Clash Glossary: Cores, Rules and Subscription Terms Explained

The program that reads configuration, opens connections and executes rules; subscriptions, nodes and proxy groups are all parsed by it. The GUI client is only a shell around it, providing the interface and switches; changing clients does not change routing results, only changing the core changes what features are available.

The open-source core renamed from Clash Meta, and the default core in most new clients today. It keeps the Clash configuration format while extending protocol support and rule capabilities; fields such as mixed-port, tun and proxy-providers in the config file are all parsed and executed by it.

The former name of mihomo, still used in many community tutorials and config files. When a core is labelled meta, it usually refers to an earlier build of the same core, and its config fields are largely compatible with mihomo; if you hit an unknown field, check the core version first.

The free-software license used by the mihomo core, which allows use, modification and redistribution, provided derivative versions keep the same terms. This licensing arrangement is a direct reason the client ecosystem has been maintained in parallel for so long.

An early, widely adopted proxy protocol designed to be lightweight and low-overhead: the config usually holds only a cipher, a password and a port. It has no built-in multiplexing or extra transport layer, so its feature set is clearly bounded, and it uses few resources on low-end devices and routers.

The main protocol in the early V2Ray project, with a built-in user ID and time check that requires client and server clocks to stay roughly in sync. It has many config fields, and a wrong parameter often means the connection simply fails; it has largely been replaced by the leaner VLESS.

A simplified successor to VMess that drops built-in encryption and the time check, leaving security to the underlying transport, so configs are shorter and handshakes faster. It usually appears together with TLS, WebSocket or gRPC, and is one of today's mainstream protocols.

A proxy protocol wrapped in TLS, where the server looks like an ordinary HTTPS server and the config is mainly a password and a domain. Its strength is reusing standard TLS ports and simple deployment; the trade-off is slightly higher handshake overhead than a bare protocol.

A QUIC-based proxy protocol with congestion control implemented in user space, so it keeps throughput on lossy links. It is UDP-friendly with stable latency, at the cost of higher CPU use, so watch heat and battery on low-power devices.

Another QUIC-based protocol, focused on low latency and connection migration, so connections rarely drop when you switch networks. It has fewer config options than Hysteria2 but narrower client support, so check whether your client bundles it before choosing.

A set of rules decides which proxy group each connection uses: when a domain, IP or process condition matches, the rule applies; if nothing matches, traffic falls through to the final MATCH rule. This is the heart of the config, deciding what goes direct and what goes through a proxy.

A file or remote URL that keeps a large rule list separate from the main config, referenced through rule-providers. The upside is that updating rules does not touch the main config and several configs can share one rule set; the cost is an extra load and cache management.

A set of selectable outbounds in the config, with common types select, url-test and fallback: manual choice, automatic choice by latency, and ordered failover. Rules point to a proxy group when they match, and what you switch in the UI is really the node currently selected by that group.

The format Clash config files are written in, using indentation for hierarchy and hyphens for list items. It is indentation-sensitive: mixing spaces and tabs or misaligning levels breaks parsing, which is the most common cause of config errors.

Rules are compared one by one from top to bottom and stop at the first match, so order is itself part of the policy. Putting broad rules first hides precise rules below them; when routing looks wrong, check the order first, then the rules themselves.

A URL from your provider that the client fetches on a schedule to build nodes and proxy groups. The link usually carries a token parameter that works like account credentials, so do not share it publicly; if the link expires or returns nothing, the node list is cleared with it.

A connectable server and its parameters, including address, port, protocol and cipher. A subscription usually contains several nodes, and the client places them in proxy groups for manual switching or automatic latency testing.

A complete configuration stored in the client, holding both subscription-generated nodes and local rules, DNS and proxy group settings. Most clients keep several profiles side by side, so when troubleshooting you can create a minimal profile to rule out interference.

An intermediary service that translates one subscription format into another, most often turning a generic link into Clash-readable YAML. The conversion rewrites node parameters and rules, so when something breaks, compare the raw content before and after conversion first.

A service that supplies subscription links and server resources; from the user side you see a link and a set of nodes. When comparing options, look at protocol types, node regions and update frequency — a large node count does not mean good usable quality.

The client points the system HTTP and HTTPS proxy at a local port, and the core takes over that traffic. It only covers programs that honour system proxy settings; terminal commands, some desktop apps and UDP traffic do not go through the proxy automatically, which is the first place to check when nothing connects.

The client creates a virtual network adapter and takes over all traffic at the system level, covering programs that ignore the system proxy and UDP traffic as well. Turning it on usually needs administrator rights, and DNS and routing must be handled properly, or you can end up with loops or a dropped connection.

Domain lookups that should be handled by the core are sent straight to a local DNS by the system or browser, leaving routing decisions without a basis. Common sources are the browser's own encrypted DNS, multi-adapter setups and port 53 that is not being intercepted.

The core first returns a virtual address from a reserved range for a domain, then matches rules by domain and opens the real connection. It removes the wait for a real lookup so the first packet responds faster, but programs that need the real IP must be excluded separately.

The time a request takes to make a round trip; the figure a client shows in a latency test usually comes from probing a test address. It reflects current line quality rather than download speed, and since clients use different test addresses, the numbers are not directly comparable.

The three takeover modes in a client: rule mode routes by config, global mode sends all traffic through the proxy, and direct mode bypasses the proxy entirely. Rule mode is the everyday choice; switching modes is a quick way to tell whether a problem lies in the rules or the line.

A database mapping IP addresses to countries or regions; the GEOIP conditions in rules and the region labels in the UI both come from it. The database needs regular updates, or newly allocated address blocks get classified as the wrong region.

The graphical shell around the core, handling subscription management, node switching, mode toggles and launch at startup. It translates user actions into configuration for the core to execute, so interface differences do not affect routing results — the core version is what defines the feature set.

A Tauri-based desktop client for Windows, macOS and Linux, where you can edit configuration and inspect connections and logs right in the interface. It bundles the mihomo core and suits desktop users who manage several profiles at once.

A cross-platform client whose desktop and Android builds share the same interface logic, with config import and proxy group switching on the home screen. It supports multiple profiles and rule editing, which suits users who want the same habits on phone and computer.

The most widely used Windows client in the early days; the original project is no longer maintained and does not follow new cores or protocols. Existing configs can still be exported and migrated to other clients, but it is not recommended as a first choice on a new install.

An all-platform client covering Windows, macOS, Android and iOS, with the iOS build available on the App Store and the official site at clashplus.io. It bundles the mihomo core, and subscription import and rule switching live in one interface.