mihomo, subscriptions, rules, TUN, and Fake-IP. Browse terms by their role in the configuration and distinguish UI options from core behavior and remote services.
This glossary covers 25 common terms. Use card titles to jump to an entry. For hands-on steps, see the Getting Started Guide; for setting combinations, see Advanced Config.
The client handles the UI and configuration management; the core handles connections. Check both when troubleshooting feature differences.
An app with an interface for importing subscriptions, choosing policies, and managing connections. UI actions are typically translated into configuration changes or requests to the core; available features depend on the client and core combination. Settings locations, override methods, and background behavior vary by client, so menu paths from one client may not apply to another.
A network proxy core that handles proxy connections, rule matching, and DNS requests. The project was previously known as Clash.Meta. It can run through a graphical client or on its own. Whether a configuration field in a guide works depends first on core support; a toggle in the UI does not mean an older core has the corresponding capability.
Clash.Meta was a former name used by the mihomo project, and Meta still appears in older guides and some client names. Check whether Meta refers to the core's former name or to a specific client. For example, Clash Meta for Android is the name of an Android client; the name alone does not reveal which core version or features it includes.
An API that lets a client or dashboard read status, switch policies, and manage connections. Its listening address is usually set with external-controller. It is not a proxy port for forwarding browser traffic. For local use, bind it to a loopback address. Before exposing it to other devices, configure authentication and restrict allowed connections.
The way a local app connects to a proxy endpoint and the protocol the core uses to connect to a remote node are two different layers.
A way for an app to send requests through a proxy server. HTTPS sites typically use CONNECT to establish a tunnel. A local HTTP proxy endpoint is not the same as the protocol the client uses to connect to a remote node. A browser can connect to an HTTP proxy port on the computer, then mihomo can choose direct access or a different protocol for the remote connection according to its rules.
A protocol for negotiating a destination address between an app and a proxy. It can carry TCP traffic and defines a mechanism for UDP forwarding. Check separately whether the app resolves domain names through the proxy. SOCKS5 does not encrypt traffic by itself. Actual UDP forwarding also depends on support across the app, local endpoint, selected outbound, and network.
An encrypted proxy protocol. A node configuration typically includes a server address, port, encryption method, and password. The client must support the specific methods and extensions used by the server. If the connection fails after import, check the encryption method, authentication parameters, and transport options—not just the node name or routing mode.
A proxy protocol that typically establishes an encrypted connection over TLS. Along with the server address and password, check that certificate verification, server name, and transport settings are configured correctly. For certificate errors, check the device clock, the domain on the certificate, and subscription parameters; disabling certificate verification should not be the routine fix.
Rules determine where a connection goes; proxy groups determine which outbound to use. Rule order and referenced names both affect the result.
Select an outbound policy—such as proxy, direct, or reject—for a connection based on its domain, IP, process, or other criteria. Rules are typically checked from top to bottom; the first match determines how the connection is handled. For example, DOMAIN-SUFFIX,github.com,Proxy routes the domain and its subdomains to the policy named Proxy, provided that policy exists in the configuration.
A named outbound that groups nodes, other proxy groups, or built-in policies for rules to reference. select lets you choose manually; url-test selects based on test results; fallback typically uses the first available outbound in the candidate list. Automatic selection depends on the test URL and conditions, and may not behave the same for every website.
Data and rules that match based on the geographic region associated with an IP address. Results depend on the data file in use and cannot establish a website's operator or the user's actual location. GEOIP,CN,DIRECT sends destinations matched by that region's data to the direct policy. CDNs, IP changes, and outdated data can affect the result.
A collection of matching criteria stored in a separate file and added to the configuration with rule-providers. Reference it by name in rules with RULE-SET, then specify the policy to apply when it matches. Make sure the file content matches the declared format and behavior type. Updating a rule set does not update a node subscription; they serve different purposes and contain different data.
