Clash Glossary

One of the earliest lightweight encrypted proxy protocols, essentially a SOCKS5 variant with symmetric encryption added. Simple protocol structure, low handshake overhead, and decent battery performance on mobile. Supported natively by nearly every Clash-family client and core, commonly abbreviated as SS.

An encrypted transport protocol designed by the V2Ray project, with UUID-based user authentication and timestamp verification built in. It's sensitive to system clock drift — a local time offset of more than roughly 90 seconds causes an immediate handshake failure, one of the most common reasons "all nodes time out." Typically paired with a transport layer like WebSocket or TLS.

A protocol designed to look exactly like ordinary HTTPS traffic, relying on a real TLS certificate for its handshake. Its traffic pattern closely resembles standard website access, with few configuration options and few points of failure. The server needs a valid domain and certificate, which is why node configs always include an SNI field.

A streamlined successor to VMess: it removes the protocol's built-in encryption layer entirely and leaves encryption to an outer TLS layer, avoiding the performance cost of double encryption. Often paired with newer transports like Reality. The original Clash core doesn't recognize these nodes — a mihomo-family core is required.

A proxy protocol built on QUIC (UDP) with a custom congestion control algorithm, delivering strong throughput on high-loss, long-distance links. Because it runs over UDP, it may be completely blocked on networks that restrict UDP, such as some campus networks. Only supported by newer cores like mihomo.

Another QUIC-based proxy protocol, focused on 0-RTT handshakes and native UDP forwarding — well suited to scenarios sensitive to connection setup time. Like Hysteria2, it's a newer-generation protocol; confirm your client is running a mihomo-family core before importing a subscription with TUIC nodes.

The original core program of the Clash ecosystem, which established the config.yaml format and rule-based routing model still used today. Its upstream repository is archived and no longer updated, and it doesn't support newer protocols like VLESS or Hysteria2. Most existing clients have already migrated to the mihomo core.

The actively maintained core that carries on the Clash Meta project, and today's de facto standard. It stays backward compatible with the original config format while adding new protocol support, the GEOSITE domain database, and a more complete TUN implementation. Mainstream clients like Clash Verge Rev and FlClash bundle it by default.

A cross-platform GUI client built on Tauri, covering Windows, macOS, and Linux, with mihomo bundled in. It offers subscription management, a TUN toggle, and Merge/Script config enhancements, making it a common choice on desktop. Installers are available on our Clients page.

The general term for software that puts a graphical interface on a core, handling subscription imports, system proxy toggles, and node switching for everyday use — while the core does the actual traffic forwarding. Client and core versions are independent, so when you hit a "protocol not supported" error, check the core version first, not the interface version.

A local HTTP management API exposed by the core, configured via external-controller and commonly listening on 127.0.0.1:9090. Both the client's own UI and web dashboards use it to read connection lists, switch proxy groups, and trigger latency tests. When bound only to the local address, it isn't exposed to the internet.

A single URL from your provider that the client periodically fetches to get a node list or full config. An expired link, an exceeded data quota, or a server blocking requests by User-Agent will all show up as an "update failure" or "nodes wiped out after update." See Troubleshooting Subscription Failures for how to tell them apart.

Also known as config.yaml — the core's complete operating manual, laying out ports, DNS, nodes (proxies), proxy groups (proxy-groups), and rules (rules) in order. "Importing a subscription" in a client essentially means downloading or generating a file like this for the core to load.

A plain-text data format that uses indentation to express structure, used throughout Clash's entire configuration system. Its syntax is extremely strict about whitespace: indentation must use spaces, never tabs, and a colon must be followed by a space. Nine times out of ten, a "parse failed" error when hand-editing a config comes down to one of these two issues.

A service or tool that converts one subscription format into another — typically turning a generic base64 node list into Clash's YAML structure, often applying a ready-made rule template along the way. Conversion services see your node data in full, so it's worth vetting who runs a public conversion site before trusting it.

The resource-provider mechanism in the config file, split into proxy-provider (node sets) and rule-provider (rule sets). It lets nodes or rules live in separate remote files that auto-refresh on a set interval, which is handy for managing multiple subscriptions or pulling in community rule sets.

The mechanism that routes each connection to a different outbound based on domain, IP, port, process name, and other criteria — the core capability that sets Clash apart from a simple proxy tool. Rules are matched top to bottom and stop at the first hit, with a MATCH rule at the end catching everything that wasn't matched.

A selectable bundle of multiple nodes, where a rule's target points to the group rather than a single node. Common types: select for manual choice, url-test for auto-selecting the lowest latency, fallback for failover, and load-balance for load balancing. Switching nodes just means switching within the group — no rule changes needed.

A rule type that matches based on an IP address's geographic origin, relying on a geolocation database bundled with the core. GEOIP,CN,DIRECT is the classic way to route mainland China IPs straight through. An outdated database can cause misclassification, so clients typically offer a way to update it.

A domain-category database supported by the mihomo core, pre-bundling huge numbers of domains by site category — writing one line like GEOSITE,category-ads-all,REJECT covers an entire category of sites. Compared to stacking individual DOMAIN rules, this keeps configs shorter and leaves updates to the database maintainers.

A mode that skips all routing rules and sends every connection through a single node, alongside Rule mode and Direct mode. Handy for quickly checking whether an issue lies with a node or with the rules — for everyday use, stick with Rule mode to avoid needlessly routing local traffic through a node.

Two built-in special policies: DIRECT connects straight to the target without going through any proxy, and REJECT simply blocks the connection. Routing ad domains to REJECT and local network or intranet sites to DIRECT is a fixture in nearly every rule template.

A single usable remote proxy server entry, containing its address, port, protocol type, and authentication details. Each line of proxy config in a subscription is a node; the node itself is maintained by the provider, while the client just picks an outbound via proxy groups and forwards traffic through it.

The client sends a request to a designated test URL (commonly Google's generate_204) and measures the round-trip time in milliseconds to gauge a node's responsiveness. This number only reflects round-trip time, not download bandwidth — if every node times out at once, work through local network and system clock checks first, from closest cause to farthest.

An HTTP/SOCKS proxy entry registered at the OS level; apps that respect system settings, like browsers, route through it automatically. Some command-line tools and game clients don't read this setting at all, so their traffic never touches the proxy — that kind of traffic needs TUN mode to be captured.

A mode that creates a virtual network adapter to intercept all of a device's traffic at the network layer, covering apps that ignore the system proxy. Enabling it requires admin rights or a system extension: Windows usually needs a service component installed first, and macOS will prompt for network extension permission.

A DNS response strategy in the core: it first returns a fake IP from a reserved range (like 198.18.0.0/16) so the app can connect immediately, then resolves the real domain during forwarding. This skips the wait for real DNS resolution and makes domain-based routing easier — but apps that rely on the real IP (like some local network discovery services) need to be added to the fake-ip-filter exception list.

When domain resolution requests bypass the proxy and go straight to your local ISP's DNS — even if your actual traffic goes through the proxy, which domains you visited still gets logged on the resolution side. Enabling the core's DNS takeover (dns.enable: true) or TUN mode, plus checking your network adapter's DNS settings, eliminates this kind of leak.

The backstory of each proxy protocol, speed and resource-usage comparisons, core family relationships, and picks by use case. Go to the Protocol Handbook →

Step-by-step instructions from importing a subscription to verifying your connection, with the glossary's terms mapped to their exact spot in the interface. Go to the Setup Guide →

A collection of Q&As organized into four groups: the basics, installation & setup, usage tips, and troubleshooting. Go to the FAQ →