Clash Glossary: Subscriptions, Rule-Based Routing, TUN, and Fake-IP

Cores and Clients

The interface provides controls, the core handles network traffic, and subscriptions distribute configuration. Check all three layers when troubleshooting compatibility.

ClientClient / GUI: An app for importing configurations, toggling the proxy, viewing logs, and managing updates. The core typically handles network traffic. A client may let you switch cores, so the same interface does not guarantee identical protocol support. When reporting an issue, include the client and core names and versions—not just a screenshot.

CoreCore: The program that reads configuration, handles proxy protocols, matches rules, and forwards connections. Whether a field works depends on the core and its version, not just whether the settings page has a corresponding toggle. Updating the client, updating the core, and refreshing a subscription are separate actions; a subscription refresh cannot add support for a new protocol.

mihomoSuccessor project name for Clash Meta: A proxy core that evolved from the Clash Meta project, with features such as rule-based routing, providers, TUN, and DNS. The name is not exclusive to any one desktop interface. mihomo can be managed by a GUI client or run on its own. Before copying a configuration, check that the required features are supported by your version. See Core Differences for background on how the projects evolved.

Clash MetaLegacy name and ecosystem label: The name of a core branch in the Clash ecosystem; its continued development uses the name mihomo. Older guides, configuration comments, and some client names may still include Meta, so the name alone does not tell you how current a configuration is. If a field fails to parse, check the running core's version and the error location before deciding whether to update the core or change the configuration.

SubscriptionSubscription: A way to retrieve and update configuration or proxy resources from a remote URL. A link might return a full YAML configuration or just a proxy list; these are not interchangeable formats. Updating a full configuration can replace rules and proxy groups, so use a client-supported override mechanism for persistent changes. Subscription links may contain access credentials; don't include them in public screenshots, logs, or online conversion services.

Proxy Protocols

A protocol defines how the client and server communicate. Server address, authentication, transport, and TLS settings together determine whether a connection works.

Proxy entryProxy entry: A common term for a proxy connection profile, typically including the server address, port, protocol, authentication, and transport settings. The entry name is just a label; it does not guarantee location, bandwidth, or availability. If a connection fails after import, check that the configuration is complete, the core supports the protocol, and the server is reachable from your device—not just whether the name appears in the list.

Shadowsockstype: ss: A common proxy protocol, usually configured with the ss type and parameters such as server address, port, cipher, and password. The client and server must support and use the same cipher; some configurations also require a plugin or additional options. The same protocol name does not guarantee support for the same extensions across implementations, so check each setting when migrating a configuration.

VMesstype: vmess: A proxy protocol that authenticates with a user ID and other parameters and can be used with different transports and TLS settings. Successful import only means the configuration can be read; it does not confirm that the ID, path, or server name is correct. If authentication or the handshake fails, check the server settings and system time. Changing DNS alone usually will not fix mismatched authentication parameters.

VLESStype: vless: A proxy protocol focused on lightweight authentication. It does not encrypt traffic on its own and is commonly paired with TLS or REALITY. A working connection also depends on the transport, server name, and handshake parameters—not just the user ID. Supported combinations can vary by core version, so don't paste fields from another client into YAML without checking them first.

Trojantype: trojan: A proxy protocol that typically establishes connections over TLS. Common settings include the server, port, password, and server name. Certificate validation errors can result from a name mismatch, an invalid certificate chain, or an incorrect system time; identify the cause first. Disabling certificate verification changes the security of the connection and should not be the default response to handshake errors.

Rules and Routing

Rules determine where connections go; proxy groups choose the outbound. Checking which rule matched is usually more useful than repeatedly changing the configuration.

Rule-based routingrules / DOMAIN-SUFFIX / MATCH: A mechanism for choosing an action—such as direct, proxy, or reject—based on conditions like the domain or destination IP. Rules are generally matched from top to bottom, so an overly broad rule near the top can shadow more specific rules below it. To troubleshoot, first confirm rule mode is active, then check which rule matched the connection. The catch-all MATCH rule usually belongs at the end of the list.

Proxy groupproxy-groups: Groups multiple proxies or other policies under one outbound, giving rules a stable group name to reference. select is typically for manual selection, url-test picks an outbound based on test results, and fallback prioritizes available outbounds in order. Automatic selection depends on the test target and interval; it does not necessarily find the route with the fastest actual download speed.

Rule setrule-providers / RULE-SET: A collection of matching conditions in a separate file, making rules easier to update and reuse. Declare it with rule-providers, then reference it with RULE-SET. The rule set's behavior and format must match the file contents. A successful download does not mean the rules are routing traffic: also check the reference name, rule order, and target policy.

