MANUAL / GLOSSARY · REF 05
This page collects the 23 terms most frequently encountered when using and configuring Clash clients, arranged into five numbered categories. Each entry includes a definition, purpose, and related concepts. Come back here when a config error, a tutorial step, or an FAQ answer uses an unfamiliar term.
SHADOWSOCKS / SS
A lightweight proxy protocol based on symmetric encryption. Its structure is simple, handshake overhead is low, and it's friendly to lower-powered devices. Every Clash core supports it natively, and it commonly appears as type ss in subscriptions, often mixed with other protocols.
VMESS
A transport protocol defined by the V2Ray project. Authentication depends on time sync between client and server - a local clock drift of more than about 90 seconds will break the connection. It supports combinations like WebSocket and gRPC, giving flexible obfuscation options.
TROJAN
A protocol that disguises proxy traffic as standard TLS traffic. It relies on a valid certificate and port 443, so its external fingerprint closely resembles ordinary HTTPS access. It has few config fields - mainly server address, port, and password.
VLESS
A streamlined successor to VMess. It drops the built-in encryption layer and provides no confidentiality on its own, so it must be paired with an outer layer such as TLS or Reality. Overhead is lower, it's common in newer subscriptions, and it requires a mihomo-based core.
HYSTERIA2 / HY2
A QUIC-based proxy protocol optimized for high-packet-loss links. It uses custom congestion control to maintain throughput on unstable networks, at the cost of potentially using more bandwidth. It runs over UDP, so it won't work on networks that block UDP.
RULE MODE
Clash's default operating mode. Each connection's destination is checked against the rule list in order, top to bottom, and the first match decides the outcome: proxy, direct, or reject. Rule order equals priority - earlier rules override later ones of the same kind.
DOMAIN-SUFFIX RULE
A rule type matched by domain suffix. Writing DOMAIN-SUFFIX,example.com,PROXY matches the domain itself and all of its subdomains. It covers more ground than the exact-match DOMAIN rule and is the most commonly used type in custom rule sets.
IP-CIDR RULE
A rule type matched by IP range using CIDR notation, e.g. IP-CIDR,192.168.0.0/16,DIRECT. If the target is a domain name, it must be resolved first, which can add latency - by convention, IP-based rules are placed after domain-based rules.
GEOIP RULE
A rule type that matches a destination address's country or region against a geo-IP database. GEOIP,CN,DIRECT is the most common fallback, routing traffic resolved to mainland China addresses directly. Accuracy depends on the geo database version shipped with the core.
PROXY GROUP
A container that organizes multiple nodes under a shared strategy. Rules usually point to a proxy group rather than a single node, and the group's own logic decides which node actually gets used. Common types: select (manual), url-test (auto-picks the fastest), and fallback (failover).
MIHOMO (CLASH META)
An open-source core continued from the Clash Meta project, handling protocol implementation, rule matching, and traffic forwarding. GUI clients such as Clash Verge are essentially a front end built on top of it. Compared with earlier Clash cores, it adds support for protocols like VLESS and Hysteria2.
YAML CONFIG
The configuration format read by the Clash core, using indentation to express hierarchy. The file includes sections such as ports, DNS, nodes (proxies), proxy groups, and rules. Indentation must use spaces and be consistently aligned - a single mistake causes the whole file to fail to load.
SUBSCRIPTION
A configuration distribution URL provided by a service. The client fetches this URL on a set interval to update its node list and rules; the response headers usually include data usage and expiration date. Treat a subscription link like an account credential - don't share it publicly. See the tutorial page for import steps.
NODE / PROXY
A single proxy server entry in the config file's proxies section, containing the server address, port, protocol type, and credentials. Nodes are the actual traffic exit points; proxy groups and rules are just the scheduling layer that decides which node to use.
PROXY / RULE PROVIDER
A mechanism for external resources. Node lists (proxy-provider) or rule lists (rule-provider) are split into separate files that the core fetches and refreshes on an interval. The benefit is that subscription nodes stay separate from hand-written rules, so updating a subscription won't overwrite custom rules.
DNS LEAK
A situation where the proxy is enabled but domain resolution requests still go straight to the local ISP's DNS. The result is that the target site gets logged along the resolution path, and the returned result may not suit the proxy link anyway. Fixes: enable DNS takeover in the core, or use TUN mode.
FAKE-IP MODE
A DNS response mode built into the core. Domain queries are answered with a virtual IP from a reserved range (198.18.0.0/16 by default), creating a mapping between domain and connection. Benefits: no resolution wait, more accurate domain-based routing; a few apps that require a real IP need to be added to an exclusion list.
LATENCY / RTT
The time from when the client sends a request to a test address to when it receives a response, in milliseconds. Lower numbers mean more responsive interaction, but latency only reflects round-trip speed - not bandwidth. Latency for the same node fluctuates over time, so treat it as a rough indicator rather than a single fixed number.
UDP RELAY
A proxy link's ability to forward UDP packets. Voice calls, online games, and QUIC-based access all depend on UDP. It requires support from both the protocol and the server - if a node doesn't support UDP, these use cases show up as stutter or outright failure.
TUN MODE
A mode that creates a virtual network adapter and intercepts all traffic on the machine at the network layer. Command-line tools and some games that ignore system proxy settings only get proxied under TUN mode. Enabling it requires administrator or root privileges - see the blog's TUN mode explainer for details.
SYSTEM PROXY
A mechanism that registers an HTTP/SOCKS proxy address with the operating system. Apps that respect system settings, like browsers, automatically route through Clash via this address; apps that don't respect it are unaffected. It covers less ground than TUN mode but needs no special privileges - the default takeover method on desktop.
MIXED PORT
A single listening port that accepts both HTTP and SOCKS5 connections, configured as mixed-port, usually defaulting to 7890. To set a proxy manually for a specific app, just point it to 127.0.0.1 on that port. If the port is already in use, the core will fail to start.
URL TEST
A client feature that batch-probes nodes with HTTP requests and records their response times. The test URL and timeout threshold can be adjusted in settings; nodes that time out are marked unavailable. Results help with manual node selection and also drive url-test proxy groups to auto-switch to the fastest node.
This page only covers "what it means." For step-by-step setup, see the configuration tutorial; for error messages and troubleshooting, see the FAQ; if you haven't installed a client yet, get one on the download page for your platform.