Quick Reference
Look up concepts by configuration field and understand differences through network behavior. Explore common terms for cores, protocols, routing, and subscriptions across five topics.
Runtime Components
The interface, processing engine, and proxy outbound are separate components. When troubleshooting, first identify which layer is failing.
mihomo is a proxy core developed as the continuation of the Clash Meta project. It handles protocol connections, rule matching, DNS, and other network tasks. The core can run independently or be called by a GUI client, so the client and core names may differ. To check whether a configuration option is available, look at the core actually running and the features it supports—not just whether the app name includes Clash.
A GUI client brings operations such as importing subscriptions, choosing policies, and viewing logs into a visual interface. It may also manage system proxy settings and services. The same core can work with different clients, which may use different menu labels and configuration storage methods. Before switching clients, check supported operating systems, core types, and configuration migration options.
Compare clients ›A node usually refers to one proxy outbound in a configuration, including its protocol, server address, port, and authentication parameters. A node name is just a label for identification; it does not prove the server location, connection quality, or protocol capabilities. One server can provide multiple outbound configurations, so assess nodes using connection logs and how they perform in your apps.
A client latency test usually connects to a test URL through a specified proxy and records the time taken; it is not necessarily an ICMP ping. Results depend on the test target, DNS, connection setup, and current network conditions, and cannot be directly translated into download speed. A timeout does not necessarily mean every website is unreachable. Check whether the test URL is accessible and review the relevant connection logs.
This management interface lets a client or dashboard interact with the core and typically listens at the address configured with external-controller. It can be used to inspect connections, switch policies, and check runtime status, but it is not a proxy port for apps to access the internet. Limit access to what is necessary. For remote management, configure authentication and review your firewall rules.
Outbound Connections
A protocol describes how communication works; it does not determine a speed ranking. Server implementation, network path, and device resources also affect performance.
Shadowsocks is an encrypted proxy protocol, typically represented as ss in configuration. The client and server must use matching encryption methods and authentication details. Protocol extensions or plugins may require additional parameters. It is not the same as the SOCKS proxy endpoint used by apps, so similarly named settings are not interchangeable.
VMess and VLESS are two distinct protocols in the V2Ray ecosystem, not two ways to write the same configuration type. VLESS does not encrypt data by itself; TLS, REALITY, or other mechanisms determine the connection's security properties. When importing a configuration, also check the transport, server name, and authentication parameters. Changing only type does not convert one protocol to another.
Trojan typically uses TLS to establish a proxy connection. The password, server address, and TLS parameters must match. If certificate verification fails, check the server name, device clock, and certificate chain rather than disabling verification. Nodes with the same name may use different transport settings; a connection works only when both ends are configured consistently.
Hysteria2 is based on QUIC and relies on UDP connectivity, with different trade-offs from traditional TCP transport when there is packet loss or an unstable network path. It is not guaranteed to be faster on every network, and bandwidth and congestion-control settings also affect performance. If your network restricts UDP, check connectivity first instead of repeatedly changing DNS or rules.
TUIC is also based on QUIC and can proxy TCP and UDP traffic, but its authentication, configuration, and implementation details differ from Hysteria2. The client and server must support compatible TUIC protocol versions. On mobile devices, consider persistent connections, network switching, and background activity when assessing resource use; the protocol name alone does not tell you how much battery it will use.
Explore protocol trade-offs ›Matching and Policies
Rules match connections; proxy groups organize outbounds. When checking connection details, consider both together.
In rule mode, the core checks connections against domain, address, and other conditions in configuration order. The first matching rule usually determines the outbound policy, so a broad rule near the top can override a more specific one below it. After adding custom Clash rules, check the matched rule in connection details and confirm the final fallback rule points to the intended policy.
Learn how rules work ›Proxy groups combine nodes or other groups into a logical outbound that rules can reference. select is typically for manual selection, url-test selects based on test results, and fallback prioritizes availability and switches through options in order. The group name alone does not determine its behavior. When troubleshooting, expand the group references to see which node is ultimately being used.
GeoIP matches by IP classification, while GeoSite matches against domain sets; they rely on different data and match different targets. A location category in the data does not necessarily reflect a service's current physical location, and outdated data can produce mismatches. If a rule matches unexpectedly, check the domain's resolved address, the data source, and rule order—not just the selected node.
