Clash Wiki / Configuration Dictionary
Clash Terminology Guide
From the mihomo core to TUN, Fake-IP, proxy groups, and subscription updates, this guide breaks down common concepts along the configuration path. Each entry explains the problem it addresses, related settings, and boundaries that are easy to confuse during troubleshooting.
5 configuration topics
27 core terms
For mobile and desktop
Browse by Category
Find Concepts by Configuration Stage
Start with the stage where the problem occurs, then follow related concepts in each entry. The core executes traffic, modes define interception scope, rules select the exit, DNS preserves domain information, and the client handles importing and control.
Core / Protocol
Core and Protocols
These concepts determine what executes the configuration, how files are parsed, and which communication method remote connections use. Check this section first when a configuration will not load, a field is unsupported, or the core fails to start.
- Clash
- A client ecosystem built around rule matching, proxy groups, and proxy protocols for routing traffic. In everyday usage, Clash may mean a client interface, a configuration format, or any core compatible with that configuration system. Troubleshooting should begin by identifying the exact client and core.
- mihomo
- A proxy core developed as a continuation of Clash Meta. It handles connection setup, rule matching, DNS, TUN, and policy scheduling. Client interfaces usually manage it through configuration files or a control API. Whether a setting works ultimately depends on the integrated core version and exposed features.
- Proxy Protocols
- The communication standard used when a client connects to a remote server. A configuration includes the server, port, authentication, and transport parameters. The protocol name describes the connection method, not line quality. Parameters must match the server or the node may load without establishing a working connection.
- YAML
- The data format commonly used for Clash configuration files, with indentation representing object hierarchy and hyphens marking list items. Tabs, inconsistent spacing, missing colons, or duplicate keys can cause loading failures. Keep indentation consistent in long configurations and watch for special characters in strings.
- Rule Provider
- A mechanism for splitting rule collections into local files or remote URLs, often called rule sets or rule providers. The main configuration declares the source, update interval, and behavior type, then references the supplied rules. This is useful for maintaining large domain and address collections and updating them independently.
Traffic Capture
Proxy Modes
Proxy modes have two meanings: how traffic enters the core, and whether rules run after it enters. System proxy and TUN define interception scope, while rule, global, and direct modes determine subsequent handling.
- Rule Modes
- Connections are matched against the rule list from top to bottom, then sent to the specified proxy group, proxy, or direct connection. Different websites and apps can therefore use different paths, making this the most common everyday mode. If a target hits an unexpected policy, check whether an earlier rule intercepted it first.
- Global Mode
- It bypasses ordinary routing rules and sends intercepted connections to the global policy. This is useful for temporarily testing a node or determining whether rules cause an access problem. Global mode does not expand interception automatically; apps that never enter the core remain unaffected.
- Direct Mode
- Connections intercepted by the core access their destinations directly without using a proxy node. If access recovers in direct mode, the node or proxy path may be responsible; if it still fails, check the local network and DNS. Direct mode is not exactly the same as closing the client, because interception and resolution may still be active.
- System Proxy
- Point the operating system's HTTP or SOCKS proxy address to Clash's local listening port. Browsers and other applications that follow system settings will use this entry automatically, but some games, command-line tools, and independent network stacks may ignore it. Configure an application proxy separately or consider enabling TUN.
- TUN Mode
- It captures IP traffic through a virtual network interface and can cover applications that ignore system proxy settings. On mobile, this usually appears as a persistent VPN connection; on desktop, it may require a service, network extension, or elevated permissions. After enabling it, check routing, DNS interception, and conflicts with other VPN tools.
Rules / Policy
Rules and Policies
Rules answer which handler should receive a connection, while a policy group determines which node or action handles it. Separating the two lets you update nodes without changing rules and adjust rules without rebuilding the subscription.
- Rule-Based Routing
- Traffic is sent through a proxy, directly connected, or rejected according to conditions such as domain, IP, port, or process. Rules are usually checked in written order, and matching stops at the first hit. More specific conditions should come before broad sets and the final catch-all rule to avoid being overridden.
