A categorized index of proxy protocols, cores, and configuration fields. First identify which layer a concept belongs to, then check the actual client settings. A shared protocol name does not guarantee identical transport parameters or core support.
A protocol defines how the client and server exchange proxy traffic. Transport, authentication, and certificates are related but distinct configuration layers, so the protocol name alone does not determine connection performance.
Often shortened to SS, it provides encrypted proxy transport. A node typically needs a server address, port, encryption method, and password. The encryption method must match the server, and some nodes also require an additional plugin, so copying only the address and password is not enough. If the config imports but the connection fails, check whether the core supports the encryption method and plugin instead of repeatedly changing routing rules.
A proxy protocol in the V2Ray ecosystem that identifies users with parameters such as a UUID and is often paired with transport settings like WebSocket and TLS. VMess is a protocol; WebSocket is a transport. They are not interchangeable. When migrating an older config, check authentication fields, the transport path, and system time. A core recognizing the protocol name does not mean every legacy parameter combination will work as-is.
Typically carries proxy traffic over a TLS connection and uses a password for authentication. Check the server address, port, password, and TLS server name together; the IP used to connect can differ from the domain on the certificate. If certificate validation fails, check the certificate validity period, system time, and server name. Disabling certificate validation weakens connection authentication and should not be a routine fix.
A proxy protocol that separates authentication from transport security. The protocol itself does not provide full transport encryption, so connections typically also use TLS, REALITY, or another mechanism. The UUID, transport type, server name, and flow settings must match the server. When choosing a client, check not only that it supports VLESS but also that its core supports the specific transport and handshake combination required by the node.
A QUIC-based proxy protocol that relies on UDP and is often used where packet loss and congestion matter. The protocol name does not guarantee higher throughput: UDP connectivity, server load, and bandwidth settings all affect performance. If TCP-based nodes work on the same network but Hysteria2 times out, check the UDP path first and confirm the config uses the second-generation protocol fields.
A QUIC-based proxy protocol that uses features such as multiplexing to handle proxy connections and includes settings related to UDP forwarding. The client and server must agree on the protocol version, authentication parameters, and related options; older examples may not work with current implementations. On mobile networks, real-world performance also depends on network handoffs, signal quality, and background restrictions—not just a single latency test.
The core handles network traffic; the client provides the interface and system integration. When reporting an issue, include the app name, core name, and effective config separately to avoid ambiguity when assessing compatibility.
An early rule-based proxy core in the Clash ecosystem that laid the groundwork for config formats, proxy groups, and routing. It is not the same as graphical apps such as Clash for Windows, and the original open-source core should not be confused with the legacy Premium core. When following an older guide, first check which fork it targets; protocols and fields added by later cores may not work in older environments.
Meta was a name previously used by the mihomo project, so it still appears in older articles, config guides, and some client names. It refers to one line of core development, not a universal version shared by every app with Clash in its name. If a config claims Meta support, check the actual core version and fields in use; older cores may not include all the capabilities of current mihomo.
A rule-based proxy core developed along the Clash Meta line, handling protocol connections, rule matching, DNS, TUN, and other low-level functions. It can be managed by a graphical client or run independently in a compatible environment. App and core updates do not always happen together. When troubleshooting unknown fields or unsupported protocols, check the core actually running rather than relying on the installer name.
An app with interfaces for managing subscriptions, choosing policies, viewing logs, and changing system settings, such as Clash Verge Rev. The client combines subscriptions, UI options, and local overrides into a runtime config, so editing the subscription source file may not immediately change behavior. When choosing a client, consider platform integration, config management, and core compatibility. See the Client Comparison for details.
Routing answers two questions: which condition a connection matches, and which outbound is used after the match. Downloading rule data does not mean the main rules already reference it.
Chooses direct access, a proxy policy, or rejection based on conditions such as the domain, destination IP, or process. Rules are usually checked from top to bottom, and the first match determines the route; MATCH is commonly used at the end for remaining connections. Before changing the order, check the matched rule in the connection log and confirm the client is in rule mode. In global mode, changing rules usually will not produce the expected routing changes.
A database classifies IP addresses into regions and other categories, making it easier to route groups of destination addresses. These are database classifications, not guaranteed physical server locations or indicators of website ownership. A domain may resolve to CDN addresses in multiple regions, so routing can vary for the same service. When troubleshooting, note the actual destination IP and the data source.
