Clash Glossary: Proxy Protocols, Cores & Config Terms Explained

A lightweight encrypted proxy protocol released in 2012, built on SOCKS5 forwarding. Designed for a simple traffic signature and low protocol overhead, with minimal fields and many implementations. Supported by every Clash-family core, and runs stably even on low-power routers.

The native protocol of the V2Ray project, with built-in user ID verification and timestamp-based replay protection. Typically paired with WebSocket or TCP transport, with a larger set of config fields. Both Clash and mihomo can parse it directly with no format conversion needed.

A protocol that disguises proxy traffic as HTTPS traffic, forcing TLS encryption. The server must hold a valid certificate and domain, making traffic look identical to normal web browsing. Certificate expiry is the top reason these nodes stop working.

A streamlined protocol introduced later by V2Ray, dropping built-in encryption and handing security off to outer TLS. Smaller header overhead, often paired with transport schemes like Reality. Supported only by newer cores like mihomo; the original Clash core can't parse it.

A proxy protocol based on QUIC (UDP), designed for unstable, lossy networks. Built-in congestion control lets it ramp up throughput as needed, and the server requires a certificate. Only supported by newer cores like mihomo, and shines on mobile networks.

Also a QUIC-based proxy protocol, focused on low latency and multiplexing. Native support for UDP forwarding and 0-RTT handshakes keeps jitter low on lossy connections. Requires the mihomo core; subscription entries use the tuic:// prefix.

The original open-source core maintained by Dreamacro, written in Go, with development stopped in 2023. Supports basic protocols such as Shadowsocks, VMess, Trojan, and Snell. Most clients today have already switched to its successor, mihomo.

A closed-source enhanced build released by the original author, once the only option with TUN, scripting, and rule providers, now discontinued alongside the original. These features have all been carried forward into mihomo and kept open source, so there's no need to seek this out for a new setup.

The open-source successor to the original Clash core, actively maintained by the community. It builds on the original with support for VLESS, Hysteria2, TUIC, WireGuard, and more rule types. Nearly every mainstream client today runs on this core, with config syntax largely compatible with the original.

A local HTTP control API exposed by the core, listening on 127.0.0.1:9090 by default. GUI clients use it to switch nodes, view connections, and change modes. Configured via external-controller, with access secured by the secret field — never expose it to the public internet.

A node-distribution URL provided by a proxy service. Clients periodically fetch it to get the node list, typically returned as a Base64-encoded list or full YAML. The link contains auth parameters equivalent to account credentials — never leak it or post it publicly.

The main configuration file the core reads on startup, defining ports, mode, nodes, and rules. GUI clients usually manage this file automatically, so manual edits may get overwritten by UI actions. Syntax errors are the most common cause of core startup failure.

The markup language used for Clash configs, relying on indentation to express hierarchy. Indentation must use spaces, never tabs; misaligned levels are the most common config mistake. Validate with the client's built-in checker before reloading.

An online service that rewrites one subscription format into another, useful when an older client can't read a newer format. The conversion passes through a third-party server, exposing node info to that party — a privacy concern, so use with caution.

A logical grouping of nodes defined in the config, including manual selection, auto speed test (url-test), load balancing, and failover. Rules point traffic to a group, which resolves to a specific node by policy. Switching nodes in a client's UI is really just switching members within a group.

The default operating mode. The core checks each connection against the rule list one by one; matches go through the proxy, everything else goes direct. Routing accuracy depends on rule set quality and update frequency — stale rules can send sites that should be proxied straight out instead.

All connections are routed through the GLOBAL group, bypassing the rule list entirely. Useful for troubleshooting routing issues or temporarily forcing everything through the proxy. Leaving it on long-term routes local sites abroad too, slowing them down.

All connections go out directly, effectively pausing the proxy. Useful as a baseline test: visit the same site once direct and once proxied to isolate which link is causing the problem.

A DNS response strategy under Enhanced Mode. Domains matching proxy rules get a fake address from a reserved IP range instead of a real DNS lookup, speeding up connection setup. A few apps that strictly validate addresses need to be added to the fake-ip-filter exclusion list.

A mode that takes over system-wide traffic through a virtual network adapter, independent of system proxy settings. It covers apps that ignore the system proxy as well as UDP traffic, but needs admin or root privileges to install the adapter. Running it alongside another VPN app causes routing conflicts.

The combined term for a proxy server available for forwarding and its connection parameters. Each entry in a subscription is one node. The same server can show up as multiple nodes if it offers different protocols or ports.

The round-trip time from client to node, measured in milliseconds. Client speed tests usually measure TCP or HTTP handshake time, not actual download speed. The number is only useful for comparing nodes against each other, and minor fluctuations are normal.

A policy system that routes traffic to different exits based on domain, IP range, process name, and similar criteria. Rules are matched top to bottom, stopping at the first hit — wrong ordering is a common reason routing doesn't behave as expected. When troubleshooting, check which rule a connection actually matched first.

An offline database mapping IP addresses to country and region codes, which entries like GEOIP,CN rely on. The database is updated periodically alongside the client; letting it go stale can cause the occasional routing misjudgment.

A situation where the system's domain resolution requests bypass the proxy and go straight to the ISP's DNS, letting your local network observe your browsing. Enabling Fake-IP, or pointing nameserver at a resolution path that goes through the proxy, prevents this.

A VPN interface Android exposes to proxy apps. Clients use it to establish a local tunnel and take over traffic, which is when the key icon appears in the status bar. The system only allows one app to hold this interface at a time, so two proxy apps can't run simultaneously.

The ability for Android clients to choose apps by package name for routing through the VPN tunnel, leaving everything outside the list unaffected. Commonly used to keep banking and payment apps on a direct connection to avoid triggering risk checks.

iOS's on-demand network activation mechanism. The system automatically triggers the VPN when a matching network request is detected, and disconnects automatically when idle. Rules are managed in the client's settings or the system VPN configuration, with no need to toggle it manually.

The general term for keeping the proxy process alive against system cleanup on mobile. Android relies on foreground services and battery optimization exemptions; iOS is managed by the system VPN framework. A process getting killed shows up as the proxy silently dropping and the status bar icon disappearing.