CLASH / CONFIG DICTIONARY

Clash Terms and Configuration Fields

Look up terms by configuration layer, from the mihomo core to DNS interception. Understand the terminology before editing fields, so a protocol issue doesn’t turn into an indentation problem.

01 / CORE & CLIENT

Cores and Clients

The client manages settings, the core handles connections, and subscriptions and nodes provide input data. Troubleshoot each layer separately.

mihomo core core / Clash Meta lineage: mihomo is the network core that handles proxy connections, rule matching, and DNS requests, continuing the Clash Meta technical lineage. GUI clients typically run it as a background process, so the client version and core version are separate. If a field is unsupported or a protocol fails to load, check the version of the core actually running—not just the app’s name.

GUI client GUI / configuration management and system integration: A GUI client brings subscription management, policy selection, log viewing, and system proxy controls into a clickable interface. Its capabilities depend on the core, the options the app exposes, and system permissions. When switching clients, check configuration content and app settings separately; app settings usually aren’t carried over with a subscription.

Proxy node proxy / remote connection parameters: A node is a set of parameters for connecting to a proxy server, typically including its address, port, protocol, authentication, and transport settings. Its name is only a label in the list; a location in the name doesn’t guarantee that the actual egress is there. Troubleshoot DNS resolution, port connectivity, and authentication separately—repeatedly switching modes won’t fix all three.

Subscription subscription / configuration distribution: A subscription distributes and updates nodes or a complete configuration through a URL. Depending on the format, it may contain only nodes or also include proxy groups and rules. A successful update means the content was fetched and parsed, not that every node can connect. Subscription URL parameters may contain account credentials, so check whether the link will be shared with a third party before posting logs or screenshots or using a conversion service.

Latency test latency / request time to a specified target: Clients commonly show the time taken by a test request through a node. Results depend on the test URL, timeout, and connection reuse. This is neither a pure server ping nor a download speed test. If a node times out but some sites still work, check whether the test target is reachable. Use the same test conditions when comparing nodes.

02 / PROXY PROTOCOLS

Proxy Protocols

A protocol defines how a connection is established; transport methods and TLS belong to separate configuration layers. Similar names do not mean their parameters are interchangeable.

Shadowsocks SS / encrypted proxy protocol: Shadowsocks is a common encrypted proxy protocol. The server address, port, encryption method, and password must all match. Some configurations also require support for a specific protocol version or plugin, so copying only the address and password may not be enough. If the imported configuration reports an unsupported encryption method, check the core’s capabilities and the original settings. Don’t substitute another method name at random—the server won’t change to match it.

VMess user ID / transport configuration: VMess establishes proxy connections using parameters such as a user ID and can use different underlying transport methods. Protocol authentication, transport settings such as WebSocket, and TLS certificate validation are separate steps; a mismatch at any one can cause failure. Check the user ID, transport type, path, and server name against the original configuration. Correct the system clock first if it is significantly off.

VLESS lightweight protocol / security layer combination: VLESS is a lightweight proxy protocol commonly paired with security mechanisms such as TLS or REALITY. The protocol name alone does not describe the complete encrypted connection. The client must support the transport, security mechanism, and parameter combination in use. If importing fails, check the specific field reported by the core; seeing a VLESS option in the interface does not mean every related configuration is supported.

Trojan TLS / password authentication: Trojan typically carries proxy traffic over TLS. A successful connection requires both the correct password and valid certificate verification. An incorrect server name, certificate chain issue, or system clock can leave the port reachable while the handshake fails. Check the server name and certificate status first; skipping verification weakens identity checks and should not be a routine fix.

Hysteria 2 QUIC / UDP network requirements: Hysteria 2 is a QUIC-based proxy protocol, so the network path must allow the relevant UDP traffic. A network that can access regular HTTPS may still block these connections; an accessible TCP port on the same server does not confirm UDP connectivity. If only this type of node fails, compare results across networks first, then check authentication, certificates, and server parameters.

03 / RULES & ROUTING

Rules and Routing

First confirm that traffic reaches the core, then check which rule it matches. Adding a rule won’t capture connections that never reach the core.

Rule-based routing mode: rule / ordered matching: Once a connection reaches the core, rule-based routing uses conditions such as domain and IP to choose a direct connection, reject the traffic, or send it to a proxy policy. Rule mode usually checks rules from top to bottom and stops at the first match, so specific domain rules should come before broader ones. After making changes, check the matched rule and final policy in the connection details. A successful save alone doesn’t prove routing works as intended.

GeoIP GEOIP / IP geolocation database: GeoIP matches a destination IP against records in a geolocation database, for example GEOIP,CN,DIRECT. It does not classify traffic by website language or domain suffix, and results can change with CDN addresses or database updates. Some IP rules trigger DNS resolution, so check the resolved address and database status, and whether the no-resolve parameter is in use.

GeoSite GEOSITE / categorized domain sets: GeoSite groups domains by service or topic, letting rules refer to a category instead of listing every domain individually. Available categories and their contents depend on the data file and version. If a rule fails to load, first confirm the category exists. If only some site resources use the wrong policy, check whether the relevant subdomains are included.

