Clash Configuration Reference
A focused guide to common concepts in the mihomo core, proxy modes, rules and routing, DNS, and configuration files. Use the categories or alphabetical index to find unfamiliar fields quickly.
Distinguishes the GUI client, proxy core, control interface, and external resources. The interface provides the controls; the core handles actual connections and traffic.
The proxy core evolved from Clash Meta, responsible for protocol connections, rule matching, DNS handling, and traffic forwarding. Many desktop and mobile clients use mihomo as a backend while adding configuration management, tray menus, and system proxy controls. Client and core versions are not always synchronized, so check them separately when verifying feature support.
The core program that reads configuration files and handles proxy connections, rules and routing, and DNS resolution. It can run independently or be launched and managed by a GUI client. Original Clash, Clash Meta, and mihomo belong to the same ecosystem, but their fields and feature scopes differ; use the current core documentation when migrating configurations.
The communication standard used when a node connects to a remote server. A configuration commonly includes the server address, port, authentication details, transport method, and encryption parameters, all of which must match the server. The same protocol name does not guarantee compatibility with every extension, so confirm that the current core supports the relevant fields after importing a configuration.
A control interface provided by the core. GUI clients can use it to read proxy groups, active connections, logs, and rule status, and to submit actions such as switching proxies. Common settings include a local listen address and port. If LAN access is allowed, also set an access secret and restrict the reachable scope.
A mechanism for loading node or rule collections from separate files or remote URLs. Proxy Provider maintains nodes, while Rule Provider maintains reusable rules; their data formats and reference locations differ. Providers can define update intervals, health checks, and local cache paths, so the main configuration does not need to contain every detail.
Proxy mode determines how traffic entering Clash chooses an exit; system proxy and TUN determine which application traffic can enter the core.
Evaluates each request against the rules in configuration order to decide whether it should connect directly, use a proxy, or be rejected. Rules can match domains, IPs, processes, and external rule sets, making this the most common mode for everyday use. After switching to Rule, ensure each proxy group has a working exit; otherwise a rule targeting that group may fail to establish a connection.
Sends all traffic entering Clash through a selected proxy group instead of evaluating the usual routing rules individually. It is useful for temporarily testing whether a node works or isolating access problems caused by routing rules. Global only changes exit selection inside the core; it does not automatically capture application traffic that never enters Clash.
Sends connections entering the core directly to their destinations without using a remote proxy node. When troubleshooting access problems, use it to check whether local listening, the system proxy, and the basic network are working. Direct does not disable the client, since traffic may still pass through Clash's local port and DNS module.
Points the operating system's HTTP or SOCKS proxy address to Clash's local listening port. Browsers and most desktop applications read this setting, but some games, command-line tools, and independent network components may ignore it. If the system proxy is enabled but no traffic appears, check the port, bypass list, and the application's own proxy settings.
Captures IP traffic through a virtual network interface, including traffic from applications that ignore system proxy settings. It usually requires system privileges, and the client also configures routing and DNS hijacking rules. If the network fails, LAN services stop working, or sleep recovery behaves unexpectedly, check the virtual adapter, routing table, firewall, and DNS in that order.
Rules run in the order they are written. More specific matches usually go first, while a final fallback handles connections that match nothing else.
Sends requests to different proxy groups based on domains, IPs, processes, or rule collections. Rules match from top to bottom, and the first match determines the current connection's exit, making order part of the configuration. After changing routing, reload the configuration and use connection details to verify the matched rule and proxy path.
A rule type that matches requests by domain suffix. For example, a rule for example.com can usually also match its subdomains, making it suitable for routing an entire site through one exit. It operates on domain information; if a connection contains only a destination IP and the core cannot recover the domain, the rule may not match.
Matches according to the geographic database location associated with the destination IP, commonly for region-based direct or proxy routing. Results depend on the GeoIP database version, the address used by the destination service, and the DNS response. A domain's registration region, server location, and IP database label may differ, so GEOIP should not be the sole basis for a rule.
