CLASH GLOSSARY · 28 TERMS
Organized around the paths used in real configuration interfaces. First identify the term’s layer, then determine whether the issue involves a protocol, configuration, rule, network, or client feature.
CATEGORY INDEX
Category links stay above the page content. Term anchors in the browser address can be shared directly or used to return to a specific card.
PROTOCOL AND KERNEL
Protocols define how clients and servers establish connections and transfer data; the core parses configuration, implements protocols, and dispatches traffic. The graphical client and the core are separate layers.
KERNEL · M
A proxy core evolved from Clash Meta, extending protocol, rule, DNS, and TUN support. Many newer clients use it as their backend, even when mihomo is not part of the client name. It reads many traditional Clash configurations, though some extended fields still depend on the core version.
KERNEL · C
The core program from the original Clash project. It reads configuration, establishes proxy connections, and applies rules. It is not the same thing as the graphical client seen on Windows, Android, or macOS. Since the original project stopped receiving updates, newer protocol support is generally concentrated in later cores such as mihomo.
PROTOCOL · SS
A relatively lightweight encrypted proxy protocol that typically has low connection and computational overhead. Configuration requires a server address, port, password, and cipher; any mismatch can prevent connection. Actual speed mainly depends on the server route, congestion, and encryption implementation.
PROTOCOL · VMESS
A proxy protocol used in the V2Ray ecosystem that supports user identifiers and transports such as TCP and WebSocket. When importing a configuration, verify the address, port, UUID, transport layer, and TLS settings. Matching protocol names do not guarantee compatible parameters.
PROTOCOL · TROJAN
A proxy protocol that establishes connections over TLS, with authentication commonly configured as a password. The server name, certificate verification, and transport method are all part of the connection and cannot be checked by address and port alone. Clock skew can also affect TLS certificate validation.
PROTOCOL · VLESS
A proxy protocol focused on a streamlined authentication layer, often combined with TLS, Reality, or different transports. The client must support the specific combination used by the subscription, not merely recognize the name VLESS. UUID, flow control, server name, and public-key fields should match the server settings.
PROTOCOL · HY2
A QUIC-based proxy protocol designed for efficient transport on high-latency or lossy links. Configuration commonly includes authentication, a TLS server name, and bandwidth parameters. Mobile networks may provide more consistent recovery, but results still depend on link quality and congestion-control settings.
PROTOCOL · TUIC
A QUIC-based proxy protocol supporting multiplexing and connection migration. It relies on UDP, so networks that restrict UDP may cause connection timeouts. Client and server versions and authentication parameters must be mutually compatible.
SUBSCRIPTION AND CONFIGURATION
Subscriptions deliver updateable data, while a Profile stores the configuration the client actually reads. Nodes, proxy groups, and YAML represent connection objects, selection logic, and the configuration format.
CONFIG · SUBSCRIPTION
A configuration endpoint published by a service provider. The client uses the subscription URL to retrieve nodes, proxy groups, or rules. Updating usually rereads remote content, so locally edited fields may be overwritten. An expired subscription, failed authentication, or unreachable network can all appear as an update failure.
CONFIG · PROFILE
A complete configuration instance saved in the client, usually containing proxy nodes, proxy groups, DNS, and rules. Multiple Profiles can coexist, but generally only one is loaded into the core at a time. After switching, recheck proxy-group selection and operating mode.
CONFIG · PROXY
A single proxy exit defined in a configuration, recording the protocol, server address, port, and authentication parameters. The name mainly identifies it in the interface; a region or multiplier in the name does not mean the client has verified that attribute. Availability must be judged through an actual connection or health check.
CONFIG · PROXY GROUP
A policy selection unit made up of nodes or other proxy groups. The select type is chosen manually, url-test can select automatically from probe results, and fallback is commonly used for availability switching. Rules usually point to proxy groups rather than hard-coding a node.
CONFIG · YAML
The common data format for Clash configuration, using space indentation to express object and list nesting. Tabs, inconsistent indentation, missing spaces after colons, or incomplete quotes can all cause parsing errors. After editing, use the client’s configuration checker before starting a connection.
