Configuration fields · Concept boundaries · Where to look

Clash Glossary

Look up terms by where the setting lives: first distinguish the client from the core, then explore configuration, rules, traffic capture, and DNS. Use the anchor beside any heading to share a direct link to a term.

Where configuration comes from How traffic gets in Where connections go

CORE / PROTOCOL

Core and Protocols

The client interface, core capabilities, and remote server each have their own limits. If you see an “unsupported protocol” error, first check which core is actually running.

mihomo: core · mihomomihomo is the name of the core used by Clash Meta going forward. It handles proxy protocols, rule matching, DNS, and connections. GUI clients such as Clash Verge Rev provide an interface for working with the core, but they are separate projects. When checking configuration fields, refer to the version of the core in use, not just the client name.

Client and Core: GUI / coreThe client manages subscriptions, tray menus, system proxy settings, and configuration displays; the core handles network traffic. A toggle in the client may generate configuration or call a system service. When troubleshooting, note the client name and core details separately to avoid mistaking interface behavior for a core limitation.

Proxy Node: proxiesA node is a proxy server connection definition, usually including a server address, port, protocol, and authentication details. Its name is just a label; it does not confirm the exit location, bandwidth, or available services. Check connection logs, access to the destination website, and server status to determine whether a node works.

Proxy Protocol: type · Shadowsocks / VMess / TrojanA proxy protocol defines how the client and proxy server exchange data. The node's type specifies the protocol. Protocol, transport, and TLS are separate layers; setting one does not replace the others. If an import fails, check both the core's supported protocols and the complete configuration provided by the server.

Node Latency: URL test · timeoutThe latency shown in a client usually measures how long it takes to reach a test URL through a node, not just the ICMP round-trip time. The test target, connection handshake, and network path all affect the result; low latency doesn't mean high download speed. A timeout means only that this test didn't finish in time. See the latency testing guide for troubleshooting steps.

PROFILE / STRUCTURE

Configuration Structure

First check which Profile is active, then review how subscription updates and local changes are combined.

Profile: config.yaml · ProfileA Profile is a complete configuration loaded by the core. It commonly includes proxy definitions, proxy groups, routing rules, and DNS settings. A client can store multiple Profiles, but the active configuration and its overrides are what typically determine runtime behavior. After switching Profiles, check that the proxy groups and rules changed too—not just the selected indicator in the list.

YAML: mapping · sequence · indentationYAML is a common format for Clash configuration. It uses indentation for structure and hyphens for list items. Use spaces for indentation and align fields at the same level; quote strings containing special characters. Before saving, check for duplicate keys, boolean values, and list placement. Valid syntax doesn't guarantee that the fields mean what you intended.

Subscription: remote profile · update intervalA subscription fetches and updates nodes or configuration from a remote URL. It may return a complete Profile or just a set of nodes. The update interval controls when content is fetched again; it doesn't guarantee that nodes stay online. Subscription URLs may contain account credentials, so remove them before sharing logs or screenshots.

Proxy Providers: proxy-providers · useproxy-providers defines node sources separately, and proxy groups use use to refer to provider names. This lets you update a set of nodes while keeping local proxy groups and rules intact. Provider files and complete Profiles have different structures, so check that the returned format matches before using a full subscription URL as a provider URL.

Local Override: override · merge · patchA local override lets you preserve changes alongside a remote configuration, often for ports, DNS, and custom rules. Direct edits to a downloaded subscription file may be overwritten by the next update; whether overrides persist depends on the client. After making changes, check the final runtime configuration, especially whether list fields are appended, replaced, or reordered.

RULES / OUTBOUND

Routing Rules

Rules match traffic; proxy groups choose the outbound. Check match conditions and outbound names separately.

Routing: rules · MATCHIn rule mode, connections are checked in configuration order, and the first matching rule usually determines the outbound. The proxy group named at the end of a rule must exist; DIRECT and REJECT are built-in outbounds. Put MATCH last to catch connections that haven't matched earlier rules. Placing it too early makes subsequent rules ineffective.

Proxy Groups: proxy-groups · select / url-test / fallbackA proxy group combines multiple outbounds under a name that rules can reference. select lets you choose manually, url-test picks automatically based on test results, and fallback typically selects the first available option. Avoid circular references when nesting groups. See advanced proxy group configuration for examples.

DOMAIN-SUFFIX: DOMAIN-SUFFIX,github.com,PROXYThis rule matches domain suffixes. Enter github.com to match that domain and its subdomains; no wildcard is needed. This differs from DOMAIN, which matches only the exact domain, and keyword rules, which match a text string. A domain rule may not match if a connection has only an IP address and no associated domain.

