Clash Glossary: mihomo, Subscriptions, Routing Rules & DNS

Cores and Clients

First, distinguish the interface you use, the core that forwards traffic, and how traffic reaches the core.

mihomocore / proxy engine: Think of it as the program that handles connections. Formerly known as Clash Meta, mihomo reads configuration, handles DNS, matches rules, and forwards requests. Client and core updates do not always happen together. To check whether a field is supported, verify the running core and its version—not just the app's name.

GUI Clientgraphical user interface: Use it to import subscriptions, choose proxies, and view logs without entering every command manually. GUI stands for graphical user interface; a proxy core usually runs behind it. Even when two clients use the same core, they may differ in how they merge configuration, manage permissions, and save settings.

System Proxysystem proxy / app traffic entry point: Use it first to direct apps that follow system settings to a local proxy port. Enabling the system proxy usually just sets a proxy address; it does not capture all traffic. Some command-line tools, games, and apps with their own network stack may ignore this setting. If your network behaves unexpectedly after closing the client, check whether an old proxy address is still set in the system.

TUN Modevirtual network interface: If an app ignores the system proxy, consider routing its traffic through a TUN virtual network interface. TUN works with system routes to send connections to the core and typically requires administrator privileges, service mode, or system VPN authorization. Turning it on does not guarantee traffic is being captured: check routes, DNS, and exclusions, and watch for conflicts with other VPNs.

External Controllerexternal-controller / management interface: A client or dashboard can use this interface to check status, switch policies, and manage connections. The external-controller field sets its listening address, for example 127.0.0.1:9090. This is not the proxy port you enter in a browser. For local management, keep it bound to localhost; plan authentication and access controls before allowing remote access.

Configuration Fields

Learn the file structure, then check which values are actually in effect. Don't edit only the original file you downloaded.

YAMLconfig.yaml / structured text: When editing a configuration, preserve its existing indentation. YAML is a structured text format commonly used for config.yaml: indentation defines nesting, hyphens mark list items, and spaces—not tabs—should be used for indentation. Values containing special characters may need quotes. Check the syntax before reloading the saved configuration.

mixed-portlistener / mixed proxy port: Set the app's proxy port to the value actually used by this field. mixed-port: 7890 accepts both HTTP and SOCKS proxy connections on the same port, but the number can be changed and is not fixed across all clients. If another program is using the port, the core may fail to listen. Check the logs before changing settings on either side.

allow-lanlocal network access: Enable this only if other devices on your local network need to use the proxy. allow-lan: true allows LAN connections, but access also depends on the listening address and system firewall. Before opening access, make sure the network is trusted and configure authentication as needed. This setting is not required for your own device to connect to the internet.

moderule / global / direct: For everyday use, start with mode: rule so requests are routed according to rules. global sends connections through the global policy, while direct connects directly. Global mode still applies only to traffic that reaches the core. Switching modes does not route apps through the proxy if they bypass the core.

log-levellogging / log verbosity: Use this field to adjust log verbosity when troubleshooting. Common values include info, warning, error, and debug. More detailed logs can help identify parsing, rule, and connection issues, but generate more output. Before sharing logs, remove subscription URLs, authentication details, and any access records you do not want to disclose.

Proxy Protocols

Distinguish how an app connects to a local proxy from the protocol the core uses to connect to a remote server.

HTTP ProxyHTTP / CONNECT: In apps that support manual proxy settings, choose HTTP proxy and enter the listening address. HTTPS websites usually use the CONNECT method to establish a tunnel. HTTPS between the app and destination is separate from encryption between the app and proxy. A standard HTTP proxy does not automatically encrypt every link or provide general-purpose UDP forwarding.

SOCKS5TCP / UDP ASSOCIATE: If the app supports it, use SOCKS5 to send connections to a local proxy. The protocol supports TCP and defines a mechanism for handling UDP, but the app, client, and remote connection must all support it. Whether the app resolves domains locally or through the proxy depends on how it uses SOCKS5; choosing SOCKS5 alone does not guarantee that DNS goes through the proxy.

ShadowsocksSS / encrypted proxy protocol: When importing this type of proxy, check the server address, port, password, and encryption method. Shadowsocks carries proxy traffic using parameters agreed between both ends; mismatches usually prevent a working connection. Support for specific encryption methods and extensions varies between cores, so the proxy's name alone does not establish compatibility or speed.

VMessUUID / transport settings: Check the UUID and transport settings together. VMess supports different transport options, and a correct address and port are not enough if the path, hostname, or TLS settings do not match. A badly configured system clock can also affect authentication, so check time synchronization and core logs when troubleshooting.

TrojanTLS / server authentication: When connecting to this type of proxy, check the password, server name, and certificate requirements. Trojan typically carries proxy traffic over a TLS connection, which protects traffic and verifies the server's identity. If you encounter a certificate error, check the system clock, domain name, and server configuration first. Disabling certificate verification is not a standard fix.

Rules and Routing

Check the match conditions, then the exit name. Rule order and data files can both affect the result.

