Clash Terminology Guide - Explaining mihomo, TUN, Fake-IP, and Rule-Based Routing

QUICK INDEX

Find the Layer Involved

A failed connection is not necessarily a node problem, and an inaccessible website is not necessarily a DNS problem. Confirm the layer from the logs or current action first, then look up the relevant terms.

01

RUNTIME LAYER

Core and Client

This layer determines who reads the configuration, who provides networking functions, and whether the operating system sends traffic to the client. An open interface only shows that the GUI works; it does not prove that the core, ports, or system proxy are active.

Clash: Clash is an ecosystem of proxy tools that process network traffic according to rules. In everyday usage, Clash may refer to the core or to a graphical client. Before troubleshooting, confirm the client name, core type, and current mode to avoid confusing interface issues with connection problems.

mihomo: mihomo is a proxy core that continues the capabilities of Clash Meta. It parses configuration, establishes proxy connections, applies routing rules, and handles DNS. Graphical clients usually call the core to provide actual networking functionality. If the core fails to start, the system proxy switch may still be clickable, but traffic will not be handled correctly.

GUI Client: A GUI client is a graphical interface for managing the core. It handles subscription imports, configuration switching, policy selection, and system proxy controls. The GUI and core versions are independent. If a field is unsupported, first confirm which core the client actually uses and what that version supports.

System Proxy: A system proxy is an HTTP or SOCKS proxy setting provided by the operating system for applications to read. Enabling it affects only programs that follow the setting. Some games, command-line tools, and apps with their own network stacks may bypass it; check the app’s settings or consider TUN mode.

Runtime Logs: Runtime logs record request targets, matched rules, selected policies, connection addresses, and error causes. Find the log lines matching the operation time, then determine whether the error occurred during resolution, rule matching, or connection. A single error line may lack context, so review neighboring entries.

02

CONNECTION LAYER

Proxy Protocol

The node layer connects the local core to a remote server. A subscription can update and nodes can appear without proving that their connection parameters work; a latency test can succeed without reflecting actual bandwidth or access quality for a target website.

Node: A node is a set of connection parameters for a remote proxy server, usually including the server address, port, protocol, and authentication details. Its name is only an identification label and does not prove its location, speed, or reliability. When one node times out, compare it with others in the same subscription to distinguish an isolated failure from a local network issue.

Subscription: A subscription is a remote configuration endpoint maintained by a service provider. It may return a node list, proxy groups, or a complete configuration. Updating it only fetches new content; it does not fix local system proxy or DNS settings. If an update fails, check the validity period, URL reachability, system time, and client network permissions.

Latency: Latency is the time required for a test request to make a round trip, usually measured in milliseconds. It reflects response speed to a specific target at a specific time and cannot replace sustained download or real-world website tests. A low-latency node may still be affected by bandwidth, congestion, packet loss, or target-site limits.

Traffic Multiplier: A traffic multiplier is the billing factor a provider uses to calculate plan usage. For example, transferring 100 MB through a 2× node may deduct 200 MB from the plan allowance. The multiplier does not directly indicate speed; evaluate remaining quota, latency, and use case separately.

Proxy Protocol: A proxy protocol defines how the client and remote server establish a connection, authenticate, and transfer data. Different protocols require different fields, and the server and client must use matching types, ports, and authentication parameters. Applying one protocol’s parameters to another usually causes a handshake failure.

03

DECISION LAYER

Rules and Policies

Rules determine which policy should handle a request; proxy groups determine the specific exit currently used. These are two consecutive layers of decision-making. If changing a node has no effect, first confirm that the request matched the expected proxy group.

Rule-Based Routing: Rule-based routing decides which policy handles a request based on conditions such as domain, IP, port, network type, or process. Rules are usually evaluated from top to bottom and stop at the first match. If a new rule does not work, check whether a broader rule above it captured the request first.

Proxy Group: A proxy group combines multiple nodes, direct-connection options, or other policies into a switchable exit. A manually selected group uses the specified member, while an automatic testing group chooses according to its type and test results. Changing the group changes the traffic exit, not the rule content.

DOMAIN-SUFFIX: DOMAIN-SUFFIX matches requests by domain suffix and covers both the root domain and its subdomains. For example, a rule for example.com will usually also match api.example.com. It does not match a domain that merely contains the same text with a different suffix.

