Clash Glossary: Core, Protocol, and Rule-Based Routing Terms Explained

The current name for the Clash Meta core. It extends the original Clash core with broader protocol support, rule syntax, and DNS capabilities, and is the actively maintained mainline core. Clash Verge Rev, ClashX Meta, and FlClash all bundle it by default.

A closed-source enhanced core maintained by the original author, once distinguished from the open-source version by TUN support and rule-set features. It stopped updating after the original repo was archived, and mihomo has fully carried its capabilities forward — new configs don't need any special compatibility handling for it.

An operating mode that creates a virtual network adapter to intercept all inbound and outbound traffic at the system network layer. Unlike system proxy settings, which only affect some apps, TUN covers command-line tools, games, and other programs that ignore proxy settings. It requires administrator privileges or system extension authorization.

A lightweight encrypted proxy protocol with a minimal field set and widespread implementation, making it one of the most common node types in subscriptions. mihomo supports its mainstream ciphers and is compatible with obfuscation plugins like obfs and v2ray-plugin, with plugin parameters written directly into the node entry.

A proxy protocol from the V2Ray ecosystem, authenticated via a user UUID instead of a fixed password. In practice it's often paired with WebSocket transport and TLS encryption, requiring both transport and encryption fields when configuring a node.

A newer QUIC-based proxy protocol with built-in congestion control tuned for high packet-loss networks — its main strength is throughput on poor connections. mihomo has built-in support, with nodes declared as type: hysteria2 in the config.

A mechanism that routes different traffic to different outbound paths based on conditions like domain, IP range, or process name, defined in the config's rules section. Rules are matched top-down — the first match applies immediately and subsequent rules are skipped; the list typically ends with a MATCH rule as a fallback.

A way to organize multiple nodes into a group that rules can reference, defined in the proxy-groups section. Common types: manual select, latency-based auto-selection with url-test, primary/backup switching with fallback, and traffic distribution with load-balance. Groups can also nest and reference other groups.

An IP geolocation database used by rules like GEOIP,CN,DIRECT to match target IPs against country or region codes. An outdated database can cause misclassified IPs and routing mismatches; most clients offer a one-click update, and you can also specify a custom data source in the config.

A domain classification database that groups a huge number of domains into named collections. GEOSITE rules match entire collections at once — a single rule can cover thousands of domains, saving you from maintaining them individually. Like GeoIP, it needs regular updates.

An external rule file imported via rule-providers, which the core auto-downloads and refreshes on a set interval. Ideal for large rule lists or ones shared across multiple configs — the main config only needs a single RULE-SET rule referencing the collection name.

The master switch controlling how the core handles traffic, set via the mode field: Rule matches traffic against your rules, Global routes everything through the proxy, and Direct bypasses the proxy for everything. Rule mode is the everyday default; Global and Direct are mainly for troubleshooting or special cases.

One of the DNS enhanced modes. The core returns a fake address from the reserved 198.18.0.0/16 range for domain queries, deferring the actual lookup until connection setup. This cuts resolution delay and avoids tampered results, but scenarios that need the real IP require explicit exclusions.

The other DNS enhanced mode option, returning the real resolved address directly, similar to traditional DNS behavior. This mode has been de-emphasized in mihomo, with Fake-IP recommended for most cases — older configs using redir-host can usually migrate directly.

An exclusion list used in Fake-IP mode: domains on this list get real DNS resolution instead of a fake address. Scenarios like LAN device discovery, printers, NAS, and online gaming — which depend on real IPs — usually need their domains added here.

A situation where domain lookups bypass the proxy tunnel and go straight to your local ISP's DNS. Even if the traffic itself goes through the proxy, the lookup record still exposes browsing intent. Mitigations include specifying a nameserver in the config, using encrypted DNS upstream, and using TUN mode to handle resolution centrally.

Short for DNS over HTTPS and DNS over TLS, which wrap plaintext DNS queries in an encrypted channel to prevent eavesdropping or tampering in transit. Enable them by writing upstream addresses with an https:// or tls:// prefix under dns.nameserver.

A URL hosting a full config or node list. After importing it, clients auto-fetch updates on a set interval, keeping local node info in sync with the server. The link itself functions as an access credential and shouldn't be posted publicly or shared with others.

A single proxy server entry in the config file's proxies array, containing fields like protocol type, server address, port, and authentication credentials. Nodes are referenced by name in proxy groups, and the same node can appear in multiple groups.

A YAML document, typically named config.yaml, that defines ports, proxy mode, DNS, nodes, proxy groups, and rules — the single source of truth the core runs on. For field-by-field details, see this site's config reference.

The data format used by config files, expressing hierarchy through indentation and sensitive to spacing. Always use spaces for indentation — mixing in tabs will break parsing, and a space after each colon is an easily overlooked detail.

A mechanism that lets clients layer local changes on top of subscription content, typically through merged config snippets or scripts. With override in place, subscription updates won't wipe out the rules and proxy groups you've added — a recommended approach for long-term custom routing.

A feature where the client sends requests to a designated test URL and measures response time, shown in milliseconds next to each node. url-test proxy groups use these results to auto-switch to the fastest-responding node; note that this measures handshake latency, not actual bandwidth.

A desktop client covering Windows, macOS, and Linux, built on the mihomo core, with a UI for system proxy toggles, service mode, and TUN configuration, plus subscription management and config overrides. Its desktop feature set is comprehensive and serves as one of the main demo environments for this site's config reference.

A macOS menu bar client, forked from ClashX after switching to the Meta core, known for being lightweight and quick to toggle. The project is no longer maintained, though older versions remain available for download — those wanting ongoing updates might consider other clients on the same platform.

An Android client that uses the system's VpnService to create a virtual network adapter and intercept device traffic, with support for per-app routing and managing multiple config profiles. Background stability depends on manufacturer battery-saving policies, and it requires one-time VPN authorization on first use.

An OS-level HTTP/SOCKS proxy setting — browsers and other apps that honor it will automatically route through the proxy port. Command-line tools and some apps don't read this setting and need separate environment variable configuration, or TUN mode to be covered entirely.

A system interface on Android that lets apps create a virtual network adapter and intercept device traffic without root access. First-time use requires user authorization; if the manufacturer's battery-saving policy kills the process, the virtual adapter disconnects too — showing up as the notification icon disappearing and traffic falling back to a direct connection.