Clash / Glossary
Terms covering subscriptions, rule-based routing, and networking. Look them up by where they appear in your configuration, and distinguish connection entry points, match conditions, and outbound policies.
Core concepts
Follow the path from configuration source to app connection, distinguishing what you get from how you use it.
A way to retrieve and update proxy nodes or configuration from a single URL. Updating a subscription fetches the source again. It may return a complete YAML file, a list of nodes, or encoded text; direct import depends on the client’s supported formats. A subscription is not the proxy service itself, and its URL may contain account identifiers. Treat it as sensitive information and never share the full link when troubleshooting.
A proxy connection definition containing a server address, port, protocol, and authentication parameters, usually listed under proxies in the configuration. Node names are referenced by proxy groups and rules; a region in the name does not guarantee the actual exit location. Connectivity also depends on account status, protocol parameters, and the current network. Renaming a node does not change its connection route.
The response time measured by a client using a specified test address and method; the test may include connection setup and the target’s response. Different test addresses, timeout settings, and network paths produce different results, so numbers alone are not a reliable way to compare clients. Low latency does not mean fast downloads. If a test times out, first check whether the test target is reachable rather than assuming the node is down.
A configuration managed by the client, along with information such as its source and update method; the interface may call it a profile. Switching profiles may change nodes, proxy groups, rules, and DNS settings—not just the outbound. Edits to a remote profile may be overwritten on update, so save long-term customizations using the client’s supported override mechanism.
A connection method that points the operating system’s proxy settings to a client’s local listening port. Browsers and apps that honor system proxy settings send requests to that port; programs with independent network settings may still connect directly. If the client exits but leaves a stale proxy address configured, apps may lose connectivity. Check both the client’s status and the system proxy settings.
Proxy protocols
A protocol defines how a client communicates with a proxy service. The local connection protocol and the remote node’s protocol can be different.
A way for apps to send requests through an HTTP proxy port. HTTPS typically uses CONNECT to establish a tunnel, then uses TLS to communicate with the destination site. An HTTP proxy can be a local entry point provided by the client or a remote proxy type in the configuration. Seeing “HTTP” does not tell you whether the entire connection is encrypted; consider each leg separately: app to proxy and proxy to destination.
A general-purpose proxy protocol that supports TCP forwarding and defines a mechanism for UDP forwarding. It is commonly used when an app needs a proxy configured directly. The protocol does not encrypt traffic, and username/password authentication does not create an encrypted tunnel. Actual UDP support requires the app, client settings, and remote service to work together. Which side resolves domain names also depends on how the app connects.
A proxy protocol that connects to a remote service using an agreed encryption method and authentication parameters. Its configuration type is usually ss. Match the server address, port, encryption method, and password when importing it; a mismatch can cause the handshake to fail. If the service requires a plugin or a specific protocol variant, confirm that the client core and server use compatible implementations.
A proxy protocol that typically uses TLS for an encrypted connection and a password for authentication. The server address and the domain used for TLS do not have to be the same. SNI, the certificate name, and system time can all affect the handshake. If you see a certificate error, check these parameters and the server configuration first; disabling certificate verification is not a suitable long-term fix.
Rules & routing
Rules determine what matches, proxy groups determine what to choose, and the selected outbound establishes the connection.
A mechanism for choosing an outbound for a connection based on conditions such as domain, IP, process, or rule set. In rule mode, rules are generally matched from top to bottom, and the first match determines the policy. A final MATCH rule can catch remaining connections. Before changing rules, check the matched rule in the connection log; an overly broad rule placed too early can prevent more specific rules from taking effect.
A way to organize nodes or other policies into an outbound that rules can reference, keeping matching logic separate from specific nodes. select lets you choose manually, url-test selects automatically based on test results, and fallback checks members in order for one that is available. Rules reference the group name; the selection within the group determines the actual outbound. If you rename a group, check all references.
A collection of rules defined by rule-providers and referenced by RULE-SET, useful for maintaining large domain or address lists. The collection stores match criteria, while the referencing rule specifies the outbound; both determine how a connection is handled. Check the file format, behavior, and cache path. A successful download does not guarantee that the entries use the expected format.
