Subscription, node, rule, core — these words show up in every tutorial but are rarely explained properly. This page covers the common terms across five categories, two to four plain-language sentences each. Hit an unfamiliar word while configuring? Come back here and check it, then keep going.
First, tell apart "the thing doing the work" from "the thing you see." The core forwards traffic; the client keeps you from touching a command line.
The command-line program that actually forwards traffic. It reads the configuration file, listens on a local port, then sends each request to the proxy or straight through, based on the rules. Everything you click in the GUI is ultimately carried out by the core.
A community-maintained fork of the Clash core, formerly Clash Meta. When the original core stopped updating, this fork took over and expanded protocol support. Mainstream clients today bundle this one; "the Clash core" usually means mihomo now.
A closed-source enhanced core once offered by the original Clash author, the first to support TUN mode and rule providers. It stopped updating when the original repository was archived; its features are now fully covered by mihomo, so read it as mihomo in older tutorials.
Software that wraps a graphical interface around the core, such as Clash Verge Rev or FlClash. They manage subscriptions, switch nodes, and toggle the system proxy — they don't forward traffic themselves. Switching clients doesn't mean switching cores; routing behavior usually stays the same.
The core creates a virtual network adapter and intercepts all system traffic at the network layer. Command-line tools and certain games that ignore the system proxy can only be covered this way. Enabling it needs administrator or equivalent privileges — that's why it asks for elevated access.
Every node in a subscription runs on some protocol. No need to dig into the internals — knowing each one's personality is enough.
A remote server that can relay traffic, along with its address, port, protocol, and key parameters. Every proxy entry in a subscription is a node. Node quality directly caps your speed ceiling — switching nodes is the first step in troubleshooting slowness.
A long-standing lightweight encrypted proxy protocol, often shortened to SS. Simple in structure and light on resources, even easy on mobile battery life, it's still supported by nearly every client.
The core protocol of the V2Ray ecosystem, authenticating with a UUID user ID. It doesn't disguise its traffic on its own, so in practice it's almost always paired with WebSocket and TLS.
A protocol that disguises proxy traffic as ordinary HTTPS access. It relies on the server holding a valid TLS certificate, looking indistinguishable from normal web browsing from the outside, with relatively simple settings.
A next-generation protocol built on QUIC, running over UDP with aggressive built-in congestion control. On links with heavy packet loss or long international hops, it often holds up better than TCP-based protocols. It needs a newer core like mihomo to work.
The transport-layer encryption standard — the "S" in HTTPS. In proxy scenarios it plays a dual role: making traffic look like a standard encrypted connection while also keeping the content unreadable to devices along the path.
Clash's core ability is sending each request where it should go. These terms decide the destination of every request.
A matching statement written line by line in the configuration, deciding whether a request goes through the proxy, connects directly, or gets rejected. Rules match top to bottom and stop at the first hit, so order matters; a trailing MATCH rule usually catches everything else.
A set of nodes bundled together with an exit strategy — manual selection, automatic latency testing (url-test), failover, and so on. Rules usually point to a proxy group rather than a single node, so switching nodes doesn't require editing rules.
A rule type and matching database based on IP location, with GEOIP,CN,DIRECT as the classic example — connect directly if the target IP is in mainland China. The database file needs regular updates, or location matching drifts out of date.
Rule data that packages domains by category. A single GEOSITE rule can cover hundreds or thousands of domains for one type of site, saving you from maintaining them one by one. It matches on domain name, ahead of DNS resolution, complementing GeoIP.
An external file holding a large set of rules, automatically pulled and refreshed by the core on a set schedule. The main configuration keeps just one reference line, leaving the rule content to a community-maintained list — a common way to keep configs tidy.
The link between provider and client. Understand these terms and importing a subscription stops feeling like guesswork.
A URL provided by a service, periodically fetched by the client to pull the latest node list and configuration. It's equivalent to your account credential — anyone with the link can use your traffic, so never share it publicly.
The process of converting a subscription in another client's format into Clash-readable YAML. Most providers already offer a Clash-specific link; if not, a conversion tool can generate one, and even apply a custom routing template along the way.
Usually named config.yaml, it centrally defines listening ports, DNS behavior, nodes, proxy groups, and rules — the sole basis on which the core runs. Importing a subscription essentially means the client downloads and manages this file for you.
The text format Clash configuration uses, expressing hierarchy through indentation — easy for both humans and programs to read. Indentation must use spaces; mixing in tabs or misaligning levels makes the core reject the file with a parse error.
A single port that accepts both HTTP and SOCKS5 proxy requests, commonly defaulting to 7890. When setting a proxy address for a browser extension or command-line tool, this one port is all you need.
A switch that lets other devices on the local network connect to this machine's proxy port. Once enabled, point a TV, game console, or tablet's network proxy at this computer's LAN IP and Mixed Port to share the same configuration — just remember to allow it through the firewall.
What happens after you're connected: why latency numbers lie, where DNS actually goes, and which apps skip the proxy entirely.
The client sends a request to a test URL and records the time in milliseconds. It reflects handshake speed to that specific address, not bandwidth, and not your real experience on the site you actually want to visit. A low-latency node can still buffer on video.
A DNS mode where a domain lookup immediately returns a virtual IP from a reserved range, with real resolution handled and mapped by the core as needed. This speeds up connection setup and reduces the impact of DNS pollution; a few apps that depend on the real IP need to be added to an exception list.
Traffic itself goes through the proxy, but domain resolution requests still go to the local network's default DNS, exposing your browsing intent. Properly configuring the core's DNS settings, or using TUN mode to take over resolution entirely, avoids this.
The operating system's proxy setting. Browsers and most apps that honor it hand their traffic to Clash's local port; apps that ignore the system proxy bypass it entirely. To capture everything, switch to TUN mode.
The ability to relay UDP-dependent traffic — game connections, voice calls — through the proxy. It requires support from both the node's server and the protocol in use; if game latency is fine but voice keeps dropping, this is usually off or unsupported.
Terminology is just the map; you still have to walk the road. For a first setup, start with Quick Start to import a subscription in three steps; for a system-by-system walkthrough, the multi-platform guide covers installation and settings for every platform; and if something breaks, check FAQ first — most issues have already been hit by someone else.