CONCEPTS / TERM INDEX
From fields in a subscription to switches in a client: identify which layer a term belongs to before changing settings. This guide groups common concepts into five categories, with a link beside each term for direct navigation.
Protocols & Transport
Protocol names are not a speed ranking. First check client support, then verify the server settings. For a deeper look at the trade-offs, see the protocol and core technical reference.
Shadowsocks is a family of encrypted proxy protocols. A configuration usually includes the server address, port, password, and cipher. Legacy AEAD and Shadowsocks 2022 use different cipher names and key requirements; changing the name alone is not an upgrade. If an import reports an unsupported cipher, check which ciphers the core supports instead of repeatedly changing the port.
These are distinct protocols. Both commonly use a UUID, but sharing a UUID does not make their configurations interchangeable. VMess includes protocol-level encryption; VLESS does not encrypt payloads itself, so actual security depends on settings such as TLS. Also check the transport, server name, and path—not just the protocol field.
Trojan typically carries proxy traffic over TLS and commonly uses a password for authentication. The address, port, and password must be correct, and certificate validation and the server name must match. Pay particular attention to the server name when connecting by IP. For certificate errors, first check the system time, name, and certificate chain; disabling verification is not a good routine fix.
These are two distinct proxy protocols based on QUIC, and both depend on underlying UDP connectivity. QUIC's congestion control and multiplexing may help on some networks, but that does not mean it will always outperform TCP or use less power. If the current network restricts UDP, being able to browse directly does not prove these protocols can connect.
TCP and UDP are transport protocols, WebSocket and similar technologies provide a transport layer, and TLS provides encryption and authentication. These terms refer to different layers. SNI specifies the target server name during the TLS handshake; it is not the node's display name. When importing a configuration, check the protocol, transport, path, and TLS settings together.
Cores & Clients
An enabled button only confirms that a setting is on; it does not mean app traffic is going through the proxy. For step-by-step instructions, see the Clash setup guide.
The core handles protocol connections, rule matching, and DNS. The client provides the graphical interface, subscription management, and system integration. Similar interfaces do not guarantee the same features, and a client may switch to a different core version after an update. When a field is unsupported, note the client name and the version of the core actually running—not just “Clash.”
mihomo is a proxy core that continues the Clash configuration ecosystem and has a historical connection to the Clash.Meta name. It is not a specific desktop or mobile app. Its supported protocols and configuration extensions differ from those in the original Clash, so compatibility claims in older guides may no longer apply. When choosing a client, also check whether it exposes the core features you need through its interface or override settings.
System proxy registers a local proxy address with the operating system, such as an HTTP or mixed port opened by the client. Apps that follow the system proxy settings typically use this entry point, but some games, command-line tools, and apps with their own network stack may bypass it. If networking breaks after closing the client, check whether the system still has a proxy address configured for a port that is no longer listening.
TUN receives IP traffic through a virtual network interface and routing settings, and is often used for apps that ignore the system proxy. Enabling it usually requires additional permissions and may conflict with other VPNs, virtual adapters, or routing settings. TUN handles traffic entry; once traffic reaches the core, rules still determine how it is handled. It does not mean every destination uses a proxy node.
Rules & Routing
When troubleshooting routing, check both the matched rule and the final exit. A correct rule match does not mean the proxy group it references has the right node selected.
Rule-based routing chooses a policy for each connection based on conditions such as domain, IP, or process. Rules are usually checked from top to bottom, and the first match applies. More specific exceptions generally need to come before broader rules; otherwise, later exceptions may never take effect. To troubleshoot, check the matched rule in the connection log, then review its conditions before changing nodes.
Rule mode selects a policy from the rule set. Global mode applies a global policy to connections handled by the core, while direct mode favors direct connections. Global mode does not capture traffic that never reaches the core, and the global policy itself still needs to be set correctly. Switching modes temporarily can help narrow down a problem; restore the original routing mode when you're done troubleshooting.
A proxy group organizes nodes or other policies into an exit that rules can reference. select is commonly used for manual selection, url-test selects based on probe results, and fallback switches according to availability and configured order. Automatic selection reflects only the specified probe; a good result for the test URL does not guarantee the same performance on every site.
