Clash Glossary
Terms that keep showing up in the client UI and throughout this guide, organized into 25 cards across six categories. Each card gives a definition, then explains where you'll run into it and what it affects. Jump straight to a term using the category links or index below.
Quick A-Z Index
Proxy Basics
4 termsFour of the most common terms, defined up front. Later sections — including the setup guide and troubleshooting page — assume you already know what these mean.
ProxyProxy
A relay server that handles your traffic on your behalf. With a proxy enabled, your browser's requests to a site go to the proxy server first, which fetches the content and passes it back. The Clash client's job is to set up and maintain this tunnel between your device and the proxy server.
NodeNode
A single proxy server you can connect to. Subscriptions usually include multiple nodes spread across regions like Japan, Singapore, and the US — whichever one you select in the client's node list determines which server your traffic exits from. Names, regions, and protocols are all set by the provider; the client just displays and connects to them.
LatencyLatency
The round-trip time between your device and a node, measured in milliseconds (ms). The client's "latency test" typically sends a small timed request to a fixed address. Lower numbers mean faster response, but low latency doesn't guarantee fast speeds — bandwidth and route congestion matter too.
System ProxySystem Proxy
A toggle in your OS network settings. When enabled, the system writes "send HTTP/HTTPS requests to this port on 127.0.0.1" into its network preferences, and your browser and most apps follow along. The client's system proxy switch just flips this setting for you, and reverts it when turned off.
Protocols & Cores
4 termsThe core is the engine doing the work; the protocol is the format data travels in. Understand these two layers and the abbreviations in your node list and config stop being mysterious.
mihomo
The dominant core in the Clash ecosystem today, the successor to Clash Meta, picked up by the community after the original Clash core stopped updating. Clients like Clash Verge Rev and FlClash use it as their engine to parse configs, match rules, and route traffic. Most newer config features (rule providers, sniffing, etc.) are mihomo-only.
Shadowsocks
An early and widely used proxy protocol, commonly abbreviated SS, with node links starting with ss://. It wraps traffic to look like an ordinary encrypted connection, keeping setup simple and overhead low. Newer setups favor the 2022 encryption ciphers, while older ciphers are being phased out.
VMess
The core protocol behind the V2Ray project, with node links starting with vmess://. It supports encryption and user identity verification, and was long the dominant protocol in subscription configs. It's gradually being supplemented by newer protocols like VLESS, but plenty of nodes still use it, and mihomo fully supports it.
Trojan
A protocol that disguises proxy traffic as normal HTTPS browsing, with node links starting with trojan://, relying on TLS certificates for cover. Because it depends on a real domain and certificate, its configs often include certificate-related fields like sni and skip-cert-verify.
Rules & Routing
5 termsRouting answers one question: which path does this connection take? These five cards are the minimum you need to read a rules config.
Rule Routing
Clash's default way of working. For every incoming connection, the core checks the rule list from top to bottom, and whichever rule matches first decides how it's handled — direct, through a proxy group, or blocked; if nothing matches, the final MATCH rule catches it. Rule order matters — more specific rules should come first.
Proxy GroupProxy Group
A logical outbound made up of several nodes, referenced by group name (not individual node) in the rules. Common types include manual selection (select), auto lowest-latency (url-test), and failover (fallback). Clicking a node in the client's node page is usually just changing which node a given proxy group is currently using.
GeoIP
A database mapping IP ranges to countries or regions. A rule like GEOIP,CN matches when the destination IP falls within a mainland China range, and the core relies on it to determine IP location. The database file needs periodic updates, or newly allocated IP ranges may be misjudged.
GeoSite
A database that complements GeoIP by mapping domains to categories based on the nature of the site — for example, geosite:cn covers common sites in mainland China, geosite:google covers Google's domains. A rule can reference GEOSITE plus a category name to match an entire category at once, skipping the need to list domains individually.
Fake-IP
A DNS mode where the core first returns a fake address in the 198.18 range when an app queries a domain, then matches rules by domain name once the real connection comes in. This sidesteps DNS pollution interfering with routing decisions, and lets rule matching happen before the connection is even established. A few older apps don't accept this address range and can be excluded via fake-ip-filter in the config.
