Clash Glossary

The primary kernel powering the Clash ecosystem today, evolved from the Clash.Meta project. It parses configs, executes rule matching, and forwards traffic — mainstream clients like Clash Verge Rev and FlClash bundle it by default. It supports more protocols and rule types than the original Clash kernel.

The project's original open-source core, which defined the config file format. The repository was archived in 2023 and is no longer updated; mihomo now maintains the ecosystem, though the term "Clash config" persists. Older clients still bundling the original kernel can't use newer protocols.

A lightweight encrypted proxy protocol with minimal config and low connection overhead. Declared as type: ss in the proxies section of a Clash config, commonly using aes-128-gcm or chacha20-ietf-poly1305 encryption.

A transport protocol defined by the V2Ray project, authenticated via UUID and supporting transports like WebSocket and gRPC. It has more config fields than most, usually delivered directly through a subscription rather than typed by hand. A wrong UUID or excessive clock drift will break the handshake.

A proxy protocol disguised as TLS traffic, typically listening on port 443 with a handshake that resembles ordinary HTTPS. The server needs a valid certificate; the client just needs a password and SNI to connect.

A QUIC-based proxy protocol optimized for high-packet-loss links, delivering better throughput than TCP-based protocols on poor networks. The original Clash kernel doesn't support it — nodes with type: hysteria2 require the mihomo kernel to load.

The single source of truth for how Clash runs, made up of five main sections: ports, DNS, nodes, proxy groups, and rules. Most toggles in a client's UI are really just reading and writing fields in this file. When troubleshooting, first confirm which config is actually loaded.

The text format Clash configs are written in, using indentation to express hierarchy. Indentation must use spaces, and a space is required after each colon. Any indentation or syntax slip while editing by hand can break the entire config, though client logs usually point to the exact line number.

A URL provided by a service that returns a full Clash config or node list when accessed. Clients pull updates at a fixed interval, so nodes can be added or removed without manually editing the file. Once a subscription expires or is reset, the same URL returns empty content or an error.

The process of converting node lists in other formats — V2Ray or Sing-box share links, for example — into a Clash config. This can be done through an online converter or a client's built-in feature, which usually injects a rule template and proxy group structure at the same time.

A single matching line in the rules section, formatted as type,value,policy — for example, DOMAIN-SUFFIX,github.com,Proxy Selection. The kernel matches rules top to bottom and stops at the first hit, so rule order directly affects how traffic gets routed.

A mechanism for keeping large rule sets in separate files that update on a schedule via URL. Referenced in the config as RULE-SET,name,policy, it's commonly used to maintain domain lists running into the tens of thousands — updating the rules never touches the main config.

A collection that bundles multiple nodes — or other proxy groups — into something rules can reference. Rules point to a proxy group rather than a specific node, so adding or removing nodes only changes group membership while the rules stay stable.

The most basic proxy group type, with members switched manually in the client UI. Often used as the main "Proxy Selection" entry point that wraps automatic groups like url-test inside it, letting you take manual control whenever needed.

Tests the address specified by url at the interval given by interval, and automatically picks the lowest-latency node. The tolerance parameter sets a switching threshold so nodes with similar latency don't flip back and forth.

Tests members in order for availability and always uses the first one that's reachable. Suited to a "stick with a primary node, fail over automatically" setup — unlike url-test's best-pick logic, it only cares whether a node works, not how fast it is.

Spreads connections across multiple nodes in a group. The strategy option can be consistent-hashing (the same site always routes through the same node) or round-robin, used to distribute load away from any single node.

The final line in the rules section, catching any traffic that no earlier rule matched. Without it, unmatched traffic falls back to the kernel's default behavior. How tight your routing setup is often comes down to which policy this line points to.

The client registers an HTTP/SOCKS proxy address with the operating system (such as 127.0.0.1:7890), and apps that honor that system setting — browsers, for instance — route through it automatically. Programs that ignore this setting, like some CLI tools or games, are unaffected.

Creates a virtual network adapter that intercepts all system traffic, regardless of whether an app reads the system proxy setting — giving it more complete coverage than a system proxy. Turning it on requires admin rights or a system extension approval, and the system proxy should be disabled to avoid traffic loops.

A listening mode that accepts both HTTP and SOCKS5 proxy requests on the same port, with most clients defaulting to 7890. Apps just need to point at that one port without worrying about protocol; if another program is already using it, the kernel will fail to start.

One DNS response strategy where the kernel instantly returns a reserved-range placeholder IP (198.18.0.0/16) for a domain query, deferring the real lookup until the connection is actually made. This skips the resolution wait; programs that need the real IP should be added to a fake-ip-filter exception.

What happens when DNS queries keep going straight to your local ISP's DNS even after the proxy is on. The lookup records reveal what you're accessing — the usual fix is enabling the kernel's DNS module or switching to TUN mode so resolution also travels through the proxy.

A rule type that matches traffic against an IP-geolocation database, most commonly written as GEOIP,CN,DIRECT — meaning IPs geolocated to mainland China connect directly. The database updates along with the kernel or client; leaving it stale for too long causes misidentified regions and inaccurate routing.

An open-source Tauri-based desktop client covering Windows, macOS, and Linux, with the mihomo kernel built in. It supports TUN mode, subscription management, and script extensions, and is the community continuation after the original Clash Verge stopped receiving updates.

A multi-platform client covering Windows, macOS, Android, and iOS, with the iOS version distributed through the App Store. Its interface stays close to native platform conventions, with short paths for importing subscriptions and switching rules — a good fit for anyone new to Clash.

A system-level network-takeover framework provided by macOS and iOS. When a client enables TUN or VPN mode, a system prompt asks you to authorize installing the extension; if you dismiss it by mistake, the feature stops working until you re-approve it under Network or Login Items in system settings.

Android's VPN framework, which Clash-style clients use to build a virtual network adapter for system-wide traffic takeover. The first launch triggers a system VPN connection prompt, and only one app can hold that channel at a time.

A local HTTP interface exposed by the kernel, listening by default on 127.0.0.1:9090. Client panels and web dashboards like metacubexd use it to read connection lists, switch nodes, and view logs — an access key can be set in the config.