Configuration terms / field references / limitations
Browse terms by configuration topic. Each entry explains the concept, related fields, and common pitfalls. Field descriptions use mihomo as a reference; names in a client's interface may differ.
First distinguish the core that handles connections from the interface that manages configuration, then identify which layer the issue is in.
Clash originally referred to a rule-based proxy core and is also commonly used as shorthand for the ecosystem of clients compatible with its configuration format. “Supports Clash configuration” does not mean that every client supports the same fields or protocols. Before troubleshooting a configuration error, confirm the core actually running rather than relying on the installer name or window title.
mihomo is an open-source proxy core descended from Clash.Meta. It handles connections, DNS resolution, protocol communication, and rule processing. It can run on its own or be launched and managed by a GUI client. Whether configuration fields such as tun and sniffer are available depends on the core version and platform.
A GUI client provides controls for importing subscriptions, selecting policies, viewing logs, and integrating with the operating system. Settings changed in the interface may be merged by the client before they reach the core, so the file you edit may not be the effective configuration. Client and core versions are separate; reporting both is more useful for troubleshooting than providing a screenshot alone.
The system proxy points the operating system's proxy settings to a local client listening address, such as an HTTP or mixed port on the loopback interface. Only apps that honor these settings send connections through it; some command-line tools and games use their own network settings. Enabling the system proxy does not route all traffic or automatically change every DNS query path.
A client typically accesses a specified test URL through a node and records the request time, depending on its implementation; this is not necessarily the same as an ICMP ping. The test URL, connection reuse, timeout settings, and current network conditions all affect the result. A low value only means this test route responded quickly; it does not tell you download bandwidth, video throughput, or whether other websites are reachable.
A protocol defines how a client communicates with a proxy server. Node settings must match the server; sharing a name does not make configurations interchangeable.
A proxy node contains the settings needed to connect to a proxy server, usually including type, server, port, and authentication fields. Nodes can be defined under proxies or loaded by a proxy provider. A display name is only a local reference; a region or speed label in the name does not establish the actual route, performance, or service capabilities.
An HTTP proxy forwards requests using HTTP proxy semantics. For HTTPS destinations, it typically uses CONNECT to establish a tunnel. An HTTP proxy node in the configuration is a remote outbound, not the same thing as an HTTP listening port opened locally by the client. An HTTPS destination does not automatically mean the client-to-proxy connection uses TLS; check the node's transport settings.
SOCKS5 is a proxy protocol that supports TCP connections and UDP forwarding, and can also use username-and-password authentication. The protocol itself does not encrypt traffic, so requiring a password does not mean the connection is encrypted. Actual UDP support depends on whether the app uses the relevant mechanism, the server supports it, and the node configuration enables it.
Shadowsocks is an encrypted proxy protocol configured with type: ss in mihomo. The server address, port, encryption method, and password must match; changing a node's name does not convert its protocol. For plugins or UDP forwarding, verify that the core supports the feature and that its settings match the server.
Trojan is a proxy protocol that protects traffic with TLS and uses type: trojan in node configuration. A successful connection depends on more than the password: the destination address, SNI, certificate chain, and transport settings matter too. For certificate errors, check the domain, device time, and certificate status first; disabling certificate verification is not a routine fix.
Rules determine which category a connection falls into; policy groups determine which outbound that connection ultimately uses.
Rule-based routing selects a direct, blocked, or proxy outbound for each connection based on criteria such as domain, IP, or process. In rule mode, rules are typically checked from top to bottom, and the first match determines what happens. Put specific exceptions before broad rules. Referenced policy group names must exist, and in global mode you should not assume connections still follow this rule order.
A policy group combines nodes or other policy groups under a stable outbound name for rules to reference. select is generally for manual selection, url-test selects based on test results, and fallback checks options in order for an available outbound. The result depends on the test URL and settings; a node that appears available may not reach every destination.
GeoIP matches IP addresses against location categories in a database, for example GEOIP,CN,DIRECT. It is not live geolocation and does not directly indicate a website's language or operator. CDN address changes can also affect results. The data file used depends on the core's data mode; if you add no-resolve, understand how it limits DNS lookups triggered by domain names.
