Configuration Reference · 25 Common Terms
From importing subscriptions to setting up TUN, identify what each term refers to before deciding what to change. These five categories cover common Clash terminology, and each card has a shareable anchor link.
If you're setting things up for the first time, start with subscriptions, configuration files and proxy groups. For step-by-step instructions, see the user guide. For differences between protocols and cores, see the technical reference.
Protocols define how a client connects to a server. When choosing one, check authentication, security, transport settings and core support together—not just the name.
Shadowsocks · ss
Shadowsocks is an encrypted proxy protocol, commonly written as ss in configuration files. A connection requires a server address, port, encryption method and password. Client support varies by encryption method, and newer methods may impose additional key format requirements. If importing fails, check all parameters—not just the password. The protocol name alone says nothing about connection speed.
VMess · UUID
VMess is a proxy protocol in the V2Ray ecosystem. It typically uses a UUID for authentication and supports multiple transport options. The node's network type, TLS setting, path and hostname must match the server configuration; a UUID alone is not enough to connect. A share link being parseable does not mean the current core supports every transport combination it contains.
Trojan · TLS
Trojan is a proxy protocol that typically establishes an encrypted connection over TLS. Common parameters include the server address, port, password and server name used for TLS. Certificate validation depends on both a matching name and a correct device clock and trusted certificate chain. If the handshake fails, check these settings first rather than treating certificate verification bypass as a permanent fix.
VLESS · Transport
VLESS is a lightweight proxy protocol that does not provide general-purpose encryption on its own. It is typically paired with TLS or another supported secure transport. Beyond the UUID, the transport and security settings also determine whether a connection can be established. Check that the core supports the complete configuration; the VLESS name itself guarantees neither encryption nor speed.
Hysteria 2 · QUIC / UDP
Hysteria 2 is a QUIC-based proxy protocol that relies on UDP and uses transport mechanisms designed for proxying. Performance depends on UDP reachability, packet loss, congestion and server bandwidth; networks that restrict UDP may prevent connections altogether. Hysteria 2 configurations are not directly interchangeable with those for earlier Hysteria versions, so check subscription format and core support separately.
TUIC · QUIC / UDP
TUIC is a QUIC-based proxy protocol that forwards TCP and UDP traffic over an encrypted connection. It requires the underlying network to carry UDP reliably, and authentication parameters and implementation support can vary between protocol versions. Network changes on mobile, idle connection policies and server settings all affect reliability, so the protocol name alone is no guarantee of stability.
The client interface, proxy core and interface framework each have different roles. Seeing an option in the interface does not mean every core version supports the corresponding configuration.
Clash Core
The original Clash core is a key part of the Clash configuration ecosystem. It handles connections, matches rules and forwards proxy traffic; it is not a desktop client with a graphical interface. The original open-source core and the former Premium branch do not support exactly the same features. When following older guides, check which branch they target rather than assuming every field works unchanged with your current core.
Clash Meta
Clash Meta is the name of a core project that extended the Clash configuration ecosystem; its successor continues development under the name mihomo. Older documentation, subscription formats and client names may still use Meta, so a different name does not necessarily mean an entirely separate configuration ecosystem. Compare actual core versions and supported fields, not just the client title.
mihomo Core
mihomo is the name used by the successor to the Clash Meta project. It handles protocol connections, DNS, rule routing and traffic forwarding. Clash Nyanpasu provides the graphical interface; configuration support depends on the selected core and its version. After switching cores, check that the configuration loads. Alpha builds are useful for testing new features, but are not necessarily more stable in every situation.
Tauri · Application Framework
Tauri is a framework for building desktop apps, used by Clash Nyanpasu to provide its interface and local capabilities. It is not a proxy protocol and does not decide which route a domain should use; those tasks belong to the proxy core. If a window is blank or a connection times out, check the app runtime and core logs separately rather than treating them as the same issue.
Rules determine which connections go where; proxy groups determine which outbound to use. When troubleshooting routing, check the matched rule, target group and selected node in that order.
Rule Routing · rules
Rule routing selects how to handle each connection—direct, through a proxy or otherwise—based on conditions such as domain, IP or process. Rules are generally checked from top to bottom. A broad rule placed too early can prevent more specific rules below it from taking effect. Unlike global mode, routing depends on the active mode, the matched rule and the selected policy, so check all three when traffic takes the wrong route.
Proxy Group · proxy-groups
A proxy group combines nodes or other policies under a single outbound name that rules can reference. Common types include manual selection, automatic testing and failover. When a rule matches a group, the group's logic determines which node is actually used. If you rename a group, update its rule references too. Selecting a node in a group does not mean all traffic is routed through that group.
