GLOSSARY
While reading Clash tutorials or troubleshooting connection issues, you'll often run into specialized terms like TUN mode, Fake-IP, and GeoIP. This page collects more than twenty high-frequency terms into five categories, each with its own anchor link, so you can jump here directly from tutorials and FAQs for reference.
The transport protocol corresponding to the type field in a node entry. Different protocols have different core version requirements; if certain nodes don't show up after importing a subscription, protocol compatibility is a good place to start troubleshooting.
ShadowsocksProxy Protocol
A lightweight proxy protocol based on symmetric encryption, extending SOCKS5 with encrypted transport. It has few configuration fields — typically server address, port, encryption method, and password. Most Clash subscriptions still include this type of node, and every core version supports it.
VMessProxy Protocol
A transport protocol defined by the V2Ray project that relies on a UUID for user authentication and requires the client-server time difference to stay within an allowed range. Commonly paired with WebSocket and TLS. An inaccurate device clock will cause every handshake for this type of node to fail.
VLESSProxy Protocol
A streamlined successor to VMess that drops built-in encryption. Authentication is still UUID-based, while encryption is handled by an outer layer of TLS or REALITY, reducing transport overhead. The original Clash core doesn't support this protocol — a client built on the mihomo core is required.
TrojanProxy Protocol
A protocol that disguises proxy traffic as standard HTTPS, requiring the server to hold a valid TLS certificate. Traffic characteristics resemble normal web browsing, and the main configuration fields are server address, port, and password. Certificate validation failures are a common source of connection errors for this type of node.
Hysteria2Proxy Protocol
A QUIC-based transport protocol with congestion control tuned for high-packet-loss links; throughput on poor networks is usually better than TCP-based protocols. It runs over UDP, so connections can't be established on networks that restrict UDP traffic. Supported only by newer cores such as mihomo.
The Clash ecosystem consists of the core plus the various platform clients built around it. Installer downloads for each client are on the download page.
mihomoCore & Client
The core currently used by mainstream Clash clients, continued and renamed from the Clash Meta project. Building on the original core, it adds capabilities such as VLESS, Hysteria2, and enhanced TUN mode. Clients like Clash Verge and FlClash all bundle this core.
Clash VergeCore & Client
A desktop GUI client, full name Clash Verge Rev, covering Windows, macOS, and Linux, with the mihomo core built in. Provides subscription management, a TUN mode toggle, and config enhancements — a common alternative after Clash for Windows stopped receiving updates.
Clash Meta for AndroidCore & Client
The Android Clash client, abbreviated CMFA, based on the mihomo core. Takes over device traffic through the system VPN interface, supporting per-app routing and automatic subscription updates. The first launch requires authorizing the system's VPN connection request.
Core vs. GUICore & Client
The core is the command-line proxy program itself, responsible for protocol implementation, rule matching, and traffic forwarding; the GUI client is the graphical shell around the core, handling subscription management and visual operations. Distinguishing the two helps when troubleshooting: interface glitches are usually client-related, while connection behavior is mostly determined by the core and its configuration.
The mechanism that decides whether a connection is proxied or sent directly. Once you understand this set of concepts, the meaning of the rules and proxy-groups sections in a config file becomes much clearer.
Rule RoutingRules & Routing
Clash's core mechanism: each connection is matched top-down against the rule list in the config file, and matched traffic is handed off to the corresponding proxy group or sent directly. Rules can be written based on domain, IP location, process name, and other conditions, with earlier rules taking priority.
Rule ModeRules & Routing
One of three outbound modes; traffic is matched against the rule list entry by entry to decide its path, and it's the default recommended mode for daily use. The alternatives are Global mode, which proxies everything, and Direct mode, which proxies nothing; all three can be switched from the client's main screen.
Global ModeRules & Routing
Ignores the rule list and routes all traffic passing through the client to the currently selected node. Suitable for temporarily testing whether a node works, or as a fallback when rules misbehave. Leaving it on long-term routes local traffic that should be direct through the proxy too, adding latency and data usage.
Proxy GroupRules & Routing
Organizes multiple nodes into a logical group; a rule's outbound target usually points to a group rather than a single node. Common types include manual selection (select), latency-based auto-switching (url-test), failover (fallback), and load balancing (load-balance). Switching nodes in the client interface is really just changing the current selection within a group.
