Configuration Reference / Glossary
Terms for cores, protocols, rules and subscriptions. Look up settings by task and distinguish UI options from connection parameters and their actual effects.
For first-time setup, start with the user guide. To compare protocols and core features, see the protocol reference. Copy a link from any term heading below to jump straight to its explanation.
CORE / CLIENT
First identify what handles the connection, then determine which layer a setting affects. A client name and a core name are not interchangeable.
Proxy core
A proxy core descended from the Clash Meta project, responsible for connection handling, rule matching, DNS and protocol implementations. GUI clients use it through configuration files and control interfaces; the window layout is not a core feature. To check whether a field is supported, consult the documentation for the running core version rather than relying on the client name.
Historical project name
The former name of the mihomo project, still used by some clients, subscription notes and older tutorials. A Meta configuration usually means Clash-style YAML that uses extensions from this core family, not a separate file format. Original cores may not recognize newer protocols or fields, so check compatibility when migrating.
Graphical user interface · GUI
An app with interfaces for importing subscriptions, choosing policies, changing system settings and viewing logs, such as Clash Verge Rev. The client translates user actions into core configuration and may also manage service permissions, startup tasks and configuration overrides. A UI option does not guarantee that the operating system, core version or permissions support it.
System proxy
Points the operating system's proxy settings to a local listening address on the client, so apps that honor those settings send requests to the core. It is not a gateway for all system traffic; some command-line tools, games and standalone network apps may ignore system proxy settings. If an app bypasses the proxy, first check its proxy support, then consider configuring it separately or routing it through TUN.
Virtual network interface
A mode that receives IP packets through a virtual network interface and lets the core handle connections and routing. It can cover some apps that ignore system proxy settings, but actual coverage still depends on routes, exclusions, permissions and DNS settings. After enabling it, check the service status and connection paths; an enabled toggle alone does not confirm that traffic is reaching the core.
TRANSPORT / AUTHENTICATION
A protocol defines how the client and server communicate. The address, authentication, transport and security layers must work together; a protocol name alone says nothing about speed.
Shadowsocks · SS
An encrypted proxy protocol commonly abbreviated as SS. Configuration typically includes the server address, port, encryption method and password. The client and server must use compatible methods; the name Shadowsocks alone does not guarantee that arbitrary parameters will work together. If the provider requires an additional plugin or a specific protocol version, check that the core supports it.
VMess protocol
A proxy protocol from the V2Ray ecosystem that uses a UUID and other parameters to identify users. A significantly incorrect system clock can also affect authentication. VMess is the protocol; WebSocket and similar options are transports, not substitutes for the protocol. If a connection fails during the handshake, check the identity parameters, transport path, TLS settings and device clock separately.
VLESS protocol
A lightweight proxy protocol from the V2Ray ecosystem that does not encrypt payloads on its own. Deployments typically pair it with a security layer such as TLS or REALITY. The UUID is only part of the configuration; the transport, server name and security parameters must also match. Support for one transport or security layer does not mean every VLESS configuration will work.
TLS-based proxy protocol
A proxy protocol that typically uses TLS to protect connections and a password for authentication. To troubleshoot a connection, check the server address, password, server name and certificate trust separately; the port number alone cannot confirm that the configuration is correct. For certificate errors, first check the domain, system clock and certificate chain. Disabling certificate verification should not be a routine fix.
QUIC-based proxy protocol
A QUIC-based proxy protocol that relies on UDP. Suitability depends on UDP support on the network, packet loss and server configuration. The configured bandwidth affects transport behavior; it does not guarantee download speed. If the network restricts UDP, a connection may fail even with correct credentials. First distinguish network-path issues from parameter errors.
QUIC-based proxy protocol
A QUIC-based proxy protocol with connection multiplexing and UDP forwarding. Authentication fields and implementation details can vary between protocol versions, so import the full parameters provided by the server rather than just changing the protocol name. Mobile battery use also depends on connection activity, network switching and app behavior; the protocol name alone cannot determine it.
RULES / POLICY
Rules select a policy; proxy groups select an exit. Understanding how these layers work together helps identify which connections will change when you switch proxies.
Rule-based routing
In rule mode, the destination domain, IP address or other conditions determine which policy handles a connection. Rules are checked from top to bottom and usually stop at the first match, so specific exceptions should come before broad rules. For example, DOMAIN-SUFFIX,github.com,Proxy sends matching domains to the policy named Proxy, provided that policy exists in the configuration.
Proxy group
A collection of proxies, other proxy groups or built-in policies that rules can target. select lets you choose manually, url-test selects based on test results, and fallback uses availability and configuration order. Switching a group option usually affects new connections; existing long-lived connections may keep using their previous exit. Whether old connections are closed depends on the client.