IP Geolocation · GEOIP
GeoIP uses an IP database to classify addresses by country or region, allowing rules to select an outbound route. It matches IP information, not domain names, and cannot guarantee that every address used by a service will always map to the same region. Database source and freshness, along with DNS results, affect classification. Precise service routing usually also requires domain rules.
Domain Categories · GEOSITE
GeoSite is a collection of domains grouped by service, purpose or region, so a rule can reference a whole category instead of listing domains individually. Unlike GeoIP, which classifies IP addresses, GeoSite categories and coverage depend on the data source. Before using a collection, check that the core supports the rule type and the data file is available. Outdated collections may miss newer domains.
Rule Providers · RULE-SET
rule-providers lets you manage external rule sets separately from the main configuration and update them according to your settings. After defining a provider, reference it in rules with RULE-SET for it to participate in matching. The rule set's format, behavior type and file contents must be compatible. A successful download alone does not guarantee correct rule order or routing.
Read more: Rule matching order and remote rule set syntax.
DNS resolution and connection routing are related, but they are not the same thing. Consider the system proxy, TUN and an app's own DNS settings together to understand the actual traffic path.
Domain Name System
DNS resolves domain names to records such as IP addresses, which applications usually need before they can connect. The proxy core, operating system and browser secure DNS may all handle lookups; the actual query path depends on how traffic is intercepted. If old results persist after changing nameserver, check caches, routing policies and the application's own DNS behavior.
Fake IP · fake-ip
Fake-IP is a DNS handling method in which the core returns a virtual IP to the application, then uses a mapping to recover the domain and handle the connection. The virtual address is not the destination website's real IP, so seeing one does not necessarily indicate a DNS problem. Some local network services and apps that rely on real DNS results may need exception rules; adjust the configuration to address the specific compatibility issue.
TUN · Virtual Network Interface
TUN mode receives IP traffic through a virtual network interface and uses routing settings to intercept connections from apps that ignore the system proxy. It usually requires additional permissions and involves settings for the network stack, automatic routing and DNS interception. It is not a single switch that captures all traffic. When running alongside another VPN or virtual network adapter, check for routing and DNS conflicts.
DNS Leak
A DNS leak usually means domain queries bypass the expected resolution path and reach a DNS service the user did not intend to use. The resolver locations shown by a test site are clues, not proof that all traffic is or is not going through a proxy based on a country name alone. To trace the actual query path, check browser secure DNS, system DNS settings, TUN coverage and core logs together.
System Proxy
The system proxy is an operating system setting that provides apps with a proxy endpoint. A client can point it to a local listening port so apps that honor the setting route their connections through it. This is different from TUN mode: some programs ignore system settings or use their own proxy configuration. If the internet stops working after closing the client, check whether the system proxy setting is still enabled and whether a service is listening on the configured local port.
Read more: DNS leak test results and DNS settings troubleshooting.
A subscription provides content, a configuration file defines runtime settings, and nodes are just one part of it. Check the content format and active profile first, then troubleshoot connection or update issues.
Subscription
A subscription is usually a link for retrieving nodes or a complete configuration. The client downloads its contents and can refresh them on a schedule. Subscriptions may return a node list, a collection of share links or a Clash configuration; these formats are not interchangeable. Subscription URLs may contain credentials, so treat them as sensitive and never expose the full link in screenshots, logs or public support requests.
Proxy Node
A node is a set of parameters describing a proxy destination. It typically includes a protocol, server address, port and authentication details, and may also specify TLS and transport settings. The node name is mainly for identification; a region or multiplier in the name is no substitute for actual route information. Availability also depends on your network and server status, so the same node can perform differently on different networks.
YAML · Configuration Syntax
YAML is a text format commonly used for Clash configurations. It represents structure with key-value pairs, lists and indentation. Use spaces for indentation and keep items at the same level consistent; values containing special characters may need quotes. Passing YAML syntax validation only confirms the text structure is valid. The current core must still validate field names, references and protocol parameters.
Configuration Profile
A configuration file describes how the core runs and can include listening ports, DNS, nodes, proxy groups and rules. It is usually more complete than a single node entry. Importing a configuration and enabling it are separate steps, so confirm which profile is selected even after saving. Clients may also apply local overrides; when troubleshooting, inspect the final effective configuration, not just the original subscription content.
Latency · URL Test
A client latency test typically sends a request to a test URL through a selected node and records how long it takes. The exact timing depends on the implementation and whether connections are reused. This is not a bandwidth test and cannot directly predict video download speeds. The test URL, timeout, local network and server load all affect the result, so choose a node based on how the target app actually performs.
Choose your next step: Need help importing a configuration? See the user guide. Imported it but getting update errors? Follow the subscription update troubleshooting checklist. Looking for help with a specific issue? Visit FAQs.