Look up terms by where they appear, from clients and protocols to rules and DNS. Each entry explains what a term does, where it applies, and common pitfalls; configuration keys remain unchanged.
The interface manages settings; the core handles connections. Ports, the system proxy, and the control interface each serve a different purpose.
mihomo, formerly known as Clash Meta, is a proxy core that reads configuration, establishes connections, handles DNS, and applies routing rules. Supported protocols and configuration fields depend on the version actually running, not just the client name. Desktop clients typically run it as a background component, but it can also run independently on a server.
See core troubleshooting →The client is the interface for importing subscriptions, choosing policy groups, and viewing logs; the core is the program that actually receives and forwards connections. They may be updated separately, so updating the client does not necessarily update the core. If a field is unsupported, note both versions to determine whether the limitation is in the interface or the core's parser.
Browse clients by platform →The system proxy points the operating system's proxy settings to a local listening address, so apps that follow those settings send requests to the core. Some games, command-line tools, and apps that manage their own connections ignore this setting; configure a proxy separately or use TUN instead. If the setting is not restored when the client closes, apps may keep sending requests to a port that is no longer listening.
A mixed port accepts HTTP proxy and SOCKS5 requests on the same listening port, giving apps a single entry point. A common example is mixed-port: 7890, but use the port set in your current configuration. When entering the proxy address, check the listening address and access scope too; a port already in use can prevent startup or cause connection failures.
The external controller lets dashboards check connection status and switch proxy groups. It is for management, not for forwarding app traffic. Entering its port in browser proxy settings will not work as a substitute for the mixed port. To access it from other devices, configure authentication and restrict allowed sources to avoid exposing management controls to the public internet.
A protocol defines how a client communicates with a proxy server. Matching protocol names are not enough; authentication, transport, and certificate settings must also match.
Shadowsocks is an encrypted proxy protocol. Node settings typically include a server address, port, password, and encryption method. The client and server must support compatible encryption methods; a wrong password or port can cause a timeout. If the node uses a plugin, its settings must match too. UDP availability depends on both implementations and network conditions.
VMess and VLESS are different proxy protocols, not interchangeable labels for the same node. Along with identity settings, a node may require transport and security options such as WebSocket, gRPC, or TLS, all of which must match the server. Changing type to another protocol does not convert the node, and older cores may not recognize newer fields.
Trojan typically uses TLS to protect connections and a password for authentication. If a connection fails, check the server and password, then verify the server name, certificate validity, and local system time. Supported transports vary by implementation; the protocol name alone does not mean the current core accepts every optional parameter.
Hysteria2 is a QUIC-based proxy protocol that requires the network to allow UDP traffic. Node availability depends on core support, authentication, certificates, and network UDP policies. Trying another protocol can help with comparison, but it does not prove that one protocol is faster on every network. Verify sustained throughput with real-world use.
TLS protects the connection and verifies the peer's identity. SNI tells the server which name the request is for during the handshake. The server address in the configuration may differ from the certificate name, so use the values provided for the node. For certificate errors, first check the name, system clock, and certificate status; disabling certificate verification is not a suitable long-term fix.
Rules decide where a connection goes; proxy groups decide which member to use. List order directly affects the outcome.
Rule mode checks connections against the rules list from top to bottom and applies the policy on the first matching line. Domain rules, IP rules, and rule sets can coexist, but specific rules should generally come before broader ones. A final MATCH,PROXY catches traffic that did not match earlier rules, provided the configuration defines a proxy group named PROXY.
DIRECT is the built-in direct policy, and REJECT is the built-in reject policy. PROXY is usually just a name the configuration author assigned to a proxy group, not a built-in group that always exists. A rule can reference an actual group name, such as DOMAIN-SUFFIX,example.com,PROXY. Direct means traffic is not forwarded through a proxy node; it does not bypass all processing by the local core.
Proxy groups organize nodes and other policy groups into targets that rules can reference. select lets you choose manually, url-test selects a member based on probe results, and fallback tries members in order until it finds an available connection. Automated policies measure performance against a specific probe target; they do not guarantee that every site will work equally well, and probe results are not download speed rankings.
