Configuration fields · Connection logs · Client settings
Understand the entry point, core, and exit before reading a configuration. This guide covers 25 common terms in five categories, explaining what each means, when it applies, and what it is often confused with.
For your first setup, start with Getting Started. For the full workflow, see the user guide. Use the links beside each term to bookmark or share it.
Start with three questions: where does the configuration come from, where does traffic enter, and where does the connection go?
A subscription is a remote source from which a client retrieves nodes or a complete configuration, often through a link containing access credentials. Different providers may return different formats, and a link opening in a browser does not mean the current client can import it directly. Updating a subscription refreshes its remote content, not the client app. Hide the subscription URL in screenshots you share.
A node is a set of parameters for connecting to a proxy server, usually including its address, port, protocol, and authentication details. Its name is just a label chosen by the provider; it does not guarantee the actual exit location or indicate current load. Troubleshoot a node connection failure separately from a subscription fetch failure: check connection parameters and the network path for the former, and the configuration source for the latter.
The latency shown by a client is the response time measured against a specific test endpoint using a particular method; it is not necessarily an ICMP ping. Results vary with the target, connection reuse, timeout threshold, and current network conditions. Low latency does not mean high bandwidth, and a timeout does not mean every service is unavailable. To compare results, use the same test conditions.
The system proxy sets a local proxy address in the operating system so apps that honor the setting can use the client. Browsers usually support it, but some games, command-line tools, and apps that manage their own networking may not. Enabling the system proxy and choosing a routing mode are separate actions: one controls the entry point, the other controls routing after traffic reaches the core.
TUN receives IP packets through a virtual network interface and passes them to the core to establish the corresponding connections. It can handle apps that do not honor the system proxy. Actual coverage depends on system routes, permissions, exclusions, and DNS settings; enabling TUN does not capture every connection automatically. First confirm that the node works through the system proxy, then check TUN settings one by one to avoid confusing entry-point issues with node problems.
A protocol describes how a connection is established and carried; it is not a speed ranking. Before choosing one, confirm that both the core and server support it.
An HTTP proxy is one way for an app to connect through a proxy server, whether as a local entry point or a remote node. For HTTPS sites, it typically uses CONNECT to establish a tunnel, while TLS is still negotiated between the browser and the destination. Using an HTTP proxy alone does not mean the client decrypts HTTPS traffic. If you see a certificate error, check the system clock, certificate chain, and connection environment separately.
SOCKS5 is a general-purpose proxy protocol that can relay TCP connections and defines a mechanism for UDP forwarding. Confirm separately whether the app and server both support UDP. SOCKS5 does not encrypt traffic, so its use alone says nothing about transport security. Whether the domain is resolved locally or by the proxy also depends on whether the app sends a domain name or an already-resolved IP address.
Shadowsocks connects to a proxy server using an encryption method and key agreed by both sides, and is commonly written in a configuration as type: ss. The encryption method, password, and any transport options must match the server; changing only the protocol name does not convert a configuration. Some newer algorithms require a recent core. If importing fails, check the specific fields and core support first.
Trojan typically uses TLS for proxy connections. The client must match the server address, port, and authentication settings. The TLS handshake may also depend on SNI and the certificate domain, so a reachable node address does not guarantee a successful handshake. For certificate issues, check the domain, system clock, and server configuration first; disabling certificate verification is not a good long-term fix.
Hysteria2 is based on QUIC and requires a working UDP network path, as well as a client core that supports the protocol. Authentication, TLS, and optional obfuscation settings must match the server; do not assume an older Hysteria configuration is compatible. If the network blocks UDP, the protocol may fail even when TCP services on the same server work.
Rules select a policy; the policy group then selects an exit. Understanding these two layers is more useful than repeatedly switching modes.
Rule-based routing directs connections based on criteria such as domain, IP address, or process. Rules are usually checked from top to bottom, and the first match takes effect. Put more specific rules before broader ones, and leave the catch-all rule at the end. If a connection exits unexpectedly in rule mode, check the matched rule and policy chain in the connection log before changing the rule order or criteria.
A proxy group combines nodes or other policies into a reusable set. Rules can point to the group name instead of a specific node. select is generally for manual selection, url-test for choosing based on test results, and fallback for switching according to availability. Automatic groups depend on the test endpoint and interval, so they cannot guarantee the best exit for every type of traffic.
