Glossary / Network map
This index brings together easily confused terms from client interfaces, configuration files, and network modes. Find a concept by category first, then return to the download or tutorial page to complete the setup.
01 / Runtime layer
These terms answer the question of what runs the configuration. The client provides the controls, while the core parses configuration, establishes connections, and applies rules.
Clients and Cores
Mihomo is a widely used configuration and proxy core in the Clash Meta ecosystem, responsible for parsing YAML configuration, establishing connections, applying rules, and managing policy groups.
Different clients may use different core versions. Even when interface labels look similar, check the client’s core information and configuration compatibility range.
Clients and Cores
A Clash client runs the proxy core and provides a graphical interface, typically handling configuration imports, mode switching, connection monitoring, and system proxy changes.
When choosing a client, first confirm the operating system, supported core, and whether system-level features such as TUN are required. Then choose a desktop or mobile tool.
Clients and Cores
YAML is a common configuration format for Clash and Mihomo, where indentation and colon-based structure are syntactically significant.
Incorrect indentation, misspelled keys, or mismatched types can prevent a configuration from loading. When editing YAML, preserve the existing hierarchy and recheck the parsing result after making changes.
02 / Connection path
These terms describe how a connection leaves the local device, enters a proxy entry point, and how its response performance is measured.
Proxy and Connections
A node is a proxy server connection described in the configuration, usually including an address, port, protocol, authentication details, and transport parameters.
A configuration can contain multiple nodes for policy groups to choose from. A node name is only an identifying label and cannot by itself reveal the actual region, speed, or stability.
Proxy and Connections
Latency is the time from when the client sends a probe to when it receives a response, usually measured in milliseconds. The target, network distance, and test protocol all affect the result.
Lower latency only means a faster response; it does not by itself indicate bandwidth, stability, or the experience on every website. When connections fluctuate, also consider timeouts, packet loss, and actual access results.
Proxy and Connections
A proxy port is a local connection entry point that the client listens on, such as an HTTP or SOCKS port.
Browsers, command-line tools, and other applications must use the correct address and port to send traffic to Clash. Port conflicts or an incorrect listening address typically appear as a refused connection.
03 / Configuration source
A subscription determines where configuration comes from, while the configuration file determines how the client runs. They are related, but they are not the same thing.
Subscriptions and Configuration
A subscription is typically a URL used to retrieve proxy configuration. The server returns nodes, policy groups, rules, and other content.
After updating a subscription, the client converts the remote content into a usable configuration file. If an update fails, first verify that the URL is valid and the account is active, then check whether the response is still parseable configuration.
Subscriptions and Configuration
A configuration file defines runtime parameters such as proxy nodes, ports, DNS, rules, and policy groups. It is the core’s primary source for execution behavior.
A subscription-generated configuration can serve as a base, with personal settings added through overrides or local edits. Keep a working copy before editing so you can quickly roll back to the previous state.
Subscriptions and Configuration
A proxy provider supplies the subscription URL and the network service behind it; the Clash client itself is not a proxy service.
Before using a subscription, verify its source, account status, traffic limits, and terms of service. If a subscription expires, nodes become unavailable, or the server changes its format, the client can usually only report an update or parsing failure.
04 / Decision layer
Rules determine which path a connection should take, while policy groups choose the specific node or handling method after a match.
Rules and Policy Groups
Rules match domains, IP addresses, processes, or network requests against preset conditions, then pass connections to a specified policy group.
Rules usually run from top to bottom, so an earlier match affects subsequent handling. When troubleshooting routing results, first confirm which rule actually matched, then inspect the policy group it points to.
Rules and Policy Groups
A rule provider references a set of independently updateable rule files, such as ad domains, local network addresses, or domains for specific services.
The configuration must declare the rule format, behavior, and whether the source is remote or local. After updating a rule provider, confirm that its behavior still matches the policy group names in the current configuration.
Rules and Policy Groups
A policy group is a selection layer for nodes or other policies. Common types include manual selection, automatic latency testing, and failover.
Once a rule matches a policy group, that group determines which proxy path the connection uses. Manual selection suits explicit control, while automatic types depend more on test targets and health-check settings.
05 / Traffic capture
Network mode determines which traffic the client can capture. System proxy works for applications that follow system settings, while modes such as TUN cover a broader range.
Network Modes
TUN mode uses a virtual network interface to capture a broader range of system traffic, allowing applications without manual proxy settings to enter Clash’s processing path.
It usually requires system permissions, and routing, DNS, and bypass lists should be reviewed alongside it. If local-network devices or system services malfunction after enabling it, check rule and routing scope before repeatedly switching nodes.
Network Modes
A system proxy is an HTTP, HTTPS, or SOCKS proxy setting provided by the operating system. Applications such as browsers that follow system settings use it.
System proxy coverage depends on whether each application reads the setting, so it is not equivalent to capturing all traffic. After closing the client, if the system proxy switch remains enabled, some applications may continue trying to connect to a port that is no longer listening.
Network Modes
Redir-Host is a DNS operating mode in which the client keeps a reversible mapping for domain resolution results and restores the original domain during connection handling.
It depends on a sufficiently complete DNS configuration and may require additional handling for applications with built-in resolution. Choose a DNS mode based on rule requirements, local-network access, and the resolution behavior of the applications involved.
06 / Resolution and route
These concepts cover IP-based geographic classification, virtual address mapping, and domain-resolution paths—the foundation for diagnosing cases where a rule matches but access still fails.
System and Routing
A GeoIP database uses IP addresses to determine their registered geographic region. Rules can use this information to distinguish traffic such as local-network, mainland China, or overseas addresses.
GeoIP results depend on the database version and should not be treated as precise geolocation. When the database is outdated, rules may assign an address to the wrong region; after updating it, recheck important routing results.
System and Routing
Fake-IP mode returns a virtual address maintained by the proxy client for a domain, then uses a mapping table to recover the original domain.
This helps preserve domain information for rule processing, but applications that depend on real DNS responses or hard-coded IP addresses may need bypass settings. If local-network devices behave unexpectedly, check the Fake-IP exclusion list first.
System and Routing
A DNS leak occurs when domain lookups are still handled by the local network or another unexpected DNS service while proxy traffic travels through the proxy chain.
Troubleshooting should cover DNS mode, listening addresses, the system resolver, and the application’s own encrypted DNS settings. Checking only the browser’s proxy switch cannot cover every application’s domain-resolution path.