GeoSite is a collection of domains organized by service or purpose and referenced by GEOSITE rules. Category names and coverage are maintained by the data source; different sources may not include the same categories or promptly cover new domains. GeoSite matches domain collections and is not interchangeable with GeoIP, which matches IP ownership. After updating, check the data-loading logs.
MATCH is a catch-all rule with no additional match condition, usually placed at the end of rules to handle connections not matched earlier. Its target can be a proxy policy group or a built-in policy such as DIRECT; it does not have to send traffic through a proxy. If placed near the top, it leaves later ordinary rules with no chance to match, so checking rule order is often more important than adding more rules.
DNS resolution and connection routing are separate paths. To determine whether traffic is fully captured, check the app, operating system, and core configuration together.
DNS resolves domain names to IP addresses and other records. mihomo's dns section configures its built-in resolver and upstream servers. Setting nameserver does not mean every app will use it: the system resolver and a browser's built-in encrypted DNS may take other paths. When troubleshooting, identify what makes each query, where it goes, and how the resulting connection is routed.
TUN mode receives IP packets routed through a virtual network interface and can cover some apps that ignore the system proxy. It usually involves additional permissions, network stack, and routing settings; exclusions, IPv6, and other VPNs can also affect what it captures. Setting tun.enable only enables the configuration entry point. Verify the result using the routing table, connection logs, and DNS interception behavior.
Fake-IP returns synthetic addresses for domain queries, while the core stores a mapping between each address and its domain. When a connection reaches the core, that mapping can be used for routing. A synthetic address is not the real address of the destination server, so using it for location matching is meaningless. For services that depend on real DNS answers, configure fake-ip-filter as needed for compatibility, and account for the effect of old DNS cache entries.
A DNS leak occurs when domain queries leave the expected resolution path and reach an unintended resolver. Check system DNS, app-level DoH, IPv6, and fallback behavior after a network change; the public IP shown by a website is not enough. Resolver names shown by a test page are clues, not proof. Compare them with your expectations and confirm using core logs and repeated tests. TUN mode alone does not determine the result.
Domain sniffing extracts domain names from protocol metadata visible in a connection, such as an HTTP Host header or SNI in some TLS handshakes, to supplement connections that only show an IP address. It cannot decrypt arbitrary HTTPS traffic and may not recover a domain for every connection. After enabling sniffer, verify behavior by protocol and destination; do not treat it as a substitute for DNS configuration or accurate rule data.
Distinguish complete configurations from node lists and rule sets to know where to import them and what an update may replace.
A subscription distributes nodes or configuration through a URL that a client can fetch and update; it is not a proxy protocol. The URL may return a complete YAML file, an encoded node list, or another format, so use the appropriate import option in your client. Subscription URLs may contain account credentials and should be treated as sensitive: hide the full link in public logs and screenshots. A failed update does not necessarily invalidate all cached nodes immediately.
YAML is the data serialization format used for mihomo configuration. Mappings represent fields, lists represent collections, and indentation defines structure. Use spaces for indentation, quote values with special characters as required by the syntax, and do not mix tabs with spaces. A YAML parser accepting the file only confirms that its syntax is valid; also check field types, policy references, and core support for each field.
Proxy providers are defined under proxy-providers. They load node collections from a remote or local source, which policy groups can reference with the use field. This separates node updates from local routing and policy group structure. A provider source may not accept an arbitrary complete configuration file. When troubleshooting, check the returned content, cache path, update status, and whether the reference names match.
Rule providers load updateable rule collections under rule-providers, which are added to the main rule list with RULE-SET. behavior distinguishes content types such as domains, IP ranges, and classical rules; format describes the file format. Both must match the source. Defining a provider alone does not enable routing: check where it is referenced and its position in rules.
Overrides and merging describe how local settings are retained or added on top of a subscription configuration, often to change ports or DNS settings or add rules. The behavior depends on the client: some fields are replaced wholesale, others merged, and lists may be prepended or appended. After making changes, inspect the effective configuration and reload it. override.yaml is a common filename, not a standard entry point that every client reads automatically.