Clash Wiki · Basic Reference

Common Clash Terms and Configuration Concepts

From the mihomo core, nodes, and protocols to rule-based routing, subscriptions, TUN, and Fake-IP, this guide explains each concept by use case. When a client setting or configuration field is unclear, start here, then follow a tutorial to complete the task.

mihomo TUN mode Fake-IP Rule-Based Routing Subscription

Category 01

Core and Clients

Distinguishing the core that processes network traffic from the client that provides the interface helps identify whether a problem lies in the configuration, UI, or underlying process.

Clash: Clash is an ecosystem of proxy tools built around rule-based routing and policy groups. In practice, the core reads the configuration and handles network connections, while a graphical client manages subscriptions, node selection, and controls. Clients may use different interfaces, but their core concepts are broadly similar.
mihomo: mihomo is an actively maintained Clash Meta core that supports rule-based routing, TUN, enhanced DNS, and multiple proxy protocols. It can be called by a desktop client or run directly on a Linux server, router, or transparent gateway. If the client interface looks normal but the proxy does not work, core startup messages in the logs are an important troubleshooting entry point.
Core: The core reads configuration, establishes proxy connections, matches rules, handles DNS, and forwards traffic. The graphical interface and core usually operate at different layers: the interface issues commands, while the core executes them. A port conflict, invalid configuration syntax, or insufficient permissions can leave the interface open while the core fails to run.
Graphical Client: A graphical client provides a visual management interface for the core. Common features include importing subscriptions, switching configurations, selecting policy groups, viewing connection records, and controlling the system proxy. It is not the proxy service itself and cannot create usable nodes by itself. When choosing a client, check operating-system support, core type, and required features.
Clash Plus: Clash Plus is one of the Clash graphical clients available across several common platforms. After installation, its interface can manage subscriptions, policy groups, the system proxy, and TUN mode, making it suitable for users who want a similar workflow across devices. Visit the client downloads page to find the appropriate installation entry for each platform.

Category 02

Protocols and Transport

The protocol determines how the client communicates with a remote service, while the transport layer affects connection reliability, responsiveness, and application compatibility.

Proxy Protocol: A proxy protocol defines the communication rules used to establish a connection between a client and a remote server. Different protocols use different authentication fields, encryption methods, and transport parameters, so the client and server settings must match. The same protocol name does not mean every optional setting is interchangeable; after importing a configuration, rely on parsing results and connection logs.
Proxy Node: A node is a selectable proxy server connection entry in a configuration, usually containing a server address, port, protocol, and authentication parameters. Its name is only an identification label and does not directly determine connection quality. A subscription can contain multiple nodes, with a policy group handling manual selection, automatic testing, or failover.
Latency: Latency is the time between sending a probe from the local device and receiving a response, usually measured in milliseconds. Lower latency often means faster interactive response, but does not by itself indicate download bandwidth, congestion, or long-term stability. Client speed-test results also depend on the test address, current network, and node load.
TCP: TCP is a network transport protocol designed for reliable, ordered delivery. Web browsing, file transfers, and most connections requiring complete data typically use TCP, with lost packets retransmitted as needed. Connection timeouts, handshake failures, and resets in proxy configurations are often related to the TCP path or remote service status.
UDP: UDP transmits datagrams without first establishing a reliable connection, keeping overhead low. Real-time audio and video, games, some DNS queries, and newer network protocols may use UDP. If the node or client lacks the required support, webpages may work while game voice chat or certain apps fail to connect properly.

Category 03

Rules and Policies

Rules determine what kind of traffic a connection represents; policies decide whether it ultimately uses a proxy, a direct connection, or a specific node.

