REFERENCE / CLASH TERMINOLOGY
Find configuration concepts by their interface labels. Browse five categories—cores, fields, rules, networking, and client features—to distinguish configuration sources, runtime settings, and request routing.
For your first setup, start with Getting Started. For a complete field reference and YAML examples, see the YAML Reference. This page explains key concepts and distinctions; a toggle's state alone does not prove how a connection behaves.
TERMS / 01
The client manages configurations and provides the interface; the core handles network operations. The protocol an app uses to connect to a local proxy does not have to match the protocol used to reach a remote server.
The core program handles proxy protocols, DNS, rule matching, and connection forwarding, while Clash Nyanpasu provides configuration management and a graphical interface. A setting in the interface does not guarantee that the active core supports its corresponding field; verify core capabilities separately. When troubleshooting, note the client version, core type, and active configuration rather than relying on the client name alone.
A node configuration describes a remote server's address, port, protocol, and authentication parameters. It is usually defined under proxies or in a proxy collection. A node is not a subscription: the former defines a connection, while the latter distributes configurations. After importing a node, requests still depend on the mode, rules, and proxy group; the node's presence alone does not mean traffic is using that route.
An application connects explicitly to a proxy interface and submits requests, or uses CONNECT to establish a tunnel. Here, HTTP describes how the application interacts with the local proxy; it does not mean the remote node can only handle web traffic or that every link uses unencrypted transport. Enter the actual local listening address and port in the application. The application usually remains responsible for validating certificates for HTTPS destinations.
An application uses SOCKS5 to submit a destination address to a proxy and establish a connection. The protocol supports TCP and defines a mechanism for forwarding UDP. Actual UDP use requires support from the application, proxy interface, and the rest of the route. Where DNS resolution occurs depends on whether the application submits a domain name or a previously resolved IP address; the proxy type alone does not determine the DNS path.
TLS provides peer authentication, encryption in transit, and integrity protection. It can secure web connections or provide a transport security layer for a proxy protocol. If a handshake fails, check the certificate, server name, system time, and network reachability. Skipping certificate verification weakens identity checks; investigate certificate or name mismatches instead of making this a routine setting.
TERMS / 02
Field names, hierarchy, and data types together determine what a configuration means. When reading an example, first identify whether a field is at the top level, under DNS settings, in a node definition, or inside a proxy group.
YAML uses indentation to represent mappings and lists. Clash configurations are typically saved as .yaml or .yml files. Use spaces for indentation, align fields at the same level, and introduce list items with a hyphen. Successful parsing only confirms that the structure is readable. The active core must still check whether fields are recognized, values are valid, and references exist.
This field lets HTTP and SOCKS proxy interfaces share a local listening port, so different applications can connect to the same service. It is not the same as a remote node's port, and it does not automatically update proxy settings in every application. If startup reports that the port is in use, identify the process using it before changing the listening port, then update any system or application settings that depend on it.
The general-purpose mode field determines whether requests use rule-based, global, or direct handling. Rule-based mode selects a policy according to rules, global mode uses the global policy, and direct mode connects to the destination directly. Mode controls how traffic is handled inside the core; system proxy and TUN control how requests reach it. Switching to global mode therefore does not capture traffic from every application.
In this DNS mode, the core returns a synthetic address to the application and keeps a mapping between that address and the original domain name, so later connections can still be handled by domain. The synthetic address is not the destination website's actual public IP address. Some applications that rely on real DNS results may need filtering rules. After changing settings, account for system, browser, and application caches so stale results do not skew your tests.
This field defines a reusable source of proxy entries, which a proxy group can reference by name using use. A proxy collection and a complete profile serve different purposes; do not assume the collection file includes DNS, rules, or general listener settings. If updates fail, check the source format, retrieval path, and proxy group reference separately, then confirm the collection is included in the final runtime configuration.
TERMS / 03
Rules determine which policy to use; proxy groups determine how an outbound route is selected. To troubleshoot a request, trace it through the matched rule, its target policy, and the final outbound route.
Rule-based routing chooses direct access, rejection, or a proxy policy based on a domain, IP address, or other request attributes. Rules are usually checked from top to bottom, and the first match determines the target; later entries are not evaluated for that request. Put more specific conditions before broader ones. After changing rules, verify the match in the log for a new connection rather than judging only by whether a page loads.
A proxy group organizes nodes, other proxy groups, or built-in policies as a target that rules can reference. select is primarily for manual selection, url-test chooses automatically based on test results, and fallback switches between options in order based on availability. Names alone do not determine behavior. Check the group type, member sources, and nested references for circular dependencies when troubleshooting.
