Clash Glossary

The dominant core in the Clash ecosystem today, kept alive by the community as a fork of Clash.Meta. Compared to the original core, it adds newer protocols like VLESS and Hysteria2, along with a more complete TUN implementation and Geosite support. Most of the GUI clients listed on this site's download page bundle mihomo — just check which core version a client ships with.

The original rule-based proxy core written in Go, which defined the YAML config format still in use today; the project stopped receiving updates in 2023. These days, saying 'Clash' usually refers to the whole ecosystem built around that config format rather than the specific core binary — the core actually running today is mostly mihomo.

A desktop or mobile app that wraps a graphical interface around a core, such as Clash Verge Rev, Clash Plus, or FlClash. The client handles subscription management, node switching, system proxy and TUN toggles, while the underlying traffic handling and rule matching are still done by the core. When troubleshooting, figure out first whether the problem is in the interface layer or the core layer.

A cross-platform desktop client built on Tauri with mihomo bundled in, available for Windows, macOS, and Linux. On Linux it ships as deb and rpm packages, covering Debian-based and Red Hat-based distributions — a common choice for Linux desktop users.

A macOS menu bar client that evolved from the earlier ClashX after switching to a Meta-based core, known for its minimal interface that lives in the menu bar. The project is no longer maintained; existing installs still work, but there won't be further feature updates, so new users should pick an actively maintained client instead.

A lightweight encrypted proxy protocol with a simple structure and low overhead, one of the earliest protocols widely supported in the ecosystem. Written as ss in Clash configs, commonly paired with aes-128-gcm or chacha20-ietf-poly1305 encryption, and works with both old and new cores.

A transport protocol designed by the V2Ray project, authenticated via UUID with built-in time validation — a large clock offset on your machine can cause connection failures. It can be paired with transports like WebSocket or gRPC and layered with TLS, giving it many possible combinations.

A protocol that disguises proxy traffic as standard HTTPS, requiring valid TLS to run on, typically over port 443. Since its handshake and transport look identical to ordinary web browsing, it's harder to fingerprint; the sni field in the config must match the certificate's domain.

A streamlined successor to VMess that drops built-in encryption entirely, leaving security to an outer layer of TLS or REALITY, which lowers overhead. The original Clash core doesn't support this protocol, so any subscription with VLESS nodes requires a mihomo-based client.

A QUIC-based proxy protocol optimized with congestion control tuned for high-loss, high-latency links, giving noticeably better throughput on unstable networks. It runs over UDP, so any firewall along the way needs to allow the relevant port; also only supported by mihomo-based cores.

A top-down rule list in the config file, where each rule consists of three parts — match type, match value, policy — like DOMAIN-SUFFIX,example.org,PROXY. Matching stops at the first hit, so order matters; a MATCH rule is usually placed at the end as a catch-all.

A way to organize multiple nodes into a single selectable group. Types include select (manual pick), url-test (auto-picks the fastest by latency), fallback (failover), and load-balance. Rules typically point to a proxy group rather than a single node, so switching nodes doesn't require editing the rules.

A rule type matched by the destination IP's geolocation, relying on the client's local GeoIP database. GEOIP,CN,DIRECT is a classic way to send mainland China IPs direct. The database goes stale over time — most clients offer a one-click update option, which is the first thing to try if location-based matching seems off.

A rule type matched against community-maintained domain category lists, where a single rule can cover an entire category of sites — for example GEOSITE,category-ads-all is commonly used to block ad domains. Natively supported by mihomo, and pairing it with GeoIP can shrink a hand-written rule list dramatically.

A way to keep large rule sets in external files, subscribed to by URL and refreshed on a schedule via the interval field. The main config only needs a single RULE-SET reference, avoiding thousands of lines of manual rules; the community maintains several actively updated public rule sets you can reference directly.

A mode where the core creates a virtual network interface to intercept all system traffic at the network layer, covering apps and command-line tools that ignore system proxy settings. On Linux it requires elevated permissions or running the core with privileges, usually paired with auto-route to take over the routing table automatically.

OS-level HTTP/SOCKS proxy settings; enabling it in the client points the desktop environment's proxy at a local listening port (like 127.0.0.1:7890). Only apps that actively respect this setting will route through the proxy — browsers generally do, but many command-line tools don't, which is exactly why TUN mode exists.

One of the DNS resolution modes, controlled by the enhanced-mode field. The core returns virtual addresses from a reserved range (198.18.0.0/16 by default) for domain lookups, then matches by domain once traffic arrives, skipping a real DNS lookup and responding faster while resisting DNS poisoning. A few apps that need real IPs may require excluding them via fake-ip-filter.

A situation where domain lookup requests still go to the local ISP's DNS even with the proxy turned on. It can reveal what you're accessing, and poisoned results can also cause connection issues. Enabling Fake-IP, or specifying an encrypted DoH/DoT upstream in the dns section of the config, both prevent this.

Windows UWP apps (Store apps) are blocked by default from accessing the local loopback address 127.0.0.1, so they can't reach a local proxy port — other apps work fine while only Store apps fail to proxy. This needs to be fixed with a loopback exemption tool for each app; Linux and macOS don't have this restriction.

The round-trip time measured when the client sends an HTTP probe to a node (often Google's generate_204 endpoint), in milliseconds. The number reflects connectivity and response speed, not download bandwidth; a timeout or error means the node is currently unusable, not just 'slow'.

A field that listens for both HTTP and SOCKS5 proxy traffic on the same port, commonly set to 7890. Point both the system proxy and browser extensions at this one port, skipping the hassle of configuring port and socks-port separately; if the port is already in use, change it here and update the system proxy settings to match.

Controls whether other devices on the LAN can connect to the local proxy port. Set it to true along with bind-address, and phones or streaming boxes on the same network can share this machine's Clash proxy by pointing at its address and port; always keep this off on public networks.

The address the core's RESTful API listens on, commonly 127.0.0.1:9090. Web dashboards like metacubexd and yacd use it to read the node list, switch proxy groups, and view live connections; the accompanying secret field sets an access password, which is required if the API listens on a non-local address.

A field for the running mode, with three values: rule routes by the rule table, global sends everything through the proxy, and direct connects everything directly. Day-to-day use should stay on rule; when trying to figure out whether a site should go through the proxy, temporarily switching to global or direct for comparison can help, just remember to switch back after.

The data format used by Clash config files, relying on indentation to express structure — spaces only, no tabs, and a space is required after every colon. A lot of 'parsing failed' errors on subscription import are really just YAML syntax mistakes; an editor's YAML validation feature can quickly point to the offending line.