Rule-Based Routing: Rule-based routing directs traffic according to conditions such as domain, IP address, port, process, or other criteria. Rules are usually checked from top to bottom, and the first match determines the handling policy, making order as important as rule content. Before adding a custom Clash rule, make sure a broader rule higher in the list will not match it first.
Rule Mode: Rule mode makes the client process connections according to the configured rule list. Common outcomes include sending traffic to a policy group, connecting directly, or rejecting the connection, making it suitable for fine-grained routing of sites and apps. Traffic not covered by earlier rules usually falls through to the final catch-all rule.
Global Mode: Global mode sends all traffic entering the client through a specified proxy policy instead of applying ordinary rules one by one. It is useful for temporarily testing whether a node works or determining whether rule matching is the cause of a problem. Switch back to rule mode after testing so every connection does not use the same exit.
Direct Connection: A direct connection sends traffic to the destination through the current network without passing through a remote proxy server. Configuration files and policy groups usually use DIRECT to represent this handling method. Success still depends on the local network, DNS resolution, and the destination service.
Policy Group: A policy group combines multiple nodes or other policies into a logical exit that rules can reference. Common types include manual selection, automatic testing, failover, and load balancing, each with different selection logic. Node changes are usually made within the policy group rather than by editing every rule directly.
GeoIP: GeoIP is a data set that matches rules according to IP address ownership information and can send traffic from a particular region to the corresponding policy. Its database needs regular updates, and ownership can change as addresses are reassigned. It is useful for routing decisions but does not represent a device’s exact geographic location.

Category 04

Configuration and Subscriptions

Configuration files describe how the client operates, while subscriptions and Providers update some or all of that content from remote sources.

Subscription: A subscription is a remote configuration endpoint published and periodically updated by a service provider. After reading it, the client may receive a node list or a complete configuration containing DNS, policy groups, and rules. A successful import does not guarantee a working connection; after updating, check the configuration status, policy-group selection, and core logs.
YAML: YAML is the structured text format commonly used for Clash configuration files, using indentation to express field hierarchy. Spaces after colons, list hyphens, and indentation at the same level all affect parsing; Tab characters can also cause formatting errors. After editing manually, use the client’s configuration checker before reloading the core.
Configuration File: A configuration file stores settings such as ports, operating mode, DNS, nodes, policy groups, and rules. When starting or switching configurations, the client has the core read and validate these fields; structural errors can prevent the core from starting. For the full structure, see the complete configuration reference.
Provider: Provider is a configuration mechanism that loads node collections, rule sets, and similar content from separate files or remote URLs. proxy-providers is commonly used to maintain node sources, while rule-providers loads rule sets. Splitting these sources allows separate update intervals without replacing the entire main configuration.
Override: An override appends, replaces, or adjusts selected fields alongside the original subscription configuration. It is commonly used to preserve local DNS, ports, custom rules, or policy-group settings while continuing to receive subscription updates. Before editing, check whether the client merges, prepends, or directly replaces values to avoid duplicate fields or changed rule order.

Category 05

Networking Basics

The system proxy, virtual network interface, DNS, and local listening ports together determine whether traffic enters the client and how it is identified and forwarded.

TUN Mode: TUN mode captures system traffic at the IP layer through a virtual network interface, usually covering more traffic than the system proxy. It can handle apps that ignore system proxy settings and is often used to capture UDP traffic, but typically requires extra permissions and correct routing. If enabling it breaks connectivity, check permissions, DNS, route conflicts, and other network tools.
System Proxy: The system proxy is the proxy address and port exposed by the operating system for apps to read. Browsers and most desktop apps that follow system network settings use it, but some games, command-line programs, and software with its own networking stack may ignore it. For broader coverage, evaluate TUN mode based on the operating system.
DNS: DNS converts domain names into reachable IP addresses and is a basic step before visiting a website. Clash can take over, forward, or enhance DNS queries so results stay aligned with domain rules. An unreachable resolver, bad cache, or conflicting settings can make a domain inaccessible even when the node itself works.
DNS Leak: A DNS leak occurs when an app’s domain lookup bypasses the intended resolution path and is sent directly to another DNS server. This can make DNS results inconsistent with proxy rules, causing connection failures or unexpected routing. Troubleshooting should check system DNS, browser Secure DNS, TUN settings, and client logs rather than changing only one server address.
Fake-IP: Fake-IP is a DNS enhancement mode that first returns a mapped address from a reserved pool for a domain. When the core receives a connection to that address, it restores the original domain from the mapping for more accurate domain-rule matching. For LAN devices, special apps, or incompatible domains, a filter list can preserve real resolution.
Proxy Port: A proxy port is the local listening endpoint used by apps to send requests to the client. HTTP, SOCKS, and mixed-port accept traffic differently; a mixed port can usually accept both HTTP and SOCKS requests on the same port. If another program already uses the port, the core may fail to start or bind successfully.