Rule-Based Routingrules / choose an exit by condition: In rule mode, conditions such as the domain or destination IP determine where a request goes. Rules are usually checked from top to bottom, and the first match determines the exit, so put specific exceptions before broader rules. An exit can be DIRECT or a policy group; the group name must match the one defined in the configuration.

DOMAIN-SUFFIXdomain matching / domain suffix: Use this rule type to match a domain and its subdomains. For example, DOMAIN-SUFFIX,example.com,DIRECT matches both example.com and www.example.com. Matching respects domain suffix boundaries; it will not match another domain just because it contains the same text.

GeoIPGEOIP / IP address classification: Use GeoIP data to route traffic based on the country or region associated with an IP address. The rule GEOIP,CN,DIRECT sends addresses classified in the CN set by the database to a direct connection; matching domain requests may require DNS resolution. Databases can be outdated or inaccurate, and an IP's label does not guarantee a server's physical location.

GeoSiteGEOSITE / domain collection: Use GeoSite collections to manage large numbers of domains by service or category. Unlike GeoIP, which classifies IP addresses, GeoSite primarily matches maintained domain entries. Available category names depend on the data file in use. Before adding a rule, confirm that the category exists and that the data source works with your core.

MATCHfallback rule / catch-all rule: Add MATCH at the end of the rule list to set an exit for requests that did not match anything earlier. For example, MATCH,PROXY sends remaining requests to the policy named PROXY. MATCH does not determine a website's region; if placed too early, it prevents later rules from checking requests that should reach them.

DNS and Networking

Check domain resolution and connection establishment separately. No single switch explains every network issue.

DNSdomain name system: Before connecting to a domain, an app usually queries DNS for its IP address and other records. Resolution and the subsequent web connection are separate steps, so reaching an IP address does not prove that domain resolution is working. The system, browser, and proxy core may all handle DNS. When troubleshooting, first identify what is sending the query and which resolver it uses, then adjust the relevant setting.

Fake-IPenhanced-mode / synthetic address mapping: With this DNS mode enabled, the core returns a synthetic address to the app and stores a mapping between that address and the domain. When the app connects to the address, the core uses the domain to handle the request, so the address shown may not be the website's real public IP. Some apps and LAN services may not support Fake-IP; configure filters for specific domains rather than repeatedly switching proxies.

nameserverupstream resolver: Use this field in mihomo's dns section to specify upstream resolvers. The list can use address formats supported by the core, but domain policies, proxy-node DNS settings, and other fields may affect which resolver handles a particular query. This is not necessarily the sole route for all system DNS requests. After changing it, check the traffic capture scope and cache as well.

DNS Leakresolver path / unintended DNS routing: First define the expected DNS path, then check for leaks. The term usually means queries reach an unintended resolver—for example, web traffic uses a proxy while domain lookups still go through the local network. Interpret test results alongside browser secure DNS, system settings, TUN capture, and caching. A difference in resolver location alone does not show how all traffic is routed.

DNS Hijackingdns-hijack / DNS redirection in TUN: In mihomo configuration, dns-hijack redirects matching DNS requests to the built-in resolver. This is different from the usual meaning of maliciously altering DNS results. It is often used with TUN, but only captures specified targets and protocols. Do not assume it will automatically detect and capture encrypted DNS requests from a browser.

Subscriptions and Proxies

Understand the configuration source, individual connection parameters, and exit selection separately before interpreting test results.

Subscription URLsubscription / configuration source: Import the subscription URL from your provider into the client to download a configuration or list of proxy entries. URLs can return a full YAML file, an encoded list, or another format, so use the import method supported by your client. Subscription URLs often contain account access tokens; treat them like credentials and do not expose them in screenshots or support requests. A failed update does not necessarily mean every proxy has stopped working.

Proxy Entryproxy entry / connection profile: Think of a proxy entry as a set of connection parameters for the core, usually including a server address, port, protocol, and authentication details. Its display name is set by the configuration provider and may not accurately reflect its actual location or exit. Access to a particular service also depends on the route, remote exit, and destination restrictions, so the name alone is not enough to judge it.

Latencylatency / time for a specific test: Check the test method and target address before comparing latency values. A client test usually measures how long a specified request takes through the proxy, and results depend on the network, connection setup, and target response. It is not simply an ICMP round-trip time. Low latency does not mean high download bandwidth, and a timeout may only mean the test target is unreachable.

proxy-providersproxy collection / proxy source: Use this field to define a proxy collection that can be updated independently from a remote URL or local file. Policy groups can reference the collection to use its proxies and run updates or health checks as configured. It usually manages proxy entries only; it does not replace a full configuration with DNS and rules. Not every subscription URL can be pasted here as-is.

Proxy Groupproxy-groups / exit selection: Use a proxy group to provide a single exit name when choosing among multiple proxies. select is typically for manual selection, url-test chooses based on test results, and fallback checks entries in order for an available option; exact behavior depends on the parameters. Once a rule points to a group, the selection within that group still affects the connection. When troubleshooting, check both the matching rule and the final proxy.