DIRECT and REJECT are policies for direct and rejected connections, while MATCH is a rule type with no additional matching conditions. They are not the same kind of setting. For example, MATCH,PROXY sends remaining connections to the policy named PROXY, which must exist. MATCH usually belongs at the end; otherwise, it can prevent later rules from being checked.
GeoIP classifies using IP datasets, while GeoSite classifies using domain lists; they solve different problems. Data files can be outdated, and sites may use CDNs across regions, so a classification does not prove a site's location or a node's quality. If a match looks wrong, check the database source, update time, and rule order. See the GeoIP and GeoSite guide for update instructions.
DNS & Networking
A successful DNS lookup, a successful connection, and a good download speed are three different things. First identify which step is failing, then decide whether to change DNS mode.
DNS resolves domain names to IP addresses and other records that apps typically need to connect. Proxy connections and DNS queries may take different routes, so connecting to a node does not prove the DNS path is correct. When troubleshooting, distinguish a DNS timeout, an unexpected response address, and a connection failure after resolution; each calls for different checks.
Fake-IP returns a mapped address to the app, while the core maintains the mapping between that address and the domain. 198.18.0.1/16 is a commonly used address range, not the website's real address. Some apps that rely on the actual resolved address may need the relevant domains excluded with fake-ip-filter. A reserved address is not necessarily a fault; check whether the app works and whether DNS requests pass through the core.
redir-host typically returns the actual resolved address to the app, unlike Fake-IP's address-mapping approach. It may work better with some apps that depend on real IP addresses, but lookup time, domain associations, and shared IPs can still affect how traffic is handled. After switching modes, apps and the system may retain old cache entries; clear relevant caches or reconnect before comparing results.
A DNS leak occurs when queries take a different path from the one intended—for example, when you expect a specific resolver to handle them but another resolver sends the requests. Secure DNS in the browser, app-specific resolvers, system settings, and IPv6 can all change the path, so a single toggle does not tell the whole story. The resolver addresses shown by a test page may belong to a forwarding or public DNS service; interpret them in the context of the actual query path.
Latency measures how long a particular probe takes; throughput measures how much data can be transferred over time. They are not interchangeable. A client's HTTP probe may include a handshake and response time, so it is not simply an ICMP round-trip time. Caching, the test endpoint, and network fluctuations also affect results. Compare nodes under the same conditions and verify performance with real-world connections rather than relying on a single number.
Subscriptions & Configuration Files
A subscription, a node list, and a complete configuration are not necessarily the same thing. If an import fails, check the format first. For steps, see subscription links and supported formats.
A subscription is a way to retrieve and update configuration or node details from a URL; it is not a proxy protocol. The URL may return a complete YAML file or just a node list, and whether it can be imported directly depends on the client’s supported formats. Subscription URLs often contain account identifiers, so treat them as sensitive. Redact the full URL in screenshots, and don't send it to an unfamiliar online conversion service.
A node is a set of connection parameters, usually including the protocol, server address, port, and authentication details, and sometimes TLS and transport settings. Its display name is just a label; it does not prove the server's physical location, bandwidth, or reliability. A subscription can contain multiple nodes, but adding a node to the list does not mean the current rules or proxy group have selected it.
YAML uses indentation to express hierarchy and is a common configuration format in the Clash ecosystem. Files typically include sections for listening ports, DNS, nodes, proxy groups, and rules. Use spaces for indentation, keep items at the same level aligned, and quote special characters when needed. A file that parses successfully may still use fields unsupported by the current core; when an import fails, check the syntax, field names, and core compatibility.
A Base64 subscription commonly contains an encoded list of node URIs. Decoding it may reveal connection details on separate lines, not a complete Clash configuration. Base64 is encoding, not encryption, and does not protect account details or passwords. Direct import depends on the client's parsing capabilities; support for a node protocol does not guarantee support for every subscription format.
A Provider loads and updates some resources separately: proxy-providers supplies a set of nodes, while rule-providers supplies a set of rules. Downloading a resource is not enough: a proxy group must reference the node set, and rules must call the rule set. Check both the resource status and its reference name, content format, and final rule order when troubleshooting.
Overrides preserve local settings when a subscription is updated—for example, changes to DNS or listening ports, or custom rules—without editing a downloaded file that may be overwritten. Clients handle merging, replacement, and array appending differently, so the same snippet may not work unchanged across clients. After making changes, check the effective configuration, especially where rules are inserted and whether proxy group names match.