- Proxy Groups
- A logical entry point that combines multiple nodes or other policies for selection, testing, or failover. Rules usually reference a proxy group by name rather than binding directly to a node, keeping the rule structure stable when subscription nodes change.
- select
- A proxy group type in which the user manually selects the current exit, suitable when the connection path must be controlled explicitly. Clients usually remember the choice, but reimporting a configuration, renaming a group, or losing a node may restore the default. Check key policies after updating a subscription.
- url-test
- A proxy group type that periodically tests candidate nodes against a specified URL and automatically selects a connection path based on the results. The test reflects response behavior to that target, not the speed of every website. Very short intervals also increase background traffic and mobile battery use.
- fallback
- A proxy group type that selects an available node according to candidate order and health-check results. It prioritizes connection availability and switches to the next candidate when the current node fails. Unlike url-test, fallback does not primarily aim to keep selecting the lowest response time.
- GeoIP
- A rule-matching method based on the target IP's classification in a geographic database. A domain connection usually needs to resolve first, so the resolution path affects the result. Database contents are updated periodically, and a GeoIP result is not absolute proof of a server's physical location.
- GeoSite
- A domain-set matching format commonly used to organize rules by region, service, or purpose. It categorizes domains rather than locating IP addresses geographically. Sites using multiple domains or third-party resources may require several categories for complete coverage.
DNS / Network
DNS and Networking
DNS does more than convert domains into addresses: it affects whether rules receive the original domain, which network path handles the query, and which address the connection ultimately reaches. When a connection succeeds but a page will not open, check this section first.
- DNS
- The basic service that converts domain names into network addresses. Clash can intercept queries, select upstream resolvers, and pass domain information to the rule system. Failed resolution, unreachable returned addresses, or a query that misses the expected path may appear as a page that waits indefinitely.
- DNS Leak
- A situation in which domain queries bypass the expected Clash resolution path and are handled by another network interface or resolver. This can make the DNS path differ from the proxy connection path. Check system DNS, browser encrypted DNS, TUN interception, and fallback resolution settings.
- Fake-IP
- An enhanced mode in which the local DNS module first returns a mapped address to the application, then the core restores the original domain and performs rule matching. It preserves domain information during connection handling and reduces ambiguity from resolving before matching. LAN devices, connectivity checks, and some specialized applications may need to be added to the Fake-IP filter list.
- redir-host
- A compatibility mode that performs real DNS resolution first, then handles the connection using the domain and actual address. Its behavior is closer to traditional network resolution and may be easier for some LAN and specialized applications to handle. Compared with Fake-IP, the timing of domain preservation and the rule-matching path differ.
- nameserver
- The list of upstream resolvers used by the Clash DNS module for ordinary domain queries. Entries may be traditional DNS or encrypted DNS addresses supported by the core. Choose upstreams with their reachable path, returned results, and proxy requirements in mind.
Client Control
Client Features
The client receives subscriptions, displays nodes, writes system settings, and sends control commands to the core. A connected status only means local interception is enabled; actual access still depends on resolution, rules, policies, and the node.
- Subscription
- A way to distribute nodes, proxy groups, or complete configurations to a client through a remote URL. Updating a subscription rereads the upstream content, so nodes may be added, removed, or renamed locally. Whether manual edits survive depends on support for overrides, merging, or a separate local configuration layer.
- Node
- A single proxy connection entry that proxy groups can call from the configuration, typically containing a server address, port, protocol, and authentication parameters. A node name is only an identification label and says nothing by itself about availability. Successful loading does not prove that the server is reachable; verify it with an actual connection or health check.
- Latency
- The response time measured after a client sends a request to a test target, used to observe the current network path. Results vary with the test address, route load, local network, and test method. Lower latency does not mean higher download speed and cannot replace checks of stability or reachability to the target site.
- mixed-port
- A local listening port that accepts both HTTP and SOCKS proxy connections. Applications can connect to the same port according to the proxy type they support, simplifying local setup. If the client cannot start listening, check whether another proxy tool or background process already occupies the port.
- External Controller
- The management API provided by mihomo to a client interface or external control panel. It can read connections, switch policies, and reload configurations. It normally only needs to listen on the local address. If LAN access is required, configure access controls and restrict the interface's network reachability.