GeoIPRules & Routing
A rule type that matches traffic by IP location, relying on a built-in IP geolocation database. A typical example is GEOIP,CN,DIRECT, meaning connections to IPs located in mainland China go direct. The database updates alongside core versions, and an outdated database can cause misjudgment for some addresses.
GeoSiteRules & Routing
A rule type matched against a domain classification database maintained by the community. Compared to writing DOMAIN rules one by one, a single GEOSITE rule can cover an entire category of sites, often paired with GeoIP rules to form a complete routing scheme.
How traffic enters the client and how domains get resolved. The trade-off between TUN mode and system proxy, along with DNS configuration details, is where most issues arise in advanced usage.
TUN ModeNetwork & DNS
A mode that takes over all device traffic at the network layer by creating a virtual network adapter, independent of whether an app follows system proxy settings. Command-line tools, games, and other programs that don't read proxy configuration need TUN mode to be taken over. Enabling it usually requires administrator privileges or installing a system extension.
System ProxyNetwork & DNS
An HTTP/SOCKS proxy setting at the operating-system level. Once the client enables it and writes it to the system, apps that respect the setting — such as browsers — send their traffic to Clash's listening port. Apps that don't respect it are unaffected, which is the main difference from TUN mode. If the client exits abnormally, a leftover system proxy setting can cause a loss of connectivity and needs to be turned off manually.
Fake-IPNetwork & DNS
A DNS handling mode in which the client returns a fake IP from a reserved range for domain resolution requests, deferring the real resolution until traffic actually goes outbound. This saves one DNS round trip and lowers the chance of leaks. A few programs that depend on the real IP need to be added to the fake-ip-filter exclusion list.
DNS LeakNetwork & DNS
Occurs when traffic itself goes through the proxy, but domain resolution requests still go to the local ISP's DNS, exposing the destination to the local network. Configuring Clash's DNS module and verifying with a leak-test site can confirm whether resolution requests take the same path as traffic.
Mixed PortNetwork & DNS
A hybrid-protocol port the client listens on locally, accepting both HTTP and SOCKS5 proxy requests, with 7890 being the common default. To manually configure a proxy for another device on the LAN or for a single app, just enter the address of the machine running Clash plus this port. If the port is already taken by another program, the client will fail to start.
How node information gets into the client. The full steps for importing a subscription are in the tutorials.
Subscription LinkSubscriptions & Config Files
A URL provided by the service, which returns a complete Clash configuration or node list when accessed. Once imported, the client can automatically pull updates on a schedule, so node changes don't require manual config edits. The link itself functions as a credential and shouldn't be shared publicly.
Config File (Profile)Subscriptions & Config Files
A YAML document that centrally defines all runtime parameters — ports, DNS, nodes, proxy groups, and rules. A subscription is essentially a remotely hosted config file. You can also hand-write a config locally, or make incremental edits on top of subscription content.
YAMLSubscriptions & Config Files
The data format used by Clash config files, expressing hierarchy through indentation and sensitive to the number of spaces. When editing by hand, indentation errors or mixing tabs and spaces are the most common causes of config load failures — an editor with syntax checking is recommended.
Node (Proxy)Subscriptions & Config Files
A single usable proxy server entry in the config file, containing the protocol type, server address, port, and authentication info. Nodes are usually named by region plus a number in the client interface, such as HK-01 or JP-02, for quick identification within a proxy group.
Latency TestSubscriptions & Config Files
The client sends a request to a test address and measures the elapsed time to evaluate a node's current quality, with results shown in milliseconds. The number reflects round-trip latency to the test address, not absolute network speed. If every node times out, it usually means the subscription has expired or the local network is having issues, rather than a problem with the nodes themselves.
Subscription ConversionSubscriptions & Config Files
A service or tool that converts a subscription from one client format to another — for example, turning a generic node list into a Clash config with rules. When using a third-party conversion service, the subscription link passes through that server, so its trustworthiness should be evaluated, or a locally hosted conversion tool used instead.
Next step: once you've looked up the terms, follow the tutorials to import a subscription and connect for the first time; installers are organized by platform on the download page; and error scenarios can be matched against the troubleshooting categories in the FAQ.