Proxy group proxy-groups / node selection logic: Proxy groups combine multiple nodes or other policies to offer manual selection, selection based on test results, or failover. The target group name in a rule must exactly match its definition; update references when renaming a group. Automatic selection depends on the test target and interval—it doesn’t provide real-time insight into every website’s performance. Understanding the group type is more useful than assuming “automatic” means everything is handled.

MATCH catch-all rule / last in the list: MATCH catches connections that haven’t matched an earlier rule and is usually placed at the end of the list, for example MATCH,PROXY. PROXY must be the name of a policy that actually exists; it is not a reserved group name that can be copied into any configuration. A catch-all rule only handles traffic that has reached the core—it cannot replace system proxy settings or TUN traffic capture.

04 / DNS & NETWORK STACK

DNS and Networking

Traffic capture and domain resolution are related but separate paths. Enabling one setting does not mean the other path is configured too.

TUN mode virtual network interface / route-based traffic capture: TUN mode uses a virtual network interface and routes to send eligible traffic to the core, potentially covering apps that do not use the system proxy. Capture still depends on system permissions, routing, exclusions, and other VPN software; it does not guarantee that every connection goes through the proxy. If startup fails, check service permissions and startup logs. Once enabled, verify routing and DNS rather than relying on the toggle’s status alone.

Fake-IP enhanced-mode: fake-ip / domain mapping: Fake-IP mode returns a mapped address to the app while the core stores the mapping, allowing later connections to be associated with the original domain for rule matching. Seeing an address from the mapped range is usually expected; it does not mean the resolver is broken. Apps that require real IP addresses may need entries in fake-ip-filter. Add filters for affected domains rather than excluding all domains.

DNS leak resolution path / requests outside the expected route: A DNS leak occurs when requests bypass the expected path—for example, when a request that should use a specified resolution route goes directly to another resolver. A test site reporting a resolver in a particular region is not enough on its own to confirm a leak; consider direct-connection rules and the upstream design too. Check system DNS, browser Secure DNS, other VPNs, and encrypted DNS settings, then retest under the same conditions after making changes.

dns-hijack tun.dns-hijack / DNS capture setting: dns-hijack is a TUN setting that sends matching DNS traffic to the core’s built-in resolver. Capturing traditional DNS ports does not automatically identify and intercept every encrypted DNS request from a browser. If DNS requests still bypass the intended route despite correct rules, confirm that they pass through TUN and check whether the app uses DoH or DoT separately.

nameserver and fallback DNS upstreams / result selection conditions: nameserver specifies the upstream resolvers used by the built-in DNS service, while fallback participates in choosing results alongside filtering conditions. It is not simply a backup address used only when the primary resolver times out; also check settings such as fallback-filter. If domain policies or rule-following options are enabled, check those too before attributing a complex resolution path to a single upstream failure.

Continue troubleshooting: DNS Leak Checks and Fake-IP Fixes, or see A Field-by-Field Guide to mihomo DNS Settings.

05 / YAML & CONFIG FIELDS

Configuration Fields

Check the field value, its location in the configuration, and the file that is ultimately loaded. A form label in the client may not match the YAML field name.

YAML configuration format / indentation defines structure: YAML is a common format for Clash-based configurations. Indentation represents parent-child relationships, and hyphens mark list items. Use spaces, not tabs, and keep indentation consistent at each level. Quote strings with special characters according to YAML syntax. A successful parse only confirms valid formatting—not that the current core supports every field. Check the load logs and effective configuration too.

mixed-port HTTP + SOCKS / proxy listening port: mixed-port lets a single port accept both HTTP and SOCKS proxy requests. A common example is 7890, but use the value in the active configuration. The proxy address and port set in apps must match the core’s actual listening address and port. If logs report that the port is already in use, stop the conflicting process or choose another port, then update system and app settings that depend on it.

allow-lan LAN access / listening scope: allow-lan controls whether devices on the local network can access the client’s proxy listener; it does not enable the proxy on the current device. Setting it to true does not guarantee connectivity—binding address, firewall rules, and Wi-Fi isolation also matter. If you need to share access, restrict it to trusted devices and configure authentication as needed. Don’t expose the proxy listening port directly to the public internet.

external-controller control API / not a proxy port: external-controller defines the control API’s listening address. The dashboard uses it to check connections, switch policies, and perform other management tasks. It is different from mixed-port; entering the control port in a browser’s proxy settings will not route web traffic. Prefer local-only access and enable API authentication. Before allowing remote access, check firewall rules and the scope of network exposure.

Override override / client configuration merge mechanism: Override usually refers to a client feature that merges local fields, adds rules, or runs configuration-modification scripts on top of a subscription. It is not a universal top-level field supported by every client. It can preserve local DNS, port, or routing changes and reduce the need to reapply them after subscription updates. Implementations may append or replace lists differently, so inspect the generated configuration after changes—not just the contents of the override editor.

Back to category index ↑ View the configuration guide