CLASH / CONFIGURATION GLOSSARY
Start by separating three questions: where the configuration comes from, which route a connection takes, and how the phone sends traffic to the client. The terms below are grouped into five categories, with a link beside each heading for direct access.
For a first-time setup, start with subscriptions, proxies, and rule routing. If the connection drops when the screen locks, check the mobile OS settings. For step-by-step instructions, see the user guide →
Subscriptions provide the content, the core applies the configuration, and the client handles the interface and system integration. When something goes wrong, first identify which layer is responsible.
A subscription is a remote source for proxies or configuration, usually provided as a link. Some subscriptions contain only a proxy list; others include rules, proxy groups, and DNS settings. Before importing one, check that its format is supported by your client. Updating a subscription usually refreshes its contents but does not extend the service period. Links may contain access credentials, so hide the full URL in screenshots and support requests.
A proxy is a connection entry containing details such as a server address, port, protocol, and authentication. Names in a list are labels, not verified exit locations or reliable indicators of connection quality. Importing a proxy only confirms that the configuration was recognized; usability also depends on authentication, network connectivity, and server status.
The latency shown for a proxy usually measures how long a request to a test URL takes through that proxy. It is not necessarily a standard ICMP ping. Results vary with the test URL, handshake, and current network, so measurements taken under different conditions are not directly comparable. Low latency does not guarantee fast downloads. If a test times out, first check that the test URL is reachable, then check the proxy.
mihomo is a proxy core evolved from the Clash.Meta project. It reads configuration, establishes connections, and applies routing rules. On mobile, the outer client usually provides buttons, subscription management, and system permissions; its version is not the same as the core version. Check whether the actual core supports a configuration field rather than relying on the client name alone.
YAML is a common text format for Clash configuration. Indentation represents structure, and lists organize proxies and rules. Use spaces, keep indentation consistent at each level, avoid tabs in indentation, and watch for duplicate keys. Valid syntax is only the first step: the core must also support the fields, and the referenced policy names must exist.
A protocol defines how a client communicates with a server. Even when the protocol name matches, check the transport, security, and authentication settings. Changing only the protocol type is not a reliable way to fix a connection.
Shadowsocks is an encrypted proxy protocol. Common settings include the server, port, encryption method, and password. The client and server must support the same encryption method; some configurations also require a compatible plugin and its settings. If a connection fails after import, check these details and the core's support. An SS label does not guarantee that every implementation is compatible.
VMess is a proxy protocol in the V2Ray ecosystem. It commonly uses a UUID as a user identifier and supports different transport methods. Besides the address and port, a proxy may require specific TLS, server name, path, or header settings. If authentication fails, check that your phone's clock is accurate. A UUID alone is usually not enough to recreate a working connection without the transport settings.
VLESS is a lightweight proxy protocol that does not provide transport encryption on its own; deployments commonly pair it with security mechanisms such as TLS or REALITY. It is a different protocol from VMess, so changing only the protocol name in a configuration does not convert one to the other. Support depends on the core's handling of the specific transport, security settings, and combination. Import the complete details provided by the server.
Trojan is a proxy protocol that typically runs over TLS and requires a matching password and security settings. The TLS server name is used for certificate validation and may differ from the connection address. If logs report a certificate error, check the device clock, server name, and certificate status. Do not routinely disable certificate validation as a workaround.
Hysteria 2 is a QUIC-based proxy protocol that typically requires UDP connectivity. If the current network restricts UDP, it may fail even when other proxy types work. Support for Hysteria does not guarantee support for Hysteria 2. For an unknown type or invalid parameter, check the core version and subscription format rather than deleting fields you do not recognize.
Rules decide which policy handles a connection; the policy then selects a proxy. The target named in a rule must match an outbound name defined in the configuration.
Rule routing selects an outbound route based on a connection's domain, destination address, or other conditions. Rule mode is usually the best choice for everyday use. Rules are generally checked from top to bottom, and the first match takes effect, so specific entries should come before broad ones. MATCH is commonly used as a catch-all at the end. When adding custom Clash rules, make sure the target policy exists.
Proxy groups combine proxies or other groups into an outbound that rules can reference. select lets you choose manually; url-test selects based on probe results; fallback uses the first available option; and load-balance distributes connections across routes. Automatic probe results can become stale, and load balancing does not combine bandwidth to speed up a single download.