GeoIP: GEOIP,CN,DIRECTGeoIP matches based on how the destination IP is classified in a geolocation database, not the language of the web page. The database may be out of date, and a site's CDN can resolve to IPs with different classifications. GeoIP applies to the connection's destination; it doesn't directly confirm a proxy node's actual exit location. When troubleshooting, check both the destination IP and the matched rule.

Rule Providers: rule-providers · RULE-SET · behaviorA rule provider manages a set of domains, IP ranges, or rules separately. Define it with rule-providers, then reference it in rules. behavior determines whether the set is parsed as domain, ipcidr, or classical, and must match its contents. Updating a provider doesn't change where it appears in the main rules list; priority still depends on rule order.

CAPTURE / LISTENER

Traffic Capture

“Does traffic reach the core?” and “Which outbound does it use?” are separate questions; one toggle cannot answer both.

System Proxy: system proxy · HTTP / SOCKSThe system proxy registers a proxy address and port with the operating system for apps that honor those settings. Some command-line tools, games, and apps with their own network settings won't follow it automatically, so enabling it doesn't mean all traffic is captured. To verify, make a new connection in your browser, then check the client's connections page. See system proxy setup for steps.

TUN Mode: tun · auto-route · dns-hijackTUN captures IP traffic through a virtual network interface and routing, including traffic from some apps that ignore system proxy settings. It typically requires system permissions and works alongside settings such as route exclusions and DNS hijacking. If your connection drops after enabling it, check service permissions, routing, and DNS resolution in that order instead of repeatedly switching nodes.

TUN stack: stack: system / gvisor / mixedstack selects the network stack implementation used for TUN packets. Common options include system, gvisor, and mixed. Available options, compatibility, and behavior vary by platform and core version; there is no single best setting for every device. When testing a change, leave other settings unchanged and recheck the affected app's connection.

Mixed Proxy Port: mixed-port: 7890mixed-port accepts HTTP and SOCKS proxy connections on the same listening port; 7890 is just a common example. When setting a proxy manually in an app, use the address and port from the active configuration. Allowing LAN connections also involves the listening address and firewall rules: access from this device doesn't guarantee access from others.

Outbound Mode: mode: rule / global / directRule mode selects an outbound using the rules list, global mode typically uses the global proxy group, and direct mode connects traffic entering the core directly. These modes control outbound selection; they don't route app traffic into the core. Global mode therefore doesn't capture traffic from every device app. See outbound mode explained for details.

DNS / DOMAIN MAPPING

DNS Resolution

First identify which component is resolving the domain and where the query goes. Then adjust Fake-IP or domain sniffing.

DNS Resolution: dns · nameserverDNS resolution translates domain names into IP addresses and other records. Apps, the operating system, the core, and the proxy server may all be involved. A browser's own encrypted DNS can follow a different path from the system settings. When a site won't load, distinguish DNS failures from connection failures and incorrect rule selection; a page failing to open doesn't by itself mean the node is unavailable.

Fake-IP: enhanced-mode: fake-ipFake-IP mode returns a mapped address to the app and keeps its association with the domain in the core. When the app connects to that address, the core recovers the domain and applies routing rules. The mapped address is not the website's real server address. The connection must still reach the core; changing the DNS response alone doesn't capture traffic.

Fake-IP Filtering: fake-ip-filter · fake-ip-filter-modefake-ip-filter works with the filter mode to control whether domains use real DNS results. It's often used for LAN services or apps that need real addresses. Interpret the list in the context of the active filter mode; a domain appearing in the list alone doesn't tell you how it is handled. For compatibility issues, identify the specific domain, make a limited change, and test again.

DNS Leak: resolver path · encrypted DNSA DNS leak occurs when domain queries take an unexpected resolution path—for example, a query that should be handled through a proxy still goes to a local resolver. The resolver shown on a DNS test page is only a clue; check browser encrypted DNS, system settings, and client logs too. If certain domains are designed to use local DNS directly, that behavior isn't automatically a configuration error.

Domain Sniffing: sniffer · HTTP Host · TLS SNIDomain sniffing attempts to recover domain names from supported protocol metadata, such as the HTTP Host header or visible TLS SNI. The recovered domain can help with rule matching, but sniffing doesn't decrypt the connection and won't work with all encrypted traffic. Configure whether to override the original destination and which ports to inspect based on your needs, without expanding the scope unnecessarily.