GLOSSARY · Term Reference
Fields in config files, toggles in the client interface, terms in tutorials—all explained on this single page. Every entry is grouped into one of five categories, with 2–4 sentences each, so you can read one and jump straight back to whatever step you're on; every entry has an anchor you can link directly to.
The protocols nodes and servers use to transfer data. Every node in a subscription is tagged with a protocol type, which determines encryption method, disguise capability, and which core you'll need to connect.
A lightweight proxy protocol based on symmetric encryption, dating from 2012, where client and server agree on a password and cipher and then forward traffic directly. Few config fields, low transfer overhead, and still one of the most common protocols found in subscriptions today. Clash-family cores support it natively, including AEAD ciphers and plugin forms like obfs and v2ray-plugin.
A protocol designed by the V2Ray project that relies on a UUID for user authentication, by default requiring the client and server clocks to stay within 90 seconds of each other. In practice it's often paired with WebSocket and TLS for extra disguise. Too large a time offset causes handshake failures, so check the system clock first if a node won't connect.
A protocol that disguises proxy traffic as standard HTTPS access and must be paired with a valid TLS certificate. When the server listens on port 443, the traffic looks identical to visiting an ordinary website, making it hard to identify. Trojan nodes in a Clash config typically include two key fields: password and sni.
A newer-generation protocol built on QUIC (UDP) with built-in congestion control, offering better throughput than TCP-based protocols on high-packet-loss links. Supported by the mihomo core but not the older Premium core. If a subscription includes this type of node, you'll need a client with mihomo built in to connect properly.
A generic session-layer proxy protocol, unencrypted by itself, supporting both TCP and UDP. Once Clash starts, it opens a SOCKS5 inbound port locally so software like browsers can hand traffic off to the client. It mainly serves as the local entry point—raw SOCKS5 nodes are rarely seen in subscriptions.
The core handles protocol implementation and rule matching; the client wraps the core into something you can actually operate. Distinguishing these two layers explains many "why does the same subscription behave differently in different apps" situations.
The core of the Clash Meta project, a community continuation after the original Clash core stopped being maintained. It runs as an executable, handling protocol implementation, rule matching, and traffic forwarding. It supports VLESS, Hysteria2, TUN, and other capabilities the original core lacked. Most mainstream GUI clients today (Clash Verge Rev, FlClash, and others) bundle it.
The closed-source enhanced core released by the original author, offering features like TUN and Script that the open-source core lacked; distribution stopped along with the original repository in 2023. Existing clients have largely migrated to mihomo. When reading older tutorials, watch for Premium-exclusive fields that may not carry over to mihomo.
The graphical shell built on top of a core, handling day-to-day tasks like subscription management, node selection, and toggling the system proxy—turning a command-line core into clickable software. Clash Plus, Clash Verge Rev, and FlClash all fall into this category. When choosing a client, check whether its bundled core version matches what your subscription requires.
An HTTP API the core exposes locally, configured via the external-controller field and commonly running on port 9090. Graphical panels use it to read node latency, switch proxy groups, and view active connections. If another program occupies that port, the panel may show blank or fail to connect—just change to an unused port in the config.
The concepts that show up most often in config.yaml. Understanding rule-matching order and how traffic gets taken over is the line between "it works" and "it routes as expected."
The data format used by Clash config files, relying on indentation to express hierarchy and extremely strict about whitespace. Mixing tabs into indentation and missing a space after a colon are the two most common causes of config errors. Edit configs in a monospace-font editor with whitespace characters shown, and validate the config in the client before applying changes.
The match list in a config file's rules section, matching every connection to a designated outbound—a node, a proxy group, or DIRECT/REJECT—in top-to-bottom order. Common rule types include DOMAIN-SUFFIX, IP-CIDR, and GEOIP, with a final MATCH line catching everything else. Reversed order is the most common cause of routing failures.
A unit that organizes multiple nodes into a single selectable option, with rules pointing to the group rather than a specific node, so switching nodes doesn't require touching the rules. Types include manual select, auto-testing url-test, failover fallback, and load-balance, mixed and matched as needed. Proxy groups can also nest inside one another to form a multi-level selection structure.