GEOIP classifies by IP database, while GEOSITE classifies by domain lists; they match different types of data. GEOIP,CN,DIRECT requires usable IP data, and results depend on database updates. An IP's registered region does not fully describe a website's purpose or access requirements. For important services, use explicit domain rules rather than relying only on geographic classification.
Rule sets package rules as independently maintained data sources. Declare them with rule-providers, then add them to the rules list with RULE-SET. The data format must match behavior; for example, a domain list cannot be parsed as full rule lines. Rule set updates are separate from main subscription updates, and their position still affects the overall rule order. If an update fails, check the local cache and logs.
DNS resolution, connection interception, and network routing operate at different layers. Enabling one setting does not mean the others are configured.
DNS resolves domain names to network addresses. The core can handle queries and choose upstream resolvers according to its configuration. System DNS, browser built-in encrypted DNS, and core DNS may all be active at once, so changing one does not necessarily affect the others. To troubleshoot, first identify who sends the query and where it goes, then check upstream connectivity; this helps distinguish resolution problems from node failures.
Fake-IP assigns a mapped address to a domain so the core can retain the domain association for later connections and apply domain-based routing more easily. This is not the website's real IP, so it cannot be used to determine the server's location. For local network services or apps that need real DNS results, configure fake-ip-filter as needed. After changing it, clear stale DNS caches in the app and system.
TUN routes IP traffic through a virtual network interface into the core, which is useful for apps that ignore system proxy settings. Coverage depends on routes, exclusions, permissions, and the client implementation; enabling TUN does not mean all traffic goes through a proxy node. The current mode and rules still determine the exit route. When another VPN is running at the same time, check for conflicts in routing or DNS interception.
A DNS leak occurs when queries leave through an unexpected route or resolver. First establish the expected DNS path before testing. Common troubleshooting checks include system DNS, app-level encrypted DNS, IPv6 routing, and the core's DNS interception settings. A test page showing a resolver name is only a clue; it cannot reveal every traffic path. Confirm with logs, network settings, and repeat tests.
See DNS troubleshooting →IPv6 is a network protocol that coexists with IPv4; DNS AAAA records can return IPv6 addresses. Having an IPv6 route on the system does not mean the proxy node or core supports the same path. If some sites connect directly or time out, check DNS responses, system routes, and proxy handling separately. Temporarily disabling IPv6 can be useful for comparison, but it does not identify the underlying cause.
A subscription is a source, nodes define connection settings, and the configuration determines overall behavior. Local changes must also account for update overwrites and merge order.
A subscription is a remote source of node lists or full configurations, not a client or proxy core. Its contents may include only nodes or also rules and proxy groups, so after importing, confirm that the format works with your client. Subscription URLs may contain account identifiers; redact them before sharing logs or screenshots. Local changes may also be overwritten by the next subscription update.
See how to import a subscription →A node describes the server, protocol, port, and authentication settings needed for a proxy connection, usually maintained by the subscription provider. Its name is only a label; a region or route name does not confirm the actual exit location, protocol capabilities, or reliability. Choose based on access to the services you need, sustained performance, and account billing terms, not just the name in the list.
The latency shown by a client is usually the time taken to complete a specified probe request; what it includes depends on the implementation and test method. A lower value does not mean higher download bandwidth, and a timeout may simply mean the probe target is unreachable. Compare results only when the test address, network, and timing are similar, then verify node quality with real websites and sustained transfers.
YAML is a common configuration format; config.yaml is a common filename, not a separate configuration protocol. Indentation with spaces expresses hierarchy, and list items usually begin with a hyphen. Tabs or incorrect indentation can cause parsing failures. Valid syntax does not guarantee that the current core supports every field. Save a working copy before editing, then check the client logs to confirm the result loads.
Configuration overrides let you add or change local settings on top of a subscription, such as custom rules, DNS, and ports. Clients differ in how they append lists, replace fields, and apply changes, so an override file from one client is not a universal standard. After editing, review the final effective configuration, check rule order and group references, and back up both the original subscription and override settings.