax slip, not bad content.
mode rule / global / direct: The global operating mode field, with three values: rule routes by the rule list, global proxies all traffic, and direct sends all traffic direct. Everyday use should keep mode at rule; global is only useful for temporarily checking "is this actually a rules problem," and leaving it on long-term wastes bandwidth.
TUN Mode tun: The core creates a virtual network adapter and intercepts all system traffic at the network layer, independent of whether an application honors the system proxy setting — so it covers command-line tools, games, and other processes that "don't know about proxies." Enabling it requires administrator privileges or system extension approval, and it's usually paired with DNS hijacking to work properly.
Fake-IP enhanced-mode: A DNS response strategy: the client first returns a placeholder IP from a reserved range (198.18.0.0/16 by default), and once the application initiates a connection, the core maps that fake IP back to the real domain to handle it. This skips a round of real DNS lookup, speeding up connection setup; a handful of apps that depend on the real IP need to be added to fake-ip-filter as exceptions.
allow-lan LAN sharing: When set to true, Clash listens on all network interfaces instead of just the local loopback, letting phones and TVs on the same LAN point their proxy settings at this device and share one exit. This exposes the port to the whole LAN once enabled, so pair it with a firewall or authentication to restrict who can connect.

05 · NETWORK

Networking Basics

Not concepts unique to Clash, but unavoidable when troubleshooting.

DNS Leak DNS leak: The proxy is on, but domain resolution requests still go directly to the local ISP's DNS server, exposing which sites are being visited to the local network. This is common when only the system proxy is set and DNS hasn't been intercepted. Enabling TUN mode with DNS hijacking, or using Fake-IP mode, both noticeably mitigate it.
System Proxy system proxy: An operating-system-level HTTP/SOCKS proxy setting that well-behaved applications, like browsers, actively read and use. It's a convention, not an enforcement mechanism, and some programs ignore it entirely. If a piece of software refuses to go through the proxy no matter what, check whether it honors the system proxy at all — if not, switch to TUN mode.
UDP Relay udp: true: The ability of a proxy link to carry UDP traffic, which online games, voice calls, and QUIC-based websites all depend on. It requires support from the protocol itself, the server configuration, and the node field all at once — a node entry typically has udp: true. If a game has normal latency but keeps dropping connection, UDP probably isn't being relayed.
mixed-port mixed-port: A listening mode that accepts both HTTP and SOCKS5 proxy traffic on the same port, replacing the older combination of separate port and socks-port settings. Modern clients default to mixed-port: 7890; when entering a proxy address in another piece of software, just write 127.0.0.1:7890 — no need to distinguish between protocols.

What's Next

A glossary only answers "what does this term mean." The full range of values for each field, with config examples, is laid out in the YAML manual; for a specific issue like "why won't it connect," check the troubleshooting categories in the FAQ first; for a complete step-by-step path from scratch, see the tutorial. Haven't installed a client yet? Pick your platform on the Get the Client page.