Clash Meta Configuration Glossary

Also known as: Meta Kernel

mihomo is the proxy kernel name that evolved from Clash Meta, responsible for reading configuration, listening on local ports, establishing remote connections, and matching rules. GUI clients package subscription management, policy switching, and log viewing into an interface, but the kernel still performs the actual traffic processing.

Clients may bundle kernels from different release periods, so the same configuration can behave differently in terms of field compatibility. For unknown fields or startup failures, first confirm the kernel type and update status used by the client.

Related: mihomo, Meta Configuration

Clash Meta originally referred to a kernel branch that extended Clash with additional protocol, DNS, and traffic-interception capabilities, and is also used for the client ecosystem built around that kernel. In current technical documentation, determine from context whether Meta kernel specifically means mihomo.

Clash Meta is not the exclusive name of any single GUI client. Windows, macOS, Android, iOS, and Linux clients may use different interfaces, while their underlying configuration concepts are broadly similar.

English: Graphical User Interface Client

A GUI client provides a graphical control layer for the proxy kernel. Common functions include importing subscriptions, selecting policy groups, switching proxy modes, enabling or disabling the system proxy, and viewing logs. It reduces the need to edit configuration files directly but does not change the meaning of configuration fields.

Interface switches ultimately become kernel parameters or system settings. When comparing clients, examine interface features, kernel versions, platform integration, and configuration compatibility separately; button labels alone do not show whether capabilities are equivalent.

Configuration key: mixed-port

Mixed Port is a local listening port that accepts both HTTP and SOCKS5 requests. An application only needs to connect to this port, while the kernel handles each request according to its type, making it useful for desktop setups that aim to reduce the number of configured ports.

It is different from a remote node port: Mixed Port waits for application connections on the local machine, while a node port connects to a remote service. If another program already occupies the local port, the kernel may fail to start listening and report a bind error in the logs.

Related: virtual network interface, route interception

TUN mode receives system traffic through a virtual network interface, then lets the kernel choose an egress according to the rules. It suits apps that ignore system proxy settings and covers a broader range of connections than a standard HTTP proxy.

Enabling TUN usually involves system permissions, the routing table, and DNS settings; some platforms also require a service component. For unreachable LAN resources, dropped connectivity, or DNS failures, check TUN routes, interface exclusions, and the DNS operating mode together.

English: Proxy Node

A node is a proxy connection entry available to policy groups in the configuration, usually containing a name, server address, port, protocol type, and authentication parameters. Its name is mainly for identification in the interface and does not necessarily reflect line quality or location.

A node appearing in the list only shows that the configuration was parsed; it does not prove that the connection has been verified. To confirm availability, also check DNS, the handshake, certificates, authentication details, and the remote service status.

Related: authentication, transport, encryption

A proxy protocol is the communication standard a client follows when establishing a proxy connection with a remote service. Protocols require different authentication fields, encryption methods, and transport parameters, so the protocol type cannot be changed arbitrarily even when the server address is the same.

When converting a subscription or editing configuration manually, one missing key field can cause a handshake failure. Timeouts, authentication failures, and certificate errors occur at different stages and should be checked against the relevant protocol.

Abbreviation: SS

Shadowsocks is a common encrypted proxy protocol. Configuration usually includes a server address, port, password, and encryption method. The client and server must use the same encryption method; mismatched fields prevent a valid session from being established.

Some configurations also include plugin or transport options, which require kernel support. If a node fails after import, confirm that the subscription conversion did not drop the plugin fields.

Common combination: Trojan + TLS

Trojan typically carries proxy traffic over a TLS connection. Key settings include the server address, port, password, server name, and certificate verification. The server name is used during the TLS handshake and may differ from the node's display name or connection address.

A certificate error should not be dismissed as a latency issue. System time, the server name, the certificate chain, and interference from the network between endpoints can all affect TLS verification; use the specific log error to identify the cause.

Related transports: TCP, WebSocket, gRPC

VMess and VLESS are two common proxy protocols that may use TCP, WebSocket, gRPC, and TLS in various combinations. Similar names do not make their fields interchangeable; user IDs, encryption options, flow control, and transport parameters must be handled separately.

When troubleshooting these nodes, verify the protocol first, then check the transport path, hostname, and TLS settings. Changing only the port or policy group usually cannot fix a connection failure caused by mismatched fields.

English: Rule-Based Routing

Rule-based routing chooses an egress based on the domain, destination IP, source IP, process, or an external rule set. A matching connection can be sent to a proxy policy group, connected directly, or rejected according to the configuration.

Routing results depend on rule order and the information the client actually receives. If a domain has already been resolved to an IP outside the system, some domain rules may lack the information needed to match; check the DNS mode in that case.

Common interface label: Rule

Rule mode checks connections against the rules list from top to bottom, with the first matching rule usually determining the policy. It supports direct, proxied, and other egresses without forcing all traffic through one node.

After switching to rule mode, node selection within policy groups still applies. Rules decide which group receives a connection; the policy group then decides which node or action that group uses. They are separate layers.

Configuration key: proxy-groups

A policy group combines multiple nodes or other policies into one logical egress. Rules usually reference the policy group name rather than an individual node. Common types include manual selection, automatic testing, failover, and load balancing.

Policy groups can reference other groups, creating multiple layers of selection. When renaming a group, also check references in rules and other policy groups; otherwise the configuration may fail to load or fall back to an unexpected egress.

