Clash Glossary

NodeNode / Proxy Server

A remote proxy server listed in a subscription, with an address, port, protocol, and credentials. The client forwards traffic matched to the proxy outbound to whichever node is currently selected. A single subscription usually includes nodes from multiple regions, selectable manually or automatically by latency.

SubscriptionSubscription

A URL provided by a service that returns a node list and optional routing rules when accessed. Once imported, the client periodically pulls updates, so node changes don't need manual maintenance. The link itself acts as a credential and shouldn't be shared publicly.

LatencyLatency

The round-trip time, in milliseconds, for a test request the client sends to a node. Lower values mean faster response, but latency only reflects part of link responsiveness — it's not the same as download bandwidth. Most clients can auto-select nodes by latency.

Proxy ModeProxy Mode

A global switch that decides overall traffic routing, typically with three settings: Rule, Global, and Direct. Rule mode matches traffic against rules one by one; Global sends everything through the proxy; Direct sends everything without it. Rule mode is fine as the default for everyday use.

System ProxySystem Proxy

An HTTP/SOCKS proxy setting at the operating system level. Once enabled, apps that respect the system proxy send their traffic to the client's local listening port. Some apps ignore this setting, and that traffic needs TUN mode to be captured.

ShadowsocksSS

A lightweight encrypted proxy protocol, essentially a SOCKS5 variant with symmetric encryption. It has few config fields and low runtime overhead, and was one of the first protocols widely supported by Clash — often abbreviated as SS in subscriptions and docs.

VMessV2Ray Protocol

A transport protocol defined by the V2Ray project that authenticates users via UUID and supports various encryption and transport-layer combinations. In practice it's often paired with WebSocket and TLS.

TrojanTrojan-GFW

A protocol that disguises proxy traffic as standard HTTPS. It must run on top of TLS, so from the outside it looks like normal website traffic. Server-side setup depends on a valid certificate and domain.

Hysteria2QUIC-based Protocol

A QUIC-based (UDP) transport protocol with built-in congestion control, tuned for high-packet-loss, long-distance links. It requires core support for the protocol, which all mihomo-based cores already provide.

WebSocket Transportws / wss

A transport-layer wrapping method that packages proxy traffic as a WebSocket connection, making it easy to route through a CDN or reverse proxy. Config files commonly use ws or wss, with the latter meaning TLS is layered on top.

TLSTransport Layer Security

The encryption layer used by HTTPS. Once a proxy protocol is layered with TLS, outside observers can only see the encrypted handshake and ciphertext. Combinations like Trojan and VMess over WSS depend on it.

Rule-based RoutingRule-based Routing

A mechanism that assigns each connection to a different outbound based on conditions like domain, IP ownership, or process. Rules are matched top to bottom and matching stops at the first hit, with a MATCH rule at the end catching everything else. This is the core logic behind rule mode.

Proxy GroupProxy Group

Groups multiple nodes into a selectable set, with common types being manual selection (select), latency-based auto-testing (url-test), and failover (fallback). Rules usually point to a proxy group rather than a single node, so switching nodes doesn't require editing rules.

GeoIPIP Geolocation Rule

A rule type that matches based on the country or region an IP address belongs to, using a GeoIP database bundled with the core. A typical line reads GEOIP,CN,DIRECT — meaning traffic to mainland China IPs goes direct.

GEOSITEDomain Set Rule

A rule type that matches against pre-built sets of domains, with a database grouping large numbers of domains by site category. A single GEOSITE rule can cover hundreds or thousands of domains, significantly shrinking config size.

Outbound Three StatesDIRECT / PROXY / REJECT

DIRECT means connecting without a proxy, PROXY (or a proxy group name) means forwarding to a node, and REJECT means blocking the connection outright. Every rule ultimately resolves to one of these three outbounds, with REJECT commonly used to block ad domains.

YAMLConfig Format

The text format used by Clash config files, expressing hierarchy through indentation and sensitive to whitespace. Manual edits should keep consistent 2-space indentation — indentation errors cause parsing to fail outright and the core will refuse to load the file.

Base64 SubscriptionBase64 Subscription

A subscription format that returns a Base64-encoded list of node links, common among early clients. Clash-based clients need a YAML structure, so a Base64 subscription usually needs to go through subscription conversion first.

Subscription ConversionSubscription Conversion

A service or tool that converts one subscription format into another, most commonly a generic format into Clash YAML. The process reorganizes nodes and rules. Using a third-party online converter means your subscription link passes through that service, which is worth weighing carefully.

Fake-IPDNS Mode

A DNS handling mode where the client first returns a virtual IP from a reserved range, then matches rules by domain once the app initiates a connection. It skips a real DNS lookup, reducing first-connection latency and limiting how much DNS pollution affects routing accuracy.

DNS LeakDNS Leak

A situation where, even with the proxy on, domain resolution requests still go directly to the local ISP's DNS. A leak doesn't break connectivity, but it exposes which domains are being visited. Enabling TUN mode or letting the core handle DNS avoids it.

User-AgentUA (Subscription Fetch)

The client identifier sent in an HTTP request header. Some subscription servers return different content formats based on UA, or only allow specific UAs to fetch. If a subscription update fails, try changing the UA used for fetching in the client's settings.

CoreCore

The command-line program that actually handles traffic forwarding, rule matching, and protocol implementation — the GUI client is just its graphical shell. The core's version determines which protocols and config fields are supported, and the same config file can behave differently across cores.

mihomoFormerly Clash.Meta

The dominant Clash-family core today, maintained by the community as a continuation of Clash Meta. Compared with earlier cores, it adds support for newer protocols like Hysteria2 and TUIC. Clients such as Clash Verge Rev and FlClash bundle it by default.

TUN ModeTUN Mode

A method that captures all traffic at the network layer by creating a virtual network adapter, independent of whether an app respects the system proxy. Command-line tools and game clients often need it. Enabling it typically requires administrator rights or a system extension authorization.

Clash Verge RevGUI Client

A community-maintained cross-platform GUI client with mihomo built in, covering Windows, macOS, and Linux. It's one of the common desktop replacements since Clash for Windows was discontinued, supporting TUN mode and scheduled subscription updates.

GUI ClientGraphical Client

An application that provides a graphical interface for the core, handling day-to-day tasks like subscription management, node switching, and toggling the system proxy. Different GUIs vary in interface and platform coverage, but the underlying core capabilities are largely the same — choosing one mostly comes down to platform and habits.