Two built-in matching databases: GeoIP matches by IP location, with a typical rule looking like GEOIP,CN,DIRECT; GEOSITE matches by domain category list. These database files update separately from the core itself, and letting them go stale leads to inaccurate routing decisions. Most clients offer a one-click database update in settings—try that before digging into rules when routing misbehaves.
A DNS handling mode: the core first returns a fake IP from a reserved range (198.18.0.0/16 by default) for a domain lookup, then applies domain-based rules once the app actually connects. This eliminates DNS resolution delay and prevents lookup results from being used to bypass routing. It's a good idea to flush the system DNS cache once after switching this mode.
A way of taking over all system network traffic through a virtual network adapter, independent of whether an app respects the system proxy setting—it can cover command-line tools, games, and other traffic that would otherwise bypass the proxy. Enabling it requires admin permissions or system authorization. Use either TUN mode or the system proxy, not both—running them together offers no added benefit.
The OS-level HTTP/SOCKS proxy setting. Once the client turns this toggle on, apps that respect it (mainly browsers) hand their traffic off to Clash's local port. Some software ignores the system proxy setting entirely, in which case you'll need TUN mode instead, or set the proxy address and port directly inside that software.
A subscription is where node info comes from; a node is the actual traffic exit point. Importing, updating, testing latency, and converting formats make up the group of concepts you'll deal with most in daily use.
An HTTPS link provided by a service that returns a full config or node list, including nodes and rules, which the client pulls periodically to stay current. A subscription link acts like an account credential—anyone who has it can consume your traffic quota, so don't paste it in public. Self-check steps for failed imports are covered in a related article on this site.
A single server entry in the config's proxies section, containing protocol type, address, port, and auth info. The node name is assigned by the subscription provider, usually noting region and traffic multiplier. The millisecond figure shown next to a node in the client is the time for a single HTTP handshake from this machine to that node—not a bandwidth measurement.
The client sends a single HTTP request to a node (often against a test URL like generate_204) and records how long it takes, in milliseconds. The number reflects reachability and response speed—a low number doesn't mean fast downloads. A "timeout" means the node is currently unreachable, and it's exactly this test that url-test proxy groups rely on to auto-select an exit.
A service or tool that converts a subscription from one client format to another—for example, turning a generic node list into YAML that Clash can read. Using a third-party online converter means handing your subscription link to that server, which carries a leak risk. Prefer a client's built-in parsing capability, and only turn to a self-hosted conversion service if it's really needed.
A set of lower-level networking concepts directly relevant to Clash. When troubleshooting connection issues, the problem often sits at this layer rather than in the client itself.
A situation where the proxy is on, but domain lookups still go straight to the local ISP's DNS, exposing browsing intent and causing inaccurate routing decisions. Clash prevents this by taking over DNS: set enable: true in the config's dns section, paired with Fake-IP mode or a nameserver grouping. An online DNS-leak test page can confirm whether it's still leaking.
A listening mode where a single port accepts both HTTP and SOCKS5 inbound connections, configured via the mixed-port field, commonly defaulting to 7890. Whatever needs a proxy port—browser or system proxy—just uses this one, no need to distinguish protocols. If the port is taken by another program, switch to any free value and restart the client.
The proxy link's ability to carry UDP traffic, which voice calls, online games, and the QUIC protocol all depend on. It requires support from both the node protocol and the server side, commonly shown as a udp: true field in configs. A typical symptom of broken UDP is normal web browsing but abnormal game latency and voice connections that never establish.
The reserved IP pointing to the machine itself, namely 127.0.0.1. Clash's local inbound port listens on the loopback address by default, reachable only by programs on the same machine. To share the proxy with another device on the same LAN, enable allow-lan in the config and have that device use your machine's LAN IP instead of 127.0.0.1.
NEXT · Keep Reading
Once the terminology is clear, back to the practical side: step-by-step tutorials, per-platform install guides, and categorized Q&As covering everything from download to verifying that routing works.