DIRECT and REJECT are built-in outbound policies for direct connections and rejected connections, respectively. MATCH is a rule type that matches all remaining connections; specify a policy after it, for example MATCH,Proxy. It usually belongs at the end of the rule list. If it appears too early, later rules will never get a chance to match.
Domain resolution, traffic interception, and outbound selection need to work together. Enabling one setting alone does not mean the entire connection path has changed.
A system that resolves domain names into addresses and other records. mihomo's DNS module can choose resolution paths in conjunction with routing rules, but enabling it does not mean every app will use it. System resolvers, browser Secure DNS, and in-app resolution can take different paths. When troubleshooting, check both where queries go and the destination address used by the final connection.
A system that uses synthetic IP addresses to map domains to connections, allowing the core to recover the original domain when a connection arrives. These addresses are not the target website's real IPs, so the traffic must be intercepted along the right path. Some local network services and apps that rely on real DNS results may need entries in fake-ip-filter. Set it based on specific compatibility issues rather than disabling domain handling entirely.
A traffic interception method that receives IP packets through a virtual network interface. It can cover some apps that do not use system proxy settings. Actual coverage depends on routes, permissions, exclusions, and operating system limitations. TUN is not the same as global proxy mode: intercepted connections can still go direct, through a proxy, or be rejected according to rules. Also watch for routing conflicts with other VPNs.
A DNS leak occurs when domain queries reach a resolver other than the one intended. Check system DNS, browser Secure DNS, in-app resolution, and the scope of TUN interception when troubleshooting. The resolver locations shown by a test page are not conclusive on their own; compare them with the intended policy, connection logs, and possible bypasses such as IPv6.
Proxy server settings provided by the operating system to apps. Apps that honor these settings send connections to the specified endpoint; apps that ignore them may still connect directly. Turning on the system proxy therefore does not intercept all traffic. If the browser loses connectivity after the client exits, check whether the system still points to a port that is no longer open.
Identifying a destination domain from the handshake or protocol metadata of some connections to help match domain rules. What can be identified depends on the protocol, encryption, and client configuration. This does not decrypt HTTPS content, nor can it identify the domain for every connection. After enabling it, check DNS mappings and connection logs to see which rules actually matched.
Subscriptions provide configuration sources, YAML defines the structure, and local overrides preserve device-specific settings. Before making changes, confirm which configuration file is active.
A way to fetch node lists or full configurations from a remote URL. A subscription may return YAML, an encoded node list, or another format; its compatibility cannot be determined from the URL alone. A successful import only confirms that the content could be read, not that the nodes will work. Subscription URLs may also contain access credentials, so hide the full URL when sharing logs or screenshots.
A configuration for a remote proxy connection, typically including a server, port, protocol, and authentication parameters. A node's name is only a label and does not prove its actual location, exit characteristics, or connection quality. A successful test does not guarantee access to every website; results also depend on destination restrictions, DNS resolution, and the policy selected by the rules.
The time a client takes to send a request using a specified test method and receive a response. Results depend on the test URL, DNS, handshake, and network conditions; latency is not download speed. Results from different clients may not be directly comparable. A failed test may mean the test URL is unreachable, so check an actual destination and connection logs before judging the node.
A text data format that uses indentation to represent structure. Clash configurations are often saved as config.yaml. Use spaces for indentation, align keys at the same level, and follow the format rules for list items and strings. Passing YAML syntax validation does not mean the core supports every field; check the configuration load result and error location after saving.
A client mechanism for merging or changing specified fields outside the subscription's original configuration. Useful for keeping local rules, DNS, or port settings, though merge behavior depends on the client. Arrays may be replaced or appended. After making changes, check the active configuration to ensure subscription updates or duplicate rules have not altered the intended matching order.
A local listening endpoint configured with mixed-port that accepts both HTTP proxy and SOCKS5 connections on the same port. It serves a different purpose from the external controller API and cannot share its listening address and port. After changing the port, update apps where the proxy is configured manually. To allow other devices to connect, also check the listening scope, LAN permissions, and firewall.