Clash Glossary

The command-line program that handles traffic forwarding and rule matching, with no interface of its own. A GUI client is just a graphical shell: every click in the UI ultimately turns into a config option the core can read. Swap clients but keep the same YAML, and behavior stays identical.

A community-maintained fork of the Clash core, formerly named Clash Meta. It adds Hysteria2, TUIC, and more rule types on top of the original, and it's what most mainstream clients ship with by default today. The original Clash core has stopped receiving updates.

A lightweight proxy protocol based on symmetric encryption, needing only a server, port, password, and cipher. Low overhead, stable latency, and written as ss in a Clash config's type field.

A proxy protocol designed by the V2Ray project, using a UUID for authentication and often layered with WebSocket and TLS. It has built-in time verification: a clock offset of roughly 90 seconds or more between device and server causes the handshake to fail outright — sync the clock first if it won't connect.

A protocol that disguises proxy traffic as standard HTTPS: running over port 443 with a valid TLS certificate, it looks almost identical to normal website traffic from the outside. It depends on a domain and certificate, so node addresses are rarely bare IPs.

A QUIC-based proxy protocol that runs over UDP with aggressive built-in congestion control, giving a clear throughput edge on lossy, long-distance links. Only the Mihomo core supports it; if the network throttles UDP, results can flip the other way.

A rule type matched by domain suffix. Write DOMAIN-SUFFIX,example.com,PROXY and both example.com and all of its subdomains are matched. It's the most commonly used rule type in any rule list — precise and predictable.

Matches by the country or region of the destination IP, relying on a local GeoIP database file. GEOIP,CN,DIRECT is the standard way to send mainland China IPs direct. A stale database can misjudge location; most clients let you update it manually.

The catch-all rule, matching any traffic not caught by earlier rules, and it must be the last line in the rule list. Anything placed after it is never evaluated; leave it out, and stray traffic ends up with no outbound at all.

A rule type that references an external rule collection: hundreds or thousands of domain and IP rules go into a separate file, with just one reference line in the main config. The collection file can be updated remotely, decoupling rule maintenance from the main config.

A DNS handling mode: when a domain query comes in, the core first returns a placeholder IP from a reserved range (like 198.18.0.0/16), and only matches domain-based rules once the connection actually fires. This skips the wait for real resolution and makes domain-based rule matching more reliable. A handful of apps that need the real IP are incompatible and can be excluded via fake-ip-filter.

The situation where the proxy is on, but DNS queries still go out to the local ISP's servers — meaning which domains you visited is visible to a bystander. Letting the core take over DNS (configuring and enabling the dns section) or simply turning on TUN mode are the two common fixes.

One of the built-in outbounds: traffic connects to the destination directly, with no proxy involved. Local sites, LAN devices, and OS update traffic should generally point here — otherwise they take a needless detour through a node and slow down.

One of the built-in outbounds: the connection is dropped outright, showing up on the app side as a connection failure. Commonly used to block ads and telemetry domains. If a site won't load, check that it hasn't been misrouted to REJECT first.

A container (the proxy-groups section) that organizes multiple nodes under a strategy, with rules pointing at the group rather than a single node. Common types: select for manual choice, url-test for auto speed-testing, fallback for failover, and load-balance for load balancing. Groups can also nest other groups.

An auto-speed-test proxy group: at the interval set by interval, it pings a test URL and always picks the node with the lowest latency in the group. The tolerance parameter decides how many milliseconds of difference are needed before switching, preventing rapid flapping.

A load-balancing proxy group: connections are spread across multiple nodes in the group by hashing or round robin. Good for easing bandwidth pressure off a single node; but the exit IP shifts between connections, which isn't ideal for services sensitive to login state.

An HTTPS address from a provider that the client periodically fetches to get the latest node list and config. It carries credentials in the URL: a leak is the same as sharing the account, so redact it before screenshotting or posting logs.

The text format Clash config files use, expressing hierarchy through indentation with a space required after every colon. Indentation must be spaces only — mix in a single tab character and the whole config fails to load. Error messages usually point straight to the offending line.

A generic subscription format made by joining node share links like ss:// and vmess:// line by line and encoding the whole thing. It contains only nodes, no rules or proxy groups; Clash clients either rely on built-in parsing or need a subscription conversion step to fill it out into full YAML.

A service or tool that converts one subscription format into another, typically used to wrap a generic Base64 subscription with a rule template, producing Clash YAML that can be imported directly. The conversion service can read all of your nodes, so pick a trusted instance or self-host. See subscription format formats explained for details.

A community nickname for proxy subscription providers: pay up and get a subscription link containing nodes across multiple regions. Quality varies enormously; when shopping around, focus on the connection type (direct/relay/dedicated line), the traffic multiplier, and the stated node locations.

A working mode where the core creates a virtual network adapter and pulls in all system traffic. Programs that ignore system proxy settings — games, CLI tools, some desktop software — can all be covered this way. Enabling it needs admin or root privileges; pick either it or the system proxy, not both at once.

An HTTP proxy entry written into the OS network settings: once the client enables it, browsers and other apps that respect the setting automatically hand traffic to the local port. Some software ignores it, in which case switch to TUN mode. An abnormal client exit can leave the setting behind, which shows up as a broken connection — just turn it off manually to recover.

A single local port (mixed-port, often 7890 by default) that accepts both HTTP and SOCKS5 traffic. If another process already holds that port, the core fails to start with a bind: address already in use error — see how to find and change a port conflict for the fix.

A graphical program wrapping the core, handling subscription management, node switching, and toggling the system proxy or TUN — Clash Plus, Clash Verge Rev, and FlClash are examples. Routing capability comes from the core; differences between clients mainly show up in the interface, platform coverage, and update pace. See the client comparison to pick one, and client downloads for install packages.