Clash
Glossary

HTTP proxy is one way for an application to connect to a local Clash listening port, commonly used by browsers, terminal tools, and developer software. For HTTPS websites, the application usually creates a tunnel with CONNECT and completes encrypted communication inside it.

This describes the connection from an application to the local proxy entry point; it does not mean the remote node also uses HTTP. Only applications that read system proxy settings or support manual proxy configuration will actively use this entry point.

SOCKS5 is a general-purpose proxy protocol that forwards connections for many TCP-based applications and can also support UDP. It is generally more versatile than an entry point designed only for web requests.

SOCKS5 does not itself encrypt data between the local application and the proxy port. When configuring software, distinguish the local SOCKS5 listening port from the protocol used by a remote node in a subscription.

Shadowsocks is an encrypted proxy protocol. Node configuration usually includes a server address, port, password, and encryption method; these fields must match the server.

When import fails or a connection times out, first confirm that the node parameters are complete, then check local network access and server reachability. Supported encryption methods may differ between cores.

Trojan is a proxy protocol based on TLS transport characteristics. Common settings include the server address, port, password, and server name. Certificate validation, system time, and domain resolution all affect the connection.

When a TLS handshake fails, repeatedly switching nodes is not enough. Check the server name, certificate chain, system time, and possible interference from the network between the client and server.

DNS converts domain names into connectable IP addresses. Clash can use system DNS or configure resolvers, fallback resolvers, and different resolution strategies for different domains.

A webpage failing to load does not necessarily mean the proxy node is faulty. Resolution may have failed, the result may be stale, or the request may have taken an unexpected DNS path. Verify domain resolution and the destination connection separately.

Fake-IP mode first returns a reserved address to the application and stores a mapping between that address and the original domain inside the core. When the application connects to the address, the core can restore the domain and apply domain rules accurately.

This mode helps centralize DNS and connection interception, but some LAN devices, specialized applications, or real-address-dependent scenarios may need to be added to a filter list. Misconfiguration often appears as failed LAN service discovery or connectivity issues in specific applications.

Redir-Host mode generally returns the real DNS result to the application, then uses the domain and destination address together for routing during connection setup. Its main difference from Fake-IP is that the application receives the actual address.

This approach is more straightforward for scenarios that depend on real IPs, but domain retention and rule matching can be affected by the system, connection method, and sniffing settings. After switching modes, retest DNS caching and rule matches.

A DNS leak occurs when some domain queries do not follow the intended resolution path and are handled by the system network, a browser’s built-in resolver, or another DNS service. It usually indicates incomplete interception or an application using its own resolver.

Check the client’s DNS configuration, system proxy and TUN status, the browser’s secure DNS setting, and whether IPv4 and IPv6 are using different paths. Changing nodes alone usually cannot fix a resolution-path problem.

GeoIP matches rules by the region associated with an IP address, commonly sending addresses from a particular region to a direct connection or specified policy. It relies on a local or remote database and does not perform a real-time physical-location lookup for every address.

Address ownership changes, and databases can contain errors. If regional routing behaves unexpectedly, check the database update time and use logs to confirm the actual destination IP.

Latency is the time from a probe sent by the client to the response being received, usually measured in milliseconds. A client’s result applies only to the tested address, test method, and network conditions at that time.

Low latency does not mean high download speed and cannot alone prove that a node is stable. Also check packet loss, handshake success rate, sustained connection performance, and real access to the target website.

A system proxy points the operating system’s HTTP, HTTPS, or SOCKS proxy address to Clash’s local listening port. Browsers and most desktop applications that follow system settings send traffic through it.

Applications that ignore system proxy settings, some games, and certain command-line tools may not be intercepted. Restore the system proxy state before quitting the client to avoid leaving the system pointed at a stopped local port.

TUN mode uses a virtual network interface to intercept system traffic, then lets the core decide whether to connect directly or use a proxy. It suits applications that do not support system proxies, use non-HTTP traffic, or require broader interception.

Enabling it usually requires system permissions and may conflict with other VPNs, virtual adapters, security software, or routing settings. When troubleshooting lost connectivity, first confirm that the TUN device, routes, and DNS interception were created successfully.

Mixed Port is a local listening port that accepts both HTTP proxy and SOCKS5 connections. Applications can connect to the same port using whichever method they support, reducing the need to remember separate ports.

It is only a local entry point and does not determine which node ultimately carries the traffic. A port conflict, firewall restriction, or incorrect address in the application can all prevent a connection to the local proxy.

A routing table is the set of operating-system rules used to decide which network interface should carry a packet and which next hop it should use. TUN mode usually adds or adjusts routes so target traffic enters the virtual interface.

Incorrect routes can make the LAN unreachable, create forwarding loops, or interrupt all connections. When multiple VPN tools are running, check whether they are competing for the default route.

Bypass addresses are destinations excluded from the proxy listener or TUN forwarding path, commonly including loopback addresses, LAN ranges, gateways, and required system services. Proper settings keep printers, router dashboards, and local shares accessible.

An overly broad bypass range lets traffic that should be routed leave directly; one that is too narrow can disrupt LAN communication. After changing it, test local devices, public websites, and the target application separately.