GeoIPGEOIP: Matches destination addresses using an IP geolocation database, supplementing domain rules that don't cover a connection. Database classifications do not pinpoint a server's physical location, and results can be affected by CDNs, IP allocation changes, and database update timing. Matching a domain with this rule may trigger DNS resolution; no-resolve can prevent resolution triggered specifically for rule matching. Understand the trade-offs before using it.

LatencyLatency / URL test: The time a client takes to probe a specified test target. Its exact meaning varies with the test URL, protocol, connection reuse, and network conditions. A lower result does not necessarily mean faster downloads or guarantee that a particular site is reachable. Compare results under consistent conditions and verify them in the apps you use. For unusual results, follow the latency troubleshooting guide.

DNS and Networking

Whether traffic enters the core, which resolver handles a domain, and how the resolved address is used for rules are three separate questions. Turning on one setting does not verify the entire path.

TUN modetun: Captures traffic through a virtual network interface and routing settings, including traffic from some apps that ignore system proxy settings. It usually requires additional permissions, and its actual coverage depends on automatic routes, route exclusions, and the system network environment. Enabling TUN does not mean all DNS or app traffic is captured. When using it alongside another VPN, check for routing conflicts and interface clashes.

DNSDomain Name System: The system that translates domain names into IP addresses and other records; its results may also be used for rule matching. The operating system, built-in client, and browser's encrypted DNS may follow different paths, so changing one setting may not affect the others. When checking your setup, distinguish the resolver address, the outbound path for DNS requests, and caching. For the full configuration sequence, see the DNS section of the complete guide.

Fake-IPenhanced-mode: fake-ip: A DNS mode that returns virtual addresses to apps while the core maintains the mapping between those addresses and domain names, enabling domain-based routing later. The virtual address shown to an app is not the destination server's real address, so it cannot be used to determine the server's location. Apps that rely on real DNS results may need to be added to fake-ip-filter. After making changes, clear stale caches and reconnect.

DNS leakDNS leak: When DNS queries take an unexpected route and reach an unintended resolver. First define which queries should follow which paths to determine whether this is a problem. TUN, Fake-IP, or encrypted DNS alone does not prove that resolution follows the intended route. Check system settings, browser-specific DNS, client logs, and test results together. The resolver location shown on a test page does not by itself prove a leak.

Redir-Hostenhanced-mode: redir-host: A DNS enhanced mode that usually returns real resolved addresses to apps, unlike Fake-IP, which returns virtual addresses. It may suit apps that rely on real addresses, but the conditions used to associate domains with connections also differ. After switching modes, the operating system and apps may retain old DNS cache entries; clear the cache or restart affected apps before comparing results.

Configuration Fields

When reading a field, check its name, location in the configuration, and units. The same-looking “update interval” may control a full configuration, proxy resources, or health checks.

YAMLconfig.yaml: A common data serialization format for Clash configuration. YAML uses indentation for nesting and keys and lists to organize fields. Indent with spaces, not tabs; quote strings containing special characters when required by the syntax. Valid YAML does not mean the core recognizes every field. Check the configuration before loading it, and keep a recoverable copy of the original.

moderule / global / direct: A top-level field that sets the core's operating mode. Common values are rule, global, and direct, for rule, global, and direct mode. It determines how connections that enter the core are routed; it does not automatically send app traffic to the core. Global mode does not mean every app on the system uses the proxy—check whether system proxy settings or TUN cover the apps you want.

proxy-providersProxy resource provider: Declares the source of proxy resources, loading a proxy list from a remote URL or local file and refreshing it according to the configuration. Unlike a full configuration subscription, a provider list usually does not define all rules and DNS settings; a proxy group must reference it after loading. To troubleshoot a failed update, check URL reachability, response format, local cache path, and references separately.

intervalConfiguration level and time unit: Specifies an interval, but its meaning depends on its location: a provider's interval usually controls resource refreshes, while health-check.interval controls availability checks. Both commonly use seconds. A client's full-configuration update setting may use minutes, so don't copy the same number between them. Shortening the interval won't fix format or authentication errors. For update failures, start with the subscription update troubleshooting guide.

mixed-portShared HTTP / SOCKS listening port: Provides HTTP and SOCKS proxy endpoints on the same port, giving apps one local listening address to use. If another program is using the port, the core may fail to start the listener; check the logs rather than only changing the system proxy address. LAN access also depends on the bind address, firewall, and access controls. Entering the port number on another device is not enough to make it work.