RULES AND ROUTING
Rules determine which policy handles a request. Match order, domain-resolution results, and rule-data versions jointly affect the final path, so troubleshooting should not focus only on the currently selected node.
RULE · ROUTING
Routes requests to a specified proxy group by domain, IP, process, or other conditions. Rules are usually checked from top to bottom, with the first match taking effect and later rules ignored for that request. Incorrect ordering can let a broad rule intercept traffic intended for a more specific rule.
RULE · FINAL
The final match in a rule list, receiving traffic that did not match any earlier condition. It is usually placed at the end and points to a default policy group. Without a final rule, different cores or configuration templates may use different default handling.
RULE · GEOIP
A database rule that matches the region associated with an IP address. Results depend on the local database version and the address ultimately returned by DNS. A CDN domain may resolve to different regions, so GeoIP does not always represent the service owner’s location.
RULE · GEOSITE
Matches requests against predefined domain sets, reducing the work of maintaining domains individually. The categories come from the rule data source, whose update frequency and coverage are independent of the client interface. When routing is incorrect, first verify the matched set and data version.
RULE · ACTION
DIRECT connects traffic directly to its destination without a proxy node. REJECT denies the request locally and is often used to block specific domains or connections. Both can be rule results and may also appear as options in a proxy group.
NETWORK FOUNDATION
Latency describes a single round trip, DNS determines how a domain becomes an address, and Fake-IP and TUN change how requests enter the core. These concepts often appear together when diagnosing connection problems.
NETWORK · LATENCY
The time from a client probe to the response, usually measured in milliseconds. It reflects round-trip conditions for a specific target, protocol, and moment—not download speed or sustained stability. A timeout for an unreachable test target does not necessarily mean the node is completely unavailable.
NETWORK · DNS
The system that resolves domain names to IP addresses. Clash can use the system resolver, a specified upstream server, or its built-in DNS module. The resolution path affects rule matching, connection targets, and failure behavior, so check DNS settings together with the current operating mode.
NETWORK · DNS PATH
A situation where some domain queries bypass the intended DNS path and are handled by another resolver. Common causes include encrypted DNS enabled independently in the browser, other network interfaces retained by the system, or queries initiated directly by an app. Troubleshooting requires checking client logs, system settings, and browser configuration.
NETWORK · FAKE-IP
The local DNS module returns a mapped address for a domain, then the core restores the domain through that mapping and applies routing rules. This lets domain rules take part earlier and helps TUN traffic identification. Some LAN devices or apps that require real-IP responses may need to be added to the filter range.
NETWORK · TUN
Uses a virtual network interface to capture more system traffic, allowing apps that ignore system proxy settings to enter Clash’s processing path. It is not the same mechanism as a browser proxy toggle. After enabling it, check routes, DNS, permissions, and interface conflicts with other VPN software.
CLIENT FEATURES
The client connects system permissions, core parameters, and configuration files. The entry-point names may differ between clients using the same core, but their underlying functions are usually comparable.
CLIENT · SYSTEM PROXY
HTTP or SOCKS proxy settings provided by the operating system. Only apps that honor them send requests through the client. Browsers commonly read system proxy settings, while some terminal programs, games, and standalone networking libraries do not. Configure an application proxy separately or use TUN mode in those cases.
ANDROID · VPN SERVICE
Android’s local VPN interface. After system authorization, the Clash Android client creates a virtual network and receives device traffic. Android displays the connection request the first time it is enabled. The system usually allows only one active VPN service, so switching apps replaces the existing connection.
CLIENT · PROVIDER
A configuration mechanism that loads a set of proxy nodes from a separate file or remote address. It keeps the node list independent from the main configuration and lets multiple proxy groups reuse the same source. Update intervals and health-check parameters are usually defined in the Provider configuration.
CLIENT · RULE SET
A mechanism for loading rule sets from an external data source. The main configuration references the rule-set name and specifies the policy applied to matches. Different sources may use domain, IP, or classical rule formats. If the format type does not match the actual file, the core may reject it or fail to match rules correctly.
CLIENT · HEALTH CHECK
The client probes node availability at configured targets and intervals, commonly for automatic selection and failover. Results apply only to the specified URL and current network conditions. Excessive frequency increases background requests and battery use, while low frequency delays detection of failed nodes.