Clash Glossary – Proxy, Rules, DNS, and Core Terminology

A

Core Concepts

Start by understanding where configuration comes from, how nodes are selected, and how the three proxy modes change the outbound path. These concepts run through subscription imports, policy switching, and everyday troubleshooting.

Subscription: A remote configuration URL published by a service provider, usually containing nodes, proxy groups, and rules. When the client updates the subscription, it reads the remote content again and generates an active configuration. A subscription is not a single node; it is more like a continuously updated configuration source. Manual changes made to generated content may be overwritten during the next refresh.
Node: A proxy server entry that a proxy group can select from the configuration. A node usually includes a server address, port, protocol, authentication parameters, and transport options. A node that connects successfully is not necessarily suitable for every network environment; selection also depends on latency, packet loss, bandwidth, region, and access to the target service.
Latency: The time required for the client to connect to a node's test endpoint and receive a response, usually shown in milliseconds. It helps quickly rule out unreachable or slow nodes, but is not download speed and cannot alone indicate long-term connection stability. The test endpoint, current network, and node load all affect the result.
Proxy Mode: The operating mode that determines how traffic is matched to an outbound connection. Rule mode evaluates rules in order, Global mode sends connections through a single policy, and Direct mode bypasses the proxy outbound. Rule mode is generally best for everyday use; Global and Direct are more useful for temporarily testing nodes or isolating routing issues. The mode name alone does not prove that a connection is working.
Configuration File: A structured file that describes ports, DNS, nodes, proxy groups, and rules. Clash configurations usually use YAML, which the client loads and passes to the core. Whether a configuration runs correctly depends not only on valid syntax, but also on compatible proxy-group references, rule targets, and DNS parameters.

B

Protocols and Transports

The local proxy entry determines how an app hands a connection to Clash. System proxy, HTTP, SOCKS5, and mixed ports describe local access methods; they are not the same as the transport protocol used by a remote node.

HTTP Proxy: A proxy entry for HTTP and HTTPS application traffic. When an app supports manual proxy settings, enter the HTTP listening address and port exposed by the client. HTTPS traffic usually establishes a tunnel with CONNECT; this does not mean the local proxy directly reads encrypted web content. Whether an app follows system proxy settings depends on its own implementation.
SOCKS5: A general-purpose session-layer proxy protocol that can carry various application connections. Unlike proxy methods intended only for web requests, SOCKS5 is commonly used by browsers, development tools, and software with custom proxy settings. Also check whether DNS is resolved locally by the app or sent through SOCKS5 to the proxy side.
Mixed Port: A local listening port that accepts both HTTP and SOCKS5 connections. Once enabled, different proxy types can share one port, reducing confusion from multiple port settings. A mixed port only unifies the local entry point; it does not automatically change rule mode, node protocol, or DNS handling.
System Proxy: The proxy settings entry provided by the operating system. When the client enables the system proxy, browsers and desktop apps that follow system settings send supported network requests to Clash. Some games, command-line tools, and software with its own network stack may ignore this setting; configure a separate proxy or consider TUN mode instead.

C

Rules and Proxy Groups

Rules identify connections, while proxy groups select the outbound path. Understanding match order and references helps distinguish missing rules from incorrect policy selection or an unavailable node.

Proxy Group: An outbound target that organizes multiple nodes, direct options, or other proxy groups for use by rules. Manual groups let users pin an outbound, URL-test groups select candidates based on test results, and fallback groups try the next option when the current outbound fails. Groups can be nested, but excessive nesting makes troubleshooting harder.
Rule-Based Routing: The process of selecting an outbound connection based on a domain, IP address, port, process, or rule set. Clash normally checks rules from top to bottom, and the first match determines which policy handles the connection. More specific rules should therefore come before broader ones, or later detailed rules may never take effect.
Rule Set: A reusable collection of domain or IP entries separated from the main configuration, also commonly called a Rule Provider. Rule sets can be stored locally or updated periodically from a remote URL, making them useful for maintaining large categorized lists. The main rules must still specify how to reference the rule set and which proxy group handles a match.
MATCH: The final fallback type in a rule list. When no earlier domain, IP, or rule-set rule matches, traffic is handled according to the policy specified by MATCH, so it is normally placed at the end. If it appears too early, later rules cannot be evaluated; if no fallback exists, behavior may differ from expectations.
GeoIP: A geographic database mechanism that matches traffic by the region associated with the destination IP. Rules can use GeoIP to send traffic from a specific region through a direct connection or selected policy. GeoIP depends on the local database, and an outdated database may classify newly assigned address ranges incorrectly. Domain traffic also usually requires DNS resolution before GeoIP matching.