GeoIP: GeoIP applies rules according to the location assigned to the destination IP in a geographic database and is commonly used for regional traffic decisions. It operates on the resolved IP, not on domain rules. An outdated database, anycast address, or changed IP ownership can produce results that differ from the actual location.

RULE-SET: RULE-SET references an external collection of rules so large rule sets can be maintained and updated independently. The configuration must define the source, format, behavior type, and reference name. If downloading fails or the format does not match, related routing may not work as expected.

MATCH: MATCH is the fallback rule for traffic that matched none of the preceding conditions. It normally belongs at the end of the rule list. If it appears in the middle, later rules never get evaluated, so ordering matters more than rewriting the rule text.

Request DOMAIN-SUFFIX,youtube.com,PROXY GEOIP,CN,DIRECT MATCH,PROXY

04

TRAFFIC LAYER

DNS and Traffic Handling

This layer determines how domains are resolved and which application traffic enters the core. Confirm that traffic is being intercepted first, then check the DNS request path, and finally inspect the upstream resolution result.

DNS Leak: A DNS leak usually means a domain lookup bypassed the expected Clash DNS path and was sent to the system, router, or another resolver specified by the browser. Check system DNS, the browser’s Secure DNS, the core’s listening port, and TUN settings together. A different resolver does not necessarily mean connection traffic bypassed the proxy; verify the two paths separately.

Fake-IP: Fake-IP mode returns a temporary IP from a reserved address range for a domain. After the application connects to that address, the core restores the original domain and applies rules. This temporary address is not the remote server’s real public IP. If local devices, certain games, or apps that require a real IP malfunction, check the filter list.

Redir-Host: Redir-Host mode returns the actual resolved address to the application and processes traffic using connection information. Its domain-restoration path and compatibility behavior differ from Fake-IP. After switching modes, clear system and browser DNS caches so old results do not affect troubleshooting.

TUN Mode: TUN mode creates a virtual network interface to intercept more traffic at the network layer than a system proxy can. It usually requires administrator privileges and may conflict with other VPNs, virtual adapters, firewalls, or security software. If the entire network goes offline, disable TUN to verify basic connectivity before checking route and DNS interception settings.

DNS Hijacking: DNS hijacking redirects matching DNS requests to Clash’s built-in resolver and is often used with TUN mode. It controls the lookup path but does not guarantee that the upstream resolver works. If requests reach the core but still time out, check the upstream addresses and outbound policy.

Domain Sniffing: Domain sniffing attempts to recover the target domain from TLS, HTTP, or other connection handshake information to supplement rule matching. It is useful when an app connects directly to an IP but still includes a domain in the handshake. Restrict sniffing to suitable protocols and ports to avoid misidentifying unrelated traffic.

05

CONFIGURATION LAYER

Configuration Fields

The key to a Clash configuration is not the number of fields, but their hierarchy, name references, and processing order. Before editing, keep a working copy of the original configuration, change one field category at a time, and continue only after it loads successfully.

YAML: YAML is a common format for Clash configuration files and uses indentation to express object and list hierarchies. Tabs, inconsistent indentation, missing spaces, or misplaced colons can prevent the configuration from loading. When copying a snippet, verify its parent field as well; do not copy only the innermost lines.

proxies: The proxies field stores manually defined proxy nodes. Each node entry needs a name, type, and the server, port, and authentication parameters required by its protocol. Node names are also referenced by proxy groups, so check every reference after renaming one.

proxy-groups: The proxy-groups field defines proxy group names, types, and members. Members can be nodes, other proxy groups, or direct-connection options. Policy names referenced by rules must match these names exactly, including capitalization, spaces, and symbols.

rules: The rules field stores an ordered list of routing rules. Each rule usually contains a match type, match value, and target policy; some types also require extra parameters. When editing, verify the syntax, policy name, and position of MATCH together.

external-controller: external-controller specifies the listening address of the external control interface. A graphical panel uses it to read connection status and switch policies. If the panel cannot connect to the core, check the listening address, port availability, and access authentication. If it listens on a non-local address, also assess the LAN exposure.

config.yaml Field References

proxy-groups:
  - name: PROXY
    type: select
    proxies:
      - DIRECT

rules:
  - DOMAIN-SUFFIX,youtube.com,PROXY
  - GEOIP,CN,DIRECT
  - MATCH,PROXY