Subscriptions & Config
4 termsThe subscription determines where your nodes come from; the config determines how the client behaves. This section explains why updating your subscription overwrites manual edits.
Subscription URLSubscription URL
A URL provided by your service that the client periodically visits to fetch the latest node and rule list — this is what you paste in when "importing a subscription." The URL itself acts as a login credential; if it leaks, others can use your plan too, so don't share it publicly or post screenshots of it.
Config Fileconfig.yaml
The master configuration the core reads on startup — ports, proxy mode, nodes, proxy groups, and rules all live here, typically named config.yaml. Content imported from a subscription ultimately gets saved as a local config file too. Changes require the core to reload before taking effect, which most clients handle automatically on save.
YAML
The format used for config files, relying on indentation to express structure, with values following a colon. It's picky about formatting: indentation must use spaces (not tabs), and colons need a space after them. A yaml: line xx error during a subscription update or startup usually points to a formatting mistake on that line.
MixinMixin / Override
A personal customization layer applied on top of your subscription config. Every subscription update reverts to the provider's content, but the override layer reapplies your custom changes — an extra rule, a different DNS setup — right after the update. Clash Verge Rev calls this "Global Merge Config"; the older Clash for Windows called it Mixin.
Network & Ports
4 termsPorts are the entry point for local traffic; DNS decides where domain lookups go. Port conflicts and DNS issues are the two most common categories of trouble.
Mixed PortMixed Port
The local listening port the client opens on your device, shared by both HTTP and SOCKS5 proxy protocols, commonly defaulting to 7890. The system proxy switch simply points your browser at this port. If two clients fight over the same port, you'll see a "port already in use" error — change the port or quit the other client.
TUN Mode
A mode that takes over all of a device's network traffic through a virtual network adapter, independent of whether individual apps respect system proxy settings. It works well for apps that ignore system proxy settings (some games, command-line tools). Enabling it requires admin or root privileges, and it may conflict with other VPN-style software.
DNS LeakDNS Leak
When the system bypasses the proxy tunnel and queries your ISP's DNS servers directly. This exposes your lookup history and can throw off routing decisions. Enabling the built-in DNS with a specified nameserver, combined with Fake-IP mode, keeps domain lookups inside the proxy pipeline.
Loopback Address127.0.0.1 / localhost
Refers to your own device — traffic sent here never leaves the network adapter. The client's proxy port binds to 127.0.0.1, which is why you'll see that address in your system proxy settings; localhost is just its hostname form, pointing to the same thing. Note that it only refers to the local machine — if another device on your network wants to share this computer's proxy, it should use this computer's LAN IP, not 127.0.0.1.
Client-Side Terms
4 termsThese last four terms map directly to actual switches and options in the client UI. Knowing what each one changes gives you confidence when flipping them.
Proxy ModeRule / Global / Direct
A three-way switch in the client. Rule mode routes traffic connection-by-connection based on the rule list, and is the recommended default; Global mode sends all traffic through the currently selected node; Direct mode just forwards traffic with no proxying at all, mainly useful for quick troubleshooting comparisons. See the blog post on proxy modes for a detailed breakdown.
External ControllerExternal Controller
A local HTTP API exposed by the core, listening on 127.0.0.1:9090 by default. The client's graphical UI uses it to switch nodes, view connections, and read logs. The secret field in the config is the access password for this API and doesn't normally need to be changed.
Allow LANAllow LAN
When enabled, the proxy port switches from listening on just 127.0.0.1 to listening on 0.0.0.0, letting other devices on the same network point their proxy settings at this computer to share its connection. Best kept off on public networks (offices, cafés) to avoid exposing the port to unknown devices nearby.
Log LevelLog Level
Controls how much runtime info the client records, typically ranging from error, warning, info, up to debug. info is fine for everyday use; switch to debug temporarily when troubleshooting a connection to see the rule-matching process for each connection, then switch back — otherwise log files grow quickly.
What to Do Next
Terms are just a map — getting things running still means walking through the full process once. The setup guide ties together importing a subscription, picking a node, enabling the system proxy, and confirming it's working. If you haven't installed a client yet, head to the download page and pick one for your platform.