Clash Glossary

A subscription uses a link to retrieve and update proxy configuration. The response may be a complete Clash YAML file or just a list of proxies that needs conversion. Before importing, check that the server's format is compatible with your client. After updating, confirm that this subscription is still the active configuration.

Subscription URLs often contain account identifiers, so treat them like credentials and keep them out of public screenshots and discussion logs. See the subscription import guide for steps.

A proxy is a set of parameters for connecting to a proxy server, usually including its address, port, protocol and authentication details. In configuration, proxies are commonly listed under proxies. A proxy is used only when a rule sends the connection to a group that includes it.

A proxy's name is just a configuration label; it does not confirm the actual egress location, bandwidth or availability. Check real-world access and connection logs to verify these.

A client usually sends a request to a test URL through the selected proxy and displays how long that request took. The exact timing method depends on the implementation. Results vary with the test URL, connection handshake, server response and network conditions, and are not the same as download speed.

A timeout may mean only that the test URL is unreachable, while a successful test does not guarantee that every site will load. After selecting a proxy, try the destination site and check the connection list to confirm the route actually used.

YAML is a structured text format commonly used for Clash configuration. Indentation defines hierarchy, and hyphens mark list items. Use spaces and keep indentation consistent at each level. Values containing special characters may need quotes under YAML syntax rules.

Valid syntax does not guarantee that a configuration will run. Check that the current core supports its fields, that referenced proxy groups exist, and that the client is not overriding those settings at startup.

SOCKS5 is a protocol for connections between an app and a proxy endpoint, and can handle TCP. UDP forwarding requires support from both the app and proxy implementation. For a local SOCKS endpoint, apps usually use the loopback address; check the client for the listening port.

Whether the app sends domain lookups to the proxy depends on how it connects. Choosing SOCKS5 without enabling remote DNS resolution may still cause the app to query DNS locally first.

An HTTP proxy accepts proxy requests from apps. For HTTPS destinations, it usually establishes a tunnel using the CONNECT method. Browsers, command-line tools and development environments often support this endpoint, but may not automatically use the system proxy settings.

An HTTPS proxy field may refer to the proxy used to access HTTPS sites; it does not necessarily mean that the connection to the proxy endpoint uses TLS. Follow the app's instructions for the protocol and port.

Shadowsocks carries proxy traffic using an agreed encryption method and key. In Clash configuration, its type is usually written as type: ss. The server address, port, cipher and password must match the server settings; the protocol name alone is not enough to determine the required parameters.

Supported ciphers can vary between cores. If a configuration fails to load, check the supported options first; the protocol type alone does not indicate proxy speed or availability on your current network.

Trojan typically authenticates over a TLS connection and carries proxy requests through it. Along with the address, port and password, its configuration may require a server name and transport settings. The server name is part of the TLS connection and must match the certificate and server setup.

If the connection fails, check the system clock, certificate, server name and port. Disabling certificate verification skips the server identity check and should not be used as a routine fix.

Rule-based routing sends connections to a direct route, rejects them or assigns them to a proxy group based on conditions such as domain or destination address. In Rule mode, rules are usually checked from top to bottom, and the first match determines the route. Put specific conditions before catch-all rules such as MATCH.

For example, DOMAIN-SUFFIX,github.com,PROXY sends matching domains to the route named PROXY. That name must exist in the configuration. See the rule-based routing guide for setup steps.

Proxy groups provide a set of possible routes for rules to use. Members can be proxies, other groups or built-in routes supported by the configuration. Common types include select for manual selection, url-test to choose based on test results and fallback to try available routes in order.

Changing a group does not switch every connection. First check which rule matched the connection and which group it uses, then see which proxy that group ultimately points to.

GeoIP uses an IP address database to determine the region associated with a destination IP, commonly in rules such as GEOIP,CN,DIRECT. It matches address data, not webpage content or a domain's country of registration. CDN routing and outdated databases can affect results.

Updating GeoIP does not update subscriptions or domain rule sets. If a rule matches unexpectedly, check the actual destination address first, then see GeoIP update settings.

Rule providers store rule collections as separate resources, referenced from the main configuration with RULE-SET. This makes it easier to maintain separate lists for ad domains, app domains or IP ranges. Check the resource format, behavior and refresh interval to avoid reading a domain list as another type.

A rule resource usually does not determine the route; the rule that references it does. Even after a successful download, check the rule order: a broader rule earlier in the list may already match the traffic.

DNS resolves domain names into records such as IP addresses. The operating system, browser, apps and proxy core may all take part. The core's dns section only specifies how the core handles queries it receives; it does not route every device query through the core automatically.

When troubleshooting DNS issues, check the system resolver, encrypted DNS built into apps, DNS capture in TUN mode and cached records. Also distinguish a domain that fails to resolve from one that resolves but cannot connect.

Fake-IP assigns an internal mapped address to a queried domain. When an app connects to that address, the core restores the domain and selects a route. This is not the destination server's real address, so a lookup result alone cannot reveal the server's location. Devices that bypass the core should not connect to it directly.

If a LAN service or an app that requires real IP addresses has compatibility issues, check fake-ip-filter for the specific domains involved, then clear or refresh the old DNS cache after making changes.

A DNS leak occurs when a query takes a path other than the one intended, exposing the queried domain to another resolver. It describes a mismatch between the actual and intended paths, not simply a resolver being in a particular region. Some configurations deliberately resolve certain domains locally; distinguish that from an unintended bypass of the proxy.

Check test results alongside core logs and app DNS settings. Encrypted DNS changes how queries are transmitted, but does not prove that they follow the intended proxy path.

TUN mode uses a virtual network interface to capture traffic, including traffic from some apps that ignore system proxy settings. Coverage depends on routes, permissions and exclusions. Desktop clients may require a service or administrator privileges; mobile platforms typically use the system VPN interface.

After enabling TUN mode, check the DNS path and for conflicts with other VPNs, virtual network adapters or LAN routes. Successful TUN capture does not mean every connection is routed through a proxy by the rules.

mihomo is a proxy core descended from Clash Meta. It handles protocol connections, rule matching, DNS and traffic forwarding. A GUI client may bundle and manage the core, and may provide settings for configuring its behavior.

The GUI app and core do not necessarily update together. Before using a configuration feature, check which core is actually running and what it supports; the client name and configuration file extension are not enough.

GUI clients provide interfaces for managing subscriptions, selecting proxy groups, viewing logs and integrating with the system. Examples include Clash Plus, Clash Verge Rev and FlClash on different platforms. Clients may merge subscriptions, overrides and local settings at startup, so the runtime configuration may differ from the original subscription file.

To keep changes long term, check the client's override or merge behavior first so a subscription refresh does not overwrite manual edits. Choose a client for your platform on the downloads page.

A system proxy provides a local endpoint for apps that follow the operating system's proxy settings, usually configured with a loopback address and the client's listening port. It does not capture all network traffic; some games, command-line tools and apps with their own network settings may ignore it.

If your browser cannot connect after the client exits, check whether the system still has a stale proxy address. Removing it can restore direct access, but will not fix problems with the proxy or subscription itself.

mixed-port provides a shared endpoint for HTTP and SOCKS requests, while external-controller exposes the management API for controlling and querying the core. Common ports are 7890 and 9090, respectively, but clients can change them. Check the active configuration before entering either port.

Do not use the controller port as an app's proxy port. For local access, bind to the loopback address; if you need access from other devices, also check authentication and firewall settings. See the port configuration guide.