GeoIP uses a local database to associate IP addresses with regions and supports matching rules such as GEOIP. An IP's recorded location is not the visitor's location and cannot precisely represent a website's content or legal jurisdiction. Database updates, content delivery networks, and shared infrastructure can all affect the result. If a request contains only a domain name, some IP-based rules may also trigger DNS resolution.
RULE-SET references a collection defined by rule-providers in the rule list, allowing longer rule sets to be maintained separately. The collection's behavior type and file format must match the provider declaration; do not mix a domain list with a complete rule list. Its position in the main rules still determines priority. Moving rules to an external file does not change first-match ordering.
MATCH is an unconditional rule, usually placed at the end of rules to assign a default policy to requests that have not matched earlier rules. If placed first, it prevents later rules from handling requests. Its target can be a proxy group or a built-in policy, but the reference must be valid. Choose direct access or a proxy as the fallback according to the purpose of the configuration.
TERMS / 04
Traffic capture, DNS resolution, and outbound selection are separate stages. An enabled toggle only indicates a configuration state; confirm the actual route using connection logs and system network settings.
System proxy writes a local proxy address to the operating system's settings, so apps that honor those settings send requests to the client. Programs with their own network stack, some command-line tools, and apps configured with a separate proxy may use another route. If the internet still does not work after closing the client, check whether the system has retained an invalid proxy address, then distinguish a proxy settings issue from a general network problem.
TUN uses a virtual network interface and routing configuration to send eligible network traffic to the core, and is often used for apps that ignore system proxy settings. It usually requires additional system permissions. The traffic captured also depends on route exclusions, protocol support, and the network environment. After enabling TUN, check DNS and rules as well; TUN is not a switch that automatically fixes every network issue.
A DNS leak occurs when queries bypass the expected resolution path and reach a different resolver. Whether this is a problem depends on your privacy and routing goals. Browser Secure DNS, app-level resolution, and system DNS can each use separate paths. Encrypted DNS only means the query is protected in transit; it does not prove the query uses the expected proxy route. Check DNS policies and routing together.
allow-lan controls whether devices on the local network can access the proxy listener, but actual reachability also depends on the bind address, firewall, and Wi-Fi isolation. Other devices must connect to the LAN address of the device running the client, not their own loopback address. Before allowing access, define who needs it and configure appropriate authentication or access controls to limit exposure of the proxy interface.
The connection latency shown in the interface usually comes from a request to a specific test address. The result depends on DNS, the handshake, the target's response, and current network conditions. It is not a measure of download speed and does not reflect performance on every website. For comparisons, use the same test target and method. If a test fails, check the logs to distinguish an unreachable test server, authentication failure, or a network issue.
TERMS / 05
A configuration shown in the interface may not match the final runtime file on disk. If settings revert after a subscription update or a profile switch appears to have no effect, first identify the configuration source and how the final configuration is generated.
A profile is a local configuration or remote configuration record managed by the client, usually with a name, source, and update settings. Switching profiles changes the configuration source, but the final content may also include client overrides and merged settings. When backing up, distinguish the original file, remote source record, and override content. Copying only a generated runtime file may not preserve the original configuration management setup.
A subscription distributes and updates a configuration or proxy collection through a URL. The response may be Clash YAML or a format for another client. An accessible link does not guarantee that the current client can parse its contents directly, so confirm the format and purpose before importing. Subscription URLs often contain access credentials and should be treated as sensitive information. Redact the full URL from screenshots shared for troubleshooting, and do not post source details publicly.
Overrides adjust fields in a source configuration, while merging combines multiple configuration layers into the final runtime configuration. This is often used to preserve local DNS, listener, or rule settings. How scalar values, mappings, and lists are handled depends on the client; do not assume every list is appended. Check the final configuration after making changes. Editing a temporary generated file directly may not survive the next update or profile switch.
The connections view shows request destinations, matched rules, and outbound routes, helping you check whether an application reaches the core and whether rules behave as expected. Switching policies usually affects new connections first; existing long-lived connections may continue on their original route. To verify a change, send a new request or close the relevant connections after considering the impact. Check the domain and rule logs instead of inferring behavior from the result alone.
log-level controls the amount of detail in logs. Common values include info, warning, error, and debug. Startup messages do not necessarily indicate a problem, and one failed connection does not mean the entire configuration is invalid. Use the timing and target request to narrow down the issue. After temporarily increasing the log detail, remember that logs may contain domains or paths. Remove sensitive information before sharing, then restore your usual level when troubleshooting is done.