Clash global mode sends regular connections that have reached the core through the global policy instead of matching them against routing rules one by one. It does not mean all traffic on the phone is captured; whether traffic reaches the client still depends on VPN, system proxy, and routing settings. You can switch modes temporarily to troubleshoot rule issues, then restore the mode you need.
GeoIP matches IP addresses against geographic assignments in a database and is often used to select an outbound route based on the destination address. Results depend on the database version, address allocation, and changes to service deployment. They do not establish a precise physical location or tell you which region a website's content belongs to. When domain and GeoIP rules are combined, rule order and DNS behavior affect which one matches.
Rule sets package domain or address entries into reusable lists, keeping the main configuration manageable. In mihomo, declare a source with rule-providers, then reference it with RULE-SET and specify an outbound. The list must match the declared rule type and file format. If an update fails, check the download path, format, and reference name separately.
DNS determines how a domain becomes an address; traffic capture determines whether a connection reaches the core. They are related, but controlled by different settings.
DNS resolves domain names to addresses so apps know where to connect. Clash DNS settings also affect domain matching and routing, but the phone OS, browser, or app may use its own resolver. Before changing anything, distinguish resolution for the destination website from resolution for the proxy server. Replacing every resolver indiscriminately can prevent the proxy itself from connecting.
Fake-IP assigns a virtual address to a queried domain, then lets the core associate subsequent connections with the original domain so domain-based rules can be applied. Both DNS queries and connections must pass through the relevant processing path; the virtual address is not the website's real server address. If an app is incompatible, configure an exception for that app rather than switching the entire DNS mode first.
A DNS leak occurs when DNS queries take an unexpected route—for example, when they go directly through the local network instead of to the specified resolver. Whether this counts as a leak depends on your configuration; a test page's reported resolver location alone is not enough. Check the system's Private DNS, browser Secure DNS, client DNS settings, and routing logs.
TUN receives IP packets through a virtual network interface, allowing more connections that ignore system proxy settings to reach the core. It is not a remote proxy protocol; traffic capture still depends on routing, permissions, and platform implementation. Desktop clients may require service permissions. On Android, VpnService commonly provides the interface, even if the client does not label the feature as TUN.
A system proxy provides an endpoint—usually a local listening address and port—to apps that follow the device's proxy settings. Apps that connect directly or use separate network settings may bypass it, so a working browser does not mean every app will work. System proxy and TUN differ in how they capture traffic, not in the speed of their proxies. After closing the client, check for leftover manual proxy settings.
A stable mobile connection depends on more than the proxy. Check system settings for first-run authorization, background restrictions, and VPN conflicts.
VpnService is Android's VPN API. Clients can use it to create a local virtual interface and handle traffic; system authorization is usually required on first launch. A VPN icon in the status bar means the tunnel has been established, not that the remote proxy is working. Typically, only one standard VPN can run at a time for a user or work profile, so starting another VPN app may replace the current connection.
A battery optimization exemption lets an app avoid some background battery restrictions, though manufacturers use different names for these settings. Your phone may offer options such as Unrestricted battery use, auto-start, and background activity. Check each option available on your device if the connection drops when the screen locks. An exemption cannot guarantee that the process will never be stopped, and it will not fix proxy or network failures.
Always-on VPN is an Android feature that keeps a selected VPN service running when conditions allow; availability depends on the client and system. It is separate from “Block connections without VPN,” which may cut off network access if the service is not ready. Before enabling it, make sure the subscription, proxy, and client work, and note how to return to the system VPN settings to disable the restriction.
An iOS VPN configuration is a connection record saved by the system. A compatible client requests authorization to add one when needed. It serves a different purpose from a subscription: the VPN configuration provides a system traffic-capture path, while a subscription provides proxies or rules. It is also distinct from a profile used for enterprise device management. If connection issues persist after removing the client, check the corresponding entry in iOS VPN settings; do not delete device management profiles by mistake.
Per-app proxying determines whether each app's traffic enters the proxy path. Android clients commonly use VpnService allowlists or exclusion lists. This is separate from domain-based routing rules inside the core: traffic from an excluded app usually is not routed by those rules. Check whether the list means “proxy only selected apps” or “bypass selected apps,” and do not assume iOS offers the same options.