Proxy endpoint
A common client term for a set of proxy server connection parameters, usually including the address, port, protocol and authentication details. The display name is just a label; it does not prove the server location, connection quality or suitability. A proxy passing a test does not mean every request will use it. The actual exit depends on the current mode, matched rule and selected proxy group.
IP geolocation matching
A rule type that matches destination addresses against country or region codes using an IP database, for example GEOIP,CN,DIRECT. Results depend on the database and do not indicate a company's country of registration or a user's location. When the destination starts as a domain, matching may involve DNS resolution. A rule with no-resolve avoids triggering a resolution just to match the rule.
Final catch-all rule
A catch-all rule with no matching condition, used for connections not matched earlier, such as MATCH,Proxy. It usually belongs at the end of the rules list; if placed earlier, later rules cannot match the remaining connections. The fallback target can be a proxy group or built-in policy; its meaning depends on the name used in the configuration.
URL latency test
A test that sends a request through a proxy to a specified test URL and records the elapsed time; it usually does not send an ICMP ping directly to the server. Results depend on the test URL, connection reuse, DNS and current network conditions, and do not measure file download speed. A successful test only confirms that the tested path worked at that moment; it does not guarantee the same result for other websites, UDP apps or later connections.
DNS / NETWORK STACK
DNS resolution and connection routing are related but distinct processes. When troubleshooting, check the system, browser and core—not just one toggle.
Domain Name System
The system that resolves domain names to IP addresses and other records, typically before a network connection is established. DNS handled by the core, the operating system resolver and a browser's secure DNS may use different paths, so configuring a DNS server in the core does not automatically control every app's queries. If a domain fails to load but its IP address works, check the DNS response, cache and logs to narrow down the issue.
Synthetic IP mapping
A DNS mode that returns virtual addresses for domain names and stores the domain-to-address mapping in the core. When a connection reaches the core, the mapping can identify the original domain; the virtual address is not the website's real server address. If an app depends on real DNS results, add a compatibility exception with fake-ip-filter and verify the entry against the actual issue.
DNS leak
A DNS leak occurs when DNS queries reach a resolver outside the expected path. First define the intended DNS policy to determine whether a path is unexpected. Check system DNS, browser secure DNS, IPv6, traffic-capture settings and actual query records. The resolver location shown by a test website is only a clue, not a definitive result; direct DNS resolution may also be intentional.
Domain sniffing
The ability to recover a destination domain from connection metadata such as HTTP Host or TLS SNI, allowing connections that initially contain only an IP address to match domain rules. This does not decrypt HTTPS traffic, and a domain may not be available for every protocol or encryption method. Whether to enable it and which traffic it covers depends on the DNS mode, configuration scope and compatibility requirements.
SUBSCRIPTION / CONFIGURATION
A complete configuration, a proxy collection and a rule collection are different kinds of input. Check the file structure before importing, then review the effective configuration after an update.
Subscription
A remote source for retrieving proxies or a complete configuration. Different sources may return different structures, so a URL suffix alone cannot tell you whether the content is compatible. Subscription URLs may contain access credentials; avoid sharing them in screenshots, logs or support requests. Updates may replace the original file, so manage custom rules you want to keep through the override features supported by the client rather than editing a local copy of the remote file.
YAML configuration format
A text format for representing configuration hierarchies, lists and key-value pairs. Clash-style configurations commonly use the .yaml or .yml extension. Indent with spaces and keep indentation consistent at the same level; quote strings that contain special characters when needed. A successful parse only confirms that the format is valid. The core still needs to check whether fields are supported and referenced policies exist.
Rule providers
A configuration entry that defines an external rule-set source, with options such as the update interval, content format and matching behavior. After defining the source, reference it from rules with RULE-SET; downloading a rule-set does not automatically add it to routing. Its format must match behavior, and its priority depends on its position in the main rules list.
Proxy providers
A configuration entry for importing and managing a collection of proxy nodes, including its source, update interval and health checks. Proxy groups usually reference the collection with use. This manages where proxies come from, unlike listing them directly under proxies. A proxy provider alone is not a complete client configuration; proxy groups, rules and other settings are usually needed.
Configuration override
A client-side process that merges, appends or changes fields in the original configuration, often to preserve personal rules, DNS settings or listener options. Clients differ in how they replace lists, prepend rules and merge fields, so an override snippet alone does not show the final result. Check the effective configuration after editing and validate it again after subscription updates to catch field conflicts or changes in rule order.