Groups domains into categories defined by service, purpose, or maintainer, letting a label reference multiple domain-matching rules. Available labels and their contents depend on the data source; lists do not all use the same categories. The key difference from GeoIP is what gets matched: GeoSite targets domains, while GeoIP targets addresses. If only an IP is available and the domain is unknown, domain-based matching may not work.
Separates rule collections from the main config so they can be loaded and updated independently—useful for large domain or address lists. Settings such as behavior and format must match the file contents, and the provider must also be referenced with RULE-SET under rules. A successful download only means the resource is available; routing can still fail if the reference name, policy name, or rule order is wrong.
A set of nodes or other policies to choose from for outbound traffic. Rules usually target a group name rather than a specific server. select lets you choose manually; url-test selects based on test results; fallback switches according to availability and order. The group type controls selection logic, while the name is only a reference. With nested groups, follow the selection chain to the actual outbound instead of checking only the outer group name.
Check resolution and traffic paths together. System proxy settings, an app's own DNS, and a virtual network interface are separate entry points; enabling one does not keep the others in sync automatically.
A system that resolves domain names to addresses and other records, often as a prerequisite for network connections. The operating system, browser, and proxy core may each keep their own cache and use different DNS services, so changing system DNS may not affect the browser's lookup path. Also distinguish between resolving the destination domain and resolving the proxy server's domain: a failure in the latter can prevent the node from connecting at all.
The core first returns a virtual address to the app and stores a domain mapping. When the app opens a connection, the core uses that mapping to recover the domain and handle the outbound traffic. A virtual address is not the destination server's real address, so the lookup result alone cannot reveal the exit location. Some apps that rely on real addresses may need exceptions. Before changing a filter list, confirm the issue is caused by mapping compatibility rather than a routing or rules error.
Receives and processes IP traffic through a virtual network interface, covering some apps that ignore system proxy settings. TUN is not a proxy protocol or the same as global proxy mode; intercepted connections can still be routed directly or through a proxy according to the rules. It typically requires system permissions, routes, and network stack settings. When using it alongside another VPN or virtual interface, check for route conflicts and the scope of DNS interception.
A domain lookup takes an unexpected path instead of the intended one—for example, an app bypasses the core and uses the system resolver directly. A test page showing a particular DNS service does not, by itself, prove the entire proxy connection is failing; interpret the result against the expected setup. Check browser encrypted DNS, system resolution, TUN interception, and IPv6 routing, tracing each request back to its source.
The time a client takes to complete a request under specified test conditions. It may include connection setup, the handshake, and time spent waiting for a response, so it is not measured the same way as a system ping. Lower latency does not mean higher download bandwidth, and one timeout does not prove a node is consistently unavailable. Compare results with the same test URL, timeout, and network conditions, then consider packet loss, actual transfer speed, and access to the target service.
A remote subscription provides the input, local settings determine how it is combined, and the final runtime config is what the core actually reads. Keep a restorable config copy before updating so you can compare changes.
A way to distribute and update nodes or a complete config via a link. Depending on the format, it may contain only nodes or also include proxy groups, rules, and DNS settings. A link opening in a browser does not mean its contents are compatible with the current client; check the returned format and core fields. Subscription URLs may contain private access credentials. Redact the full URL from logs and screenshots to avoid exposing your config.
A set of server parameters that lets the core establish an outbound connection, typically including the protocol, address, port, authentication, and transport settings. A node's name in the UI is just a label; it does not prove the server's location, bandwidth, or availability. A working node also depends on the server being online and the local network path. After importing one, test the connection first, then check whether the proxy group actually selected it.
A structured text format commonly used for Clash configs. Indentation represents hierarchy; lists and key-value pairs organize settings. Use spaces for indentation: incorrect nesting, duplicate keys, or mishandled special characters can cause parsing errors or unexpected results. Valid syntax only means the text can be parsed; also check field names, data types, and core support. A valid file extension does not guarantee valid content.
The process of combining a subscription, local settings, and additional rules into the final runtime config, often to preserve custom DNS, routing, or port settings. Clients differ in how they handle override order, list replacement, and script timing, so similarly named features may not behave the same way. If settings revert after a subscription update, identify which layer contains the change and inspect the generated effective config directly.
A mechanism for loading a node collection separately, so node updates can be managed independently from proxy groups and rules in the main config. A proxy group usually needs to reference the provider with use; a successful download does not mean the nodes are available in the current selection list. Proxy providers supply outbound nodes, while rule-providers supply matching conditions. They are not interchangeable.