Rule providers are defined by rule-providers and referenced in the rule list with RULE-SET, allowing a set of matching conditions to be maintained separately. A rule set usually does not choose a node; the rule that references it specifies the final policy. Check that the data format and behavior type are compatible, and whether a failed remote update has left outdated data in use.
Rule mode assigns outbounds according to the rule list. Global mode primarily uses the GLOBAL proxy group, while Direct mode sends connections entering the core straight to their destinations. Global mode does not mean all system traffic is being captured; coverage still depends on the system proxy, TUN, and app behavior. After switching modes, test with new connections, since existing ones may continue using their original route.
Traffic Capture and DNS Resolution
Capturing connections and resolving domains are related but distinct paths. A mode toggle is no substitute for checking what actually happens on the network.
TUN mode uses a virtual network interface to capture IP packets, which can cover some apps that ignore system proxy settings. Enabling it typically requires administrator permissions, a service component, or system VPN authorization, along with routing and DNS configuration. It does not force traffic through a particular proxy node: captured connections still follow the current mode and rules, and routes may conflict with another VPN.
System proxy settings register a proxy address and port with the operating system so apps that support them can send connections through the client. Some apps use their own network settings and may not follow the system proxy, so a working browser does not mean every app is covered. If internet access still fails after closing or uninstalling the client, check for a leftover system proxy pointing to a local port that is no longer listening.
Fake-IP returns virtual addresses for domains and stores the domain-to-address mapping in the core, making it easier to apply domain-based handling to captured connections. These are not the destination servers' real addresses, so using them for external geolocation is meaningless. Some apps that depend on real DNS results may need to be added to fake-ip-filter. You may also need to clear the relevant DNS cache after making changes.
redir-host returns real resolved addresses to apps, unlike Fake-IP, which returns virtual addresses. Whether domain rules match correctly can also depend on the domain mappings available to the core and on sniffing. Switching DNS enhanced modes is not a universal fix: first identify whether the problem is with resolution, connection capture, or rule matching, then check the cache and resolution path.
A DNS leak usually means domain queries are taking an unexpected resolution path—for example, traffic goes through a proxy while DNS queries still use an unintended system resolver. Check browser encrypted DNS, system DNS, IPv6, and the scope of the client's DNS capture. A test page identifying a DNS provider does not by itself prove a leak; compare the result with your intended setup and the actual query path.
Configuration Sources and Maintenance
Remote content, local files, and client overrides each have their own scope. Before making changes, confirm which configuration is currently loaded.
A Profile is a configuration managed by the client and loaded by the core. It typically includes nodes, proxy groups, rules, DNS settings, and listening ports. A client can store multiple Profiles, but usually only one is selected as the active configuration source. A successful import does not mean the Profile is active; check the selected Profile, core load status, and connection logs.
A subscription URL retrieves remote configuration or node data. The response may be a complete YAML file or just a list of nodes, so use the appropriate import method. Updating a subscription only fetches its content; it does not establish a proxy connection. Subscription URLs often contain credentials, so avoid sharing them in public screenshots. If a Clash subscription update fails, distinguish an expired URL from a request failure or a format parsing error.
Browse subscription FAQs ›YAML is a structured text format commonly used for Clash configurations, representing hierarchy with indentation, key-value pairs, and lists. Use spaces rather than tabs for indentation; special characters in strings may also need quotes. Valid syntax does not guarantee that the current core supports every field, so check the load logs after saving instead of relying on the editor to catch every issue.
Proxy providers define independently updateable node sources with proxy-providers, which proxy groups can then reference. This separates node maintenance from rule maintenance. Unlike a complete Profile, a proxy provider typically does not supply the full DNS or routing configuration. Before importing, confirm the format of the remote content; not every subscription URL can be pasted in and used as is.
Overrides and merging let you keep local changes alongside a remote configuration, such as adding rules or changing DNS, without losing them when the subscription updates. These features are usually implemented by the client, and apps may handle field precedence, list additions, and replacements differently. After making changes, inspect the final configuration passed to the core, not just the override editor, and keep a copy of the original configuration for recovery.