Core, protocol, routing, subscription — anyone new to Clash runs into a wall of jargon fast. Here we've stocked 23 high-frequency terms across 6 categories, each explained in a couple of sentences so you can look it up and get straight back to work.
Listed in page order — click any term to jump straight to its explanation card.
First, sort out who does what: the core handles forwarding, the client handles the interface, and an API connects the two.
mihomo is the actively maintained open-source proxy core formerly known as Clash Meta. Building on the original Clash, it adds protocols like VLESS, Hysteria2, and TUIC, along with rule sets, enhanced DNS, and other improvements. Clients featured on this site — Clash Plus, Clash Verge Rev, FlClash — all run on it.
The original Clash, created by Dreamacro, pioneered this rule-based routing approach and stopped receiving updates in 2023. It established the YAML config, proxy group, and top-down rule matching conventions that later cores and clients largely kept. For a new setup, just pick a client running on the mihomo core.
A GUI client is the graphical app wrapped around the core, handling everyday tasks like importing subscriptions, switching nodes, and toggling the system proxy. The core handles traffic forwarding, the interface handles user interaction — a clean division of labor. Clash Verge Rev, ClashX Meta, and Clash for Windows all fall into this category.
The external controller is a set of HTTP endpoints exposed by the core, letting the UI read status, switch nodes, and view connection logs. The external-controller field in the config sets the listening address (port 9090 on localhost by default), while secret sets an access key. Always set a secret if you change the listening address beyond localhost.
How your node talks to the server: the protocol determines encryption, disguise, and transport efficiency.
Shadowsocks was the first widely adopted lightweight encrypted proxy protocol, needing just an address, port, password, and cipher method — low overhead, broadly implemented. It appears as ss-type nodes in Clash configs. Its SSR variant has largely fallen out of use and rarely shows up in current subscriptions.
VMess is the flagship protocol of the V2Ray project, identifying users by UUID and supporting transports like WebSocket and gRPC. It appears as vmess-type nodes, commonly with uuid, alterId, and network fields — one of the most common protocols in older provider subscriptions.
VLESS is V2Ray's follow-up lightweight protocol, dropping VMess's built-in encryption and handing security off to TLS or REALITY for a lighter handshake. The original Clash doesn't support it — you need a next-gen core like mihomo. It appears as vless-type nodes, often paired with the flow and reality-opts fields.
Trojan disguises proxy traffic as ordinary HTTPS traffic, relying on a domain certificate for its TLS handshake, giving it strong resistance to detection. It appears as trojan-type nodes, with password and sni as core fields. An inaccurate system clock can break certificate validation — check the time first if connections fail.
Hysteria2 is a QUIC-based proxy protocol running over UDP, with a clear speed advantage on lossy, high-latency connections. Only next-gen cores like mihomo support it, and it appears as hysteria2-type entries. Some broadband setups throttle UDP — if it's underperforming, try comparing against a TCP-based protocol.
Which traffic goes down which path is decided by this cluster of concepts working together.
Rule-based routing is Clash's core mechanism: traffic is sent to different nodes or direct connections based on conditions like domain, IP, or process name. The rules section is matched top to bottom, stopping at the first hit, usually ending with a MATCH catch-all. Custom rules must go before the general ones, or they'll never get a chance to fire.
A proxy group is a logical grouping of nodes — that row of dropdowns on the client's proxy page is exactly this. Common types: select for manual choice, url-test for automatic latency-based switching, fallback for failover, and load-balance for distributing load. Rules match a group name, and the group then decides which node actually handles traffic — switching nodes usually just means changing the group's selection.
GeoIP is a database used to determine which country or region an IP belongs to; a rule like GEOIP,CN queries it directly. mihomo uses mmdb-format data files, which most clients bundle and can update online. An outdated database won't cut your connection, but routing decisions may become less accurate — update it periodically.
A rule provider packages hundreds or thousands of domain or IP rules into a separate file that the main config references as needed, via the rule-providers field. Compared to writing everything into the rules section, it's smaller, updates independently, and loads faster. mihomo supports classical, domain, and ipcidr behavior formats.
Where nodes come from and how configs are written — four concepts you can't avoid in day-to-day maintenance.
A subscription URL is an address your provider gives you; visiting it pulls down a ready-made set of nodes and routing rules. It's a live source, not a one-time file — set an auto-update interval in your client and the node list stays fresh. The link carries access credentials, so never post it publicly or share screenshots of it.
A node is a single proxy server capable of forwarding traffic, corresponding to one entry in the proxies section of a config, specifying protocol type, address, port, and credentials. Switching nodes just means picking a different entry within a proxy group. Speed depends on the provider's line quality, not the client itself.
YAML is the text format used by Clash config files, relying on indentation to express structure, with a required space after every colon. Both downloaded subscription configs and hand-edited custom configs use it. The most common editing error is misaligned indentation or mixing in tabs — a YAML-aware editor helps avoid these pitfalls.
A subscription converter is an online service that rewrites subscription content from one client format into another — say, V2Ray format into a Clash config. This requires submitting your subscription URL to a third-party server, carrying a credential leak risk. Mainstream Clash clients can now parse common subscription formats directly, so conversion is rarely necessary.
The underlying terms you'll run into most when reading speed test numbers or troubleshooting a connection.
Latency is the round-trip time for a packet to travel from your device to a node and back, shown in milliseconds in the client. It mostly measures TCP handshake or small-request time — reflecting connection responsiveness, not download bandwidth. For browsing, bandwidth matters more; for gaming and voice calls, low, stable latency matters more than a low number alone.
A DNS leak means domain resolution requests bypass the proxy tunnel and go straight to your local ISP's DNS, exposing your browsing to interference or logging. Intercepting resolution in the config's dns section, combined with fake-ip or a specified nameserver, pulls domain lookups back into the proxy path. Checking DNS destinations in the client logs is the most direct way to diagnose this.
UDP relay lets non-TCP traffic — games, voice calls, QUIC — travel through the proxy as well. It requires both the udp field enabled on the node and support on the server side; missing either one breaks it. With it off, UDP traffic bypasses the proxy entirely, so UDP-dependent apps may behave unexpectedly.
Several ways a client can take over your traffic, each with different coverage and trade-offs.
System proxy mode writes the client's local port into the operating system's proxy settings, so any software that honors that setting automatically routes through Clash. Browsers and most desktop apps work out of the box, but some command-line tools and games ignore this setting entirely. Turn off the system proxy toggle before quitting the client, or you'll be left with a dead proxy entry that cuts off your internet.
TUN mode takes over all system traffic through a virtual network adapter, independent of whether an app supports proxy settings at all. It covers command-line tools, games, and UWP apps that the system proxy can't reach, at the cost of requiring administrator privileges to install the adapter driver. The mihomo core has built-in TUN support — just enable it in the client's settings page.
Fake-IP is a DNS strategy used in enhanced mode: a domain first resolves to a placeholder address in the 198.18 range, and the core then matches rules by domain name once it sees a connection to that address. This skips the wait for real resolution, speeds up routing, and sidesteps DNS pollution. If an app doesn't handle placeholder addresses well, add it to fake-ip-filter to exclude it.
Now that the terms are sorted, the next steps are right here: grab a client, follow a tutorial, or fix an issue.