A matching method that references a rule collection in a Rule Provider. It moves large domain or IP rule sets out of the main configuration, allowing the core to refresh its cache on a schedule. The Provider name, rule behavior type, and RULE-SET reference must agree, or loading or matching may fail.
The final fallback in a rule list, handling connections that matched nothing earlier. MATCH usually appears once at the end and can target a proxy group, DIRECT, or REJECT. If it appears in the middle, later rules never get a chance to match.
DNS mode affects how domains are resolved and mapped. Network problems are not always caused by a node; they may also come from the system resolver, IPv6 routing, or an application's built-in DNS.
A situation where domain lookups are still sent to an unintended DNS resolver while the connection uses a proxy. It may expose lookup targets or cause access problems when the resolution result differs from the proxy exit region. Check system DNS, Clash DNS mode, browser encrypted DNS, and the TUN capture scope together when troubleshooting.
A DNS mode in which the core first returns reserved addresses for domains, then uses an internal mapping to identify the real destination of subsequent connections. This preserves domain information during IP traffic handling, allowing domain rules to keep matching. LAN discovery, some games, and programs that require real DNS answers may need to be added to the Fake-IP filter list.
A DNS method that resolves a domain's real IP first and forwards the connection based on the result. Its compatibility path is straightforward, but domain and IP rules can be affected by DNS caches, CDN routing, and the resolver's location. After switching DNS modes, clear old caches before evaluating the result.
The list of upstream resolvers used by Clash's DNS module for ordinary domain lookups. Entries may use standard DNS, DoH, or DoT, depending on what the core supports. The resolvers must be reachable through the current network or proxy path; otherwise nodes may work while domains remain inaccessible.
The sixth version of the Internet Protocol, providing addressing and routing paths independent of IPv4. When IPv6 is enabled in Clash, DNS may return AAAA records and connections may try IPv6 first. The path is complete only when the local network, node, routing, and destination service all support it; temporarily disabling IPv6 can help narrow a problem.
Subscriptions distribute configuration, YAML stores the concrete fields, and the client connects core capabilities to the operating system. Make the overwrite relationship between updates and local edits explicit.
A URL used to retrieve a remote configuration or node collection, usually generated by a service provider. Updating a subscription downloads the content again and may overwrite local edits in the same configuration. If importing fails, check that the URL is complete, reachable, and returns a format supported by the current client.
An entry in a configuration file describing a proxy server connection, including its address, port, protocol, and authentication fields. The node name is only a selection label and says nothing about line quality. Actual usability depends on correct parameters, server status, the local network, and intermediate links.
Combines multiple nodes, DIRECT, REJECT, or other proxy groups into an exit that rules can reference. Common types include manual selection, automatic latency testing, failover, and load distribution. Groups can be nested, but excessive depth makes troubleshooting harder; when viewing active connections, verify the final node being used.
The response time recorded after the client makes a TCP connection or HTTP request to a test address, usually shown in milliseconds. The value reflects only that test URL, network path, and handshake at that moment; it does not directly represent bandwidth or long-term stability. Consider real-world access, packet loss, peak-hour performance, and download speed when choosing a node.
The structured text format commonly used for Clash configuration files, with indentation defining object and list hierarchy. Tabs, incorrect indentation, missing spaces, or unclosed quotes can make a configuration impossible to parse. After editing, check the syntax, reload the configuration, and inspect the log for the exact error location.
A YAML document that stores ports, nodes, proxy groups, rules, and DNS options, also commonly called a Profile by clients. Subscription, local, and client-generated configurations may live in different directories. When backing up, check whether Provider files and client override settings also need to be retained alongside the main YAML.
A listening mode that accepts both HTTP and SOCKS proxy connections on the same local port, commonly configured with mixed-port. Applications only need the same address and port; the core identifies the entry protocol from the connection content. If the port is occupied or blocked by a firewall, connections will fail even when the system proxy is configured correctly.
Controls whether other devices on the local network can access Clash's local proxy port, commonly configured with allow-lan. After enabling it, verify that the listen address is not limited to the loopback interface and allow the port through the host firewall. Phones, TVs, and game consoles should use the LAN address of the device running Clash as their proxy server.