Related: Rule Provider

RULE-SET references a separate rule collection from the main rules list and sends matching connections to a specified policy. Large domain or IP lists can be maintained separately instead of being written into the main configuration.

A rule collection must first declare its source, behavior type, and update interval in the Provider section. If the remote file cannot be downloaded, its format does not match the behavior, or the reference name is wrong, the RULE-SET will not work as expected.

Example meaning: GEOIP,CN,DIRECT

GeoIP matches the geographic association of the destination IP in a database. It handles IP addresses rather than domain text, so results are affected by the resolved address, database version, and content delivery network routing.

The same domain may resolve to addresses in different regions on different networks, changing the GeoIP result. For precise domain-based control, place domain rules before the relevant GeoIP rule.

Purpose: final fallback

MATCH usually appears at the end of the rules list and receives connections not matched by earlier rules. It determines the default egress for unknown traffic and is essential when reviewing rule configuration.

If MATCH appears too early, later rules never get a chance to match. If many connections fall into MATCH, check whether preceding rules loaded successfully, whether domain information is available, and whether the rule type fits the current traffic.

Common form: remote URL

A subscription is a configuration source published and periodically updated by a service provider. It may contain nodes, policy groups, rules, or a converted complete YAML file. After saving the subscription URL, the client requests it again manually or on a configured schedule.

A subscription opening in a browser does not mean its response is suitable for the current client. For parsing failures, also check the response format, field compatibility, access permissions, and output from any intermediary conversion service.

Configuration extension: .yaml or .yml

YAML is a common text serialization format for Clash configuration. It uses indentation for hierarchy and colons, hyphens, and lists to organize fields. Because it is sensitive to indentation and character structure, pasted tabs or damaged spacing can cause parsing failures.

Valid syntax only means the document can be parsed; it does not mean every field is supported by the current kernel. After editing, check the load log first, then verify that policy groups, DNS, and rules appear completely.

Configuration key: proxy-providers

Proxy Provider splits a node list out of the main configuration into a separate source, using a local file or remote URL and defining an update interval and health checks. Policy groups reference Provider nodes through the use field.

A successful Provider update does not mean the main subscription was replaced; they follow separate update paths. When investigating an outdated node list, confirm whether the current nodes come from the main configuration or a Provider.

Common client label: Profile

A configuration file is a YAML document that stores settings such as ports, DNS, nodes, policy groups, and rules. A client can save multiple configurations, but usually only the selected profile is loaded into the kernel.

Switching configurations changes the entire set of policies and listening parameters; it is not the same as switching only the node. If an edit has no effect, confirm that you edited the active configuration and perform the required reload or kernel restart.

Common units: seconds, minutes, or hours

The automatic update interval is the time a client or Provider waits before requesting remote content again. Shorter intervals receive changes sooner but increase request volume; longer intervals keep nodes and rules outdated for longer.

An update interval cannot repair an invalid subscription URL. If a manual update also fails, check reachability, the response status, proxy loops, and subscription format before changing the interval.

English: Domain Name System

DNS converts domain names into IP addresses. Clash Meta can configure upstream resolvers, fallback paths, and routing behavior so domain lookups work with proxy rules.

Whether a domain resolves, which path carries the lookup, and which egress the connection ultimately uses are related but distinct questions. After changing DNS, reload the configuration and create a new connection to avoid stale caches affecting the result.

Configuration value: enhanced-mode: fake-ip

Fake-IP mode returns reserved addresses to applications while the kernel maintains mappings between those addresses and the original domains. When an application connects to a reserved address, the kernel can restore the domain, then apply domain rules and perform the real resolution.

Some LAN devices, special domains, or apps that depend on real resolution may need to be added to the filter list. For LAN discovery, login verification, or app-specific failures, check fake-ip-filter instead of deleting all DNS configuration.

Diagnostic focus: resolution path

A DNS leak occurs when domain queries do not follow the configured resolution path and are instead sent through another network interface, the system DNS, or an unintended upstream. It describes a deviation in query routing and does not mean every connection bypasses the proxy.

During testing, observe system DNS, browser secure DNS, TUN settings, and Clash logs together. Seeing a particular resolver on a test page does not by itself identify the leak source; compare it with the current network and upstream configuration.

Common unit: ms

Latency is the time a test request takes from being sent to receiving a response. The value shown by a client usually targets a specified test address and reflects the path, handshake, and target response at that moment.

Lower latency does not guarantee faster large-file transfers or prove that every site uses the same path. When choosing a node, also consider connection stability, packet loss, bandwidth, and actual access results for the target service.

Related: HTTP, HTTPS, SOCKS

The system proxy points the operating system's proxy settings to Clash's local listening port, sending requests from apps that follow those settings to the kernel. It usually does not affect apps that ignore system settings and does not automatically cover all UDP traffic.

Restore the system proxy state before closing the client to prevent the system from pointing to a local port that is no longer listening. If the browser works but other apps do not, check whether those apps support system proxy settings or consider TUN mode.

Common symptoms: update timeouts, repeated connections

A proxy loop is an abnormal state in which a proxy request is sent back to the same proxy entry and forwarded repeatedly along the path. Subscription updates, node connections, or local services can form a loop if they incorrectly inherit the system proxy.

For troubleshooting, temporarily disable the system proxy, check whether subscription requests are being proxied, and review app exclusions and TUN routes. Repeated connections to the same target and local port in the logs are an important clue.