D

DNS and Networking

Domain resolution and traffic interception are related but separate paths. Enabling a proxy entry does not necessarily change where DNS queries go, and enabling custom DNS does not mean every app's traffic will use the proxy.

DNS: The basic network service that resolves domain names to IP addresses. Clash can take over DNS queries and select upstream servers, resolution modes, caching policies, and routing behavior according to its configuration. DNS settings must work with the rule mode: if the system resolves a domain to an IP too early, some domain-based rules may lose the information they need to match.
DNS Leak: A situation in which domain queries bypass the intended proxy or encrypted resolution path and are sent directly to other DNS servers. Troubleshooting should cover system DNS, the client's nameserver and fallback settings, browser secure DNS, and whether TUN captures the queries. Seeing multiple resolvers in a test does not automatically prove a leak; the key question is whether requests left the intended path.
Fake-IP: A mode in which the DNS module first returns a mapped address from a reserved address pool to the application, while the core restores the real domain and performs rule matching. It helps preserve domain information during connection setup and centralizes DNS handling. Some LAN devices, games, or apps that depend on real address responses may need to be added to the Fake-IP filter list.
TUN Mode: An operating mode that captures more system traffic through a virtual network interface. It suits apps without individual proxy settings and can cover some connections that ignore the system proxy. Enabling it requires correct administrator permissions, routing, DNS hijacking, and network-adapter settings. If the network goes down, disable TUN first and verify that basic connectivity returns.
IPv6: A next-generation network protocol for Internet addressing that can coexist with IPv4. Whether to enable IPv6 in Clash depends on support from the local network, DNS upstreams, nodes, and target sites. If the proxy chain handles only IPv4 while an app prefers IPv6, traffic may take an unexpected path.

E

Clients and Cores

The graphical client presents settings, manages configuration, and calls system capabilities; the core actually performs DNS resolution, rule matching, and connection forwarding. Distinguishing the two helps clarify update scope and configuration compatibility.

mihomo: A proxy core developed within the Clash Meta ecosystem. It parses configuration, applies rules, handles DNS, and forwards connections. Many modern graphical clients use mihomo as the network-processing core, while the interface provides subscription, policy, and system settings. Bundled core versions and enabled features vary by client, so check field compatibility when migrating configurations.
Clash for Windows: A classic Clash desktop GUI client that provides configuration management, system proxy controls, policy switching, and connection viewing. The project is no longer maintained, and existing packages are mainly useful for legacy environments and compatibility. For newer systems or recent core features, compare actively maintained graphical clients on the download page.
YAML: The common data serialization format used by Clash configuration files, using indentation to express hierarchy. Keep spacing consistent when editing, and take care with spaces after colons, list hyphens, and string formatting. Tabs, inconsistent indentation, or improperly handled special characters can prevent a configuration from loading or place fields at the wrong level.
External Controller: A management interface exposed by the core to a graphical interface or web control panel. The client uses it to read runtime status, switch policies, update configuration, and manage connections. Because it may provide administrative capabilities, set its listening address and access credentials for the environment and avoid exposing the management port to untrusted networks.
Configuration Override: A way to append, replace, or adjust selected settings outside the original subscription. Overrides are often used to preserve local DNS, TUN, ports, or custom rules and reduce repeated edits after subscription updates. Override order and syntax vary between clients; confirm whether fields are merged, lists appended, or original values replaced before use.
UWP Loopback: A Windows setting that lets apps using UWP network isolation access a local proxy port. If a Microsoft Store app or system component cannot use the local proxy, check its loopback access permission. This only solves the app's access to the local proxy; it does not fix failed nodes, incorrect rules, or DNS problems.