01 Core Concepts
Node / ProxyThe connection details for a single proxy server, including address, port, protocol, and encryption method — the smallest unit of routing.
SubscriptionA remote URL whose content is a config file containing multiple nodes, which a client can periodically fetch and update automatically, with no need to enter each node manually.
Proxy GroupGroups multiple nodes together with an assigned selection method: manual selection (select), automatic latency testing (url-test), failover (fallback), or load balancing (load-balance).
RuleDecides which proxy group ultimately handles a specific type of network request, or whether it connects directly or gets blocked outright.
Config File / config.yamlA YAML-formatted text file declaring ports, nodes, proxy groups, and rules — the core file that Clash / mihomo runs on.
CoreThe background program that actually processes network traffic and executes the routing logic — a GUI client is usually just a visual shell around the core.
DashboardA web-based visual panel built on the core's external control interface (external-controller), used to view traffic, switch nodes, and edit rules.
ProfileA specific saved configuration in a client (often sourced from a subscription) — some clients support switching between multiple profiles.
02 Protocols & Nodes
Shadowsocks (SS)An early, widely used lightweight proxy protocol — simple to implement and fast, though its traffic pattern is relatively easy to detect, so it's often paired with obfuscation plugins.
VMessA protocol from the V2Ray project that builds on Shadowsocks with added identity verification and dynamic ports, improving security.
TrojanA proxy protocol disguised as normal HTTPS traffic, closely resembling real web browsing — harder to detect in networks with strict traffic inspection.
SnellA lightweight proxy protocol from the Surge ecosystem, with performance similar to Shadowsocks, now also widely supported by the Clash / mihomo core.
SOCKS5A general-purpose proxy protocol standard with no built-in encryption of its own — typically used for local forwarding rather than as an encryption scheme for public nodes.
Obfuscation (Obfs)A technique that wraps a proxy protocol in an extra layer disguising its traffic pattern, making it look more like ordinary HTTPS or HTTP traffic at the network level.
UDP ForwardingWhether a node supports forwarding UDP traffic (used by some games, voice calls, and DNS queries) — usually marked with a udp field in the config.
Proxy ProviderA mechanism that dynamically supplies a list of nodes from a remote URL, similar to a subscription but more flexible, with the option to set health checks and filters independently.
03 Rules & Routing
DOMAIN / DOMAIN-SUFFIX / DOMAIN-KEYWORDThree ways to match domains: an exact match on the full domain, a match on the domain and all its subdomains, and a match on any domain containing a given keyword.
GeoIPDetermines the country or region of a request's target using an IP geolocation database — the most common way to implement "direct connect for mainland China, proxy for everywhere else."
IP-CIDRA rule syntax for matching by IP range, commonly used to route LAN or private network address ranges directly.
Rule ProviderKeeps a batch of rules in a remote file that clients periodically fetch and update, avoiding manual upkeep. Common formats include domain, ipcidr, and classical.
MATCHThe catch-all rule type that matches any traffic not caught by earlier rules — it must be the last line in the rule list.
PROCESS-NAMEA rule type that matches by the process name that made the request, supported only on desktop (Windows/macOS/Linux) — useful for routing a specific app through the proxy or direct connection on its own.
DIRECT / PROXY / REJECTThe three basic traffic outcomes: connect directly, connect through a proxy node, or block and drop the connection outright.
url-test / fallback / load-balanceThree automated proxy group types: auto-select the lowest latency node, fail over to a backup node when the primary fails, and spread the load across multiple nodes.
04 Network & Modes
TUN MODECreates a virtual network adapter at the system network layer that handles almost all traffic on the device — better compatibility than system proxy mode, but usually requires admin privileges or system authorization.
System Proxy ModeOnly handles traffic from apps that respect the system proxy setting — simple to configure and works with most browsers and everyday apps.
Rule Mode / Global Mode / Direct ModeThree run modes: route by rules (most common), send all traffic through the same node, or connect all traffic directly with no proxy.
Fake-IPReturns a fictitious local IP range during DNS resolution instead of the real IP, leaving the actual routing decision to the core at the traffic layer — improves the accuracy of domain-based routing.
DNS Pollution / DNS LeakDNS pollution refers to a query result being tampered with, resolving to the wrong address. A DNS leak means a domain lookup bypasses the proxy and goes straight to the local DNS, potentially exposing what you're accessing.
External ControllerThe local API interface the core exposes — dashboards and other visual panels use it to read status, switch nodes, and edit config.
Mixed PortA local listening port supporting both HTTP and SOCKS5 — the system proxy or browser extension usually points here.
gVisor / System Network StackTwo ways of processing network packets in TUN mode: gVisor is a userspace network stack with better compatibility; System uses the OS network stack directly for higher performance.
Want to see these terms in action?
The full tutorial includes installation steps and illustrated examples of the config file structure and rule syntax, while the advanced guide covers detailed setup for TUN mode and proxy groups.