A rule-matching capability based on an IP geolocation database, for example GEOIP,CN,DIRECT. Results depend on the database version and IP address allocation; they are not precise indicators of a website’s business region or a user’s location. Matching a domain connection against an IP rule may trigger DNS resolution. Adding no-resolve prevents the rule from initiating resolution, but may also stop it matching requests that do not yet have a destination IP.
DIRECT connects directly using the local network route; REJECT blocks the connection. Both are built-in policies that rules can reference. Direct does not mean using a specific physical network adapter; traffic may still pass through a system VPN or another network layer. Reject rules are useful for blocking specific targets, but overly broad rules may disrupt logins, CAPTCHAs, or resources a page depends on.
DNS & network stack
Domain resolution and traffic routing are separate stages. Consider the app, system routes, and core settings together.
A system that resolves domain names to records such as IP addresses. The result determines which address a subsequent connection may reach. Client DNS settings control the queries it receives, but system caches, app-level encrypted DNS, and how queries are routed also affect the outcome. When troubleshooting, distinguish between a domain failing to resolve and the resolved address being unreachable; they point to different problems.
A DNS mode in which the client returns a mapped address to an app, then restores the domain name for subsequent connections. This helps preserve domain information for routing, but the address seen by the app may not be the destination server’s real address. Local network services or specific apps that rely on real DNS results may need fake-ip-filter. After changing it, check for stale DNS caches in the system and apps.
A connection method that receives IP packets through a virtual network interface and passes them to the core for processing. It can cover some apps that ignore the system proxy. Actual coverage depends on routes, permissions, the network stack, and exclusions; simply enabling the setting does not guarantee that all traffic is captured. TUN controls how traffic enters the client; once there, connections can still be routed directly, through a proxy, or rejected by rules.
A situation where DNS queries use an unexpected resolver or route. Before assessing one, define which queries should use which outbound. System DNS, browser Secure DNS, IPv6, and apps the client does not intercept can all produce unexpected results. A test page identifying a resolver is only a clue; confirm it against query logs and actual routing. Do not draw conclusions from a region label alone.
The ability to identify a domain from protocol metadata visible at the start of a connection, such as parts of an HTTP request or TLS handshake. It can help route connections that contain only a destination IP, but it does not decrypt HTTPS traffic. Protocol changes, encrypted handshake data, or missing identifiable fields may prevent domain detection, so sniffing cannot replace proper DNS and routing configuration.
Client & core
The interface manages; the core handles execution. Check both the configuration source and the effective configuration when assessing compatibility.
The client typically handles the interface, subscription management, and system integration, while the core handles proxy connections, DNS, and rule execution. They may update separately, so the client version alone does not show which configuration fields are supported. When troubleshooting, note the actual core name and version, and inspect the effective configuration. Different clients may also expose the same field through different menus or override methods.
A proxy core under continued development in the Clash ecosystem, formerly known as Clash.Meta, that provides protocol handling, proxy groups, routing, and DNS. It is a component that executes connection logic, not a universal name for every client interface. Before copying a configuration example, check that the actual core supports its fields; newer features may not work in older versions or other cores.
A text data format that uses indentation to represent structures such as mappings and lists; Clash configurations typically use YAML. Use spaces for indentation and keep fields at the same level consistent. Strings, booleans, and lists that look similar have different types when parsed. Valid syntax does not guarantee a working configuration: incorrect proxy group references, misspelled fields, or unsupported core features can still cause loading to fail.
A way to modify the effective configuration with additional rules, merge files, or scripts on top of a subscription or base configuration, useful for preserving local customizations. Clients differ in whether lists are appended or replaced and in how fields are merged. After making changes, inspect the generated effective configuration and logs, not just the original subscription file. Keep a recoverable copy before editing.
A management interface used by a client UI or control panel to read status and change policies, usually configured with the external-controller listening address. It is not an HTTP or SOCKS proxy entry point and does not forward network requests for ordinary apps. The listening address and authentication settings determine who can access it. For local use, restrict it to a loopback address; do not expose it directly to an untrusted network.