A rule provider keeps domain or IP entries separate from the main configuration for easier maintenance and updates. After defining a resource under rule-providers, reference it in the rule list with RULE-SET; a successful download does not mean the rules are being used for routing. Make sure the resource format matches declarations such as behavior, and check logs for parsing errors if updates fail.
GeoIP classifies by IP address, while GEOSITE classifies by domain lists; they use different data and match different targets. Results depend on the data source, its coverage, and update status. They do not represent real-time physical location or determine website ownership. IP-based rules may also trigger domain resolution, so consider DNS settings when interpreting a match.
DIRECT connects directly using the local network; REJECT blocks the connection. Both are policies that rules can reference. MATCH is a rule type for matching all remaining connections, and still needs a policy after it, such as MATCH,PROXY, where PROXY must be a defined policy name. Placing MATCH too early prevents later, more specific rules from matching.
The route used for domain lookups and the route used to connect to a website are two separate things to check.
DNS looks up records such as the IP address associated with a domain. An app uses the returned address to establish a connection. The operating system, browser, and proxy core may cache results independently or use different resolvers. To troubleshoot DNS, first identify who made the query and where it was sent; changing system DNS alone does not mean the core and browser will use it too.
Fake-IP returns a synthetic address to an app and stores an address-to-domain mapping in the core, allowing the subsequent connection to be handled by domain. The synthetic address is not the destination server's real address, so the related traffic must return to the core holding the mapping. Some apps that rely on real addresses may need exclusions. After switching DNS modes, check whether old cache entries are affecting your tests.
A DNS leak usually means a query took a path other than the one intended—for example, an app sent a domain directly to the local resolver when it was supposed to go through a proxy. Whether this is a problem depends on the routing goal; local resolution for direct traffic is not automatically a leak. A DNS test page may show one resolver in a recursive chain, so check the browser's encrypted DNS settings, system settings, and actual query records together.
nameserver and fallback are resolver lists available in mihomo DNS configuration. Result selection is also affected by filters and policy fields. fallback is not simply a list of backup servers used only after the primary fails; fallback-filter helps determine which results are selected. Before editing, check whether the configuration also assigns resolvers by domain rather than looking at just one section.
In TUN settings, DNS hijacking usually means redirecting matching DNS requests to the core's resolver. It is a traffic interception feature, not a way to change website certificates. Whether it works depends on the requests entering TUN and on the protocols and ports covered by the rules. An app's own DoH or DoT connection will not automatically be intercepted by ordinary DNS hijacking; investigate its connection path separately.
The client handles the interface; the core handles connections. Check both layers when troubleshooting compatibility.
A GUI client provides controls for importing subscriptions, choosing policies, viewing logs, and toggling the proxy. It may launch a separate core process in the background. Even clients using the same core can differ in configuration management, permission requests, and system integration. When choosing a client, consider both its interface and whether its bundled core supports your configurations and protocols.
mihomo, formerly known as Clash Meta, is a proxy core that handles protocol connections, rule matching, and DNS. A GUI client can call it, or it can run on its own. It shares some configuration conventions with the original Clash, but supported fields and protocols are not identical. When a configuration is incompatible, check which core is actually running and consult its documentation rather than relying on whether the client name includes Clash.
YAML is a data serialization format commonly used for Clash configurations. It expresses hierarchy through indentation and organizes content with lists and key-value pairs. Use spaces for indentation and take care with quoting values that contain special characters; duplicate keys can also cause unexpected overrides. Valid syntax is only the first step—check policy references, field types, and core support using configuration validation or startup logs.
A configuration override generates the final running configuration by merging, patching, or scripting changes outside the original subscription. It is useful for preserving local DNS or routing adjustments. Clients can handle list replacement, append order, and precedence differently, so do not assume another client's instructions will apply. If a change seems to have no effect, inspect the final running configuration rather than only the original file in the subscription editor.
external-controller specifies the address where the core's control API listens. A UI can use it to read connections, switch policies, or manage configuration. It is not a proxy port for browser traffic, so adding it to system proxy settings will not work as expected. For local management, restrict it to a loopback address. If other devices need access, configure authentication and firewall rules as well.