Concepts and Configuration Boundaries

Mihomo Glossary

Browse common concepts by configuration layer. Each entry explains what it means, where it applies, and what it is often confused with. For practical steps, see the beginner-to-advanced guide.

CORE / CLIENT

Core and Clients

First, distinguish the interface, the connection entry point, and the program that handles proxy traffic.

Mihomo Core Mihomo core: Mihomo is the program core responsible for proxy connections, rule matching, and DNS handling. Its configuration is usually written in YAML. The core is not the same as a desktop or mobile app with a subscription management interface. Run it independently through a configuration file, command line, or control interface; when using a graphical client, the client launches and manages the core.

Clash Meta Former project name: Clash Meta is a former name used by the Mihomo project and still appears in older guides, subscription notes, and some client names. Similar-looking configurations should not be assumed to support all the same fields. To check compatibility, verify the actual core and its supported version rather than relying on “Meta” in an app's name.

Client Client application: A client provides an interface for importing subscriptions, choosing policies, viewing logs, and changing system network settings. Its features, permissions, and bundled core can be updated separately, so using the same core does not guarantee the same experience. When comparing clients, check platform support, configuration override options, and how they route traffic. See the client selection guide.

System Proxy System proxy: A system proxy adds a local HTTP or SOCKS proxy endpoint to the relevant operating system settings, so apps that honor those settings send requests to the core. Some games, command-line tools, and apps that manage their own network connections do not use this endpoint. Enabling the system proxy does not capture all traffic or determine whether connections go direct or through a proxy node.

Proxy Node Proxy outbound: A proxy node usually means an outbound proxy configuration containing a server address, port, protocol, authentication, and transport parameters. Its name is just a label; a region in the name does not prove the actual exit location. Importing a node only confirms that its data can be read. Establishing a connection also depends on the settings, server status, and current network.

PROTOCOL

Proxy Protocols

A protocol defines how communication works; check the underlying transport, authentication, and TLS separately.

HTTP Proxy HTTP proxy: An HTTP proxy is a common application-layer proxy interface. Browsers can usually connect by specifying its address and port. When accessing an HTTPS site, the client typically uses CONNECT to establish a tunnel, then communicates with the site over TLS inside it. Whether the proxy connection itself is encrypted is separate from whether the site uses HTTPS.

SOCKS5 SOCKS version 5: SOCKS5 is a general-purpose proxy protocol that supports TCP and can forward UDP when the client, server, and app all support it. SOCKS5 does not encrypt traffic, so using a proxy port does not mean the entire connection is encrypted. Whether an app resolves domains locally or through the proxy depends on the app and its proxy settings.

Shadowsocks Encrypted proxy protocol: Shadowsocks encrypts proxy traffic using an agreed cipher and key. Its configuration type is commonly written as ss. The client and server must use compatible ciphers and authentication settings; different protocol generations cannot be made interchangeable by changing the name alone. If a node requires a plugin, check that the current core supports it and its options.

VMess VMess protocol: VMess is a proxy protocol authenticated with parameters such as a UUID, and can use different underlying transports. The protocol type, transport settings such as WebSocket, and TLS are separate layers and must match the server. A valid UUID alone does not make a complete configuration; also check the address, port, path, server name, and other settings.

Trojan TLS-based proxy protocol: Trojan typically carries proxy traffic over a TLS connection and uses password authentication. Connection failures can occur during network connection, the TLS handshake, or password authentication; use logs to identify the stage. Certificate verification depends on details such as the server name and certificate chain. Skipping certificate checks should not be a routine troubleshooting step.

RULE / POLICY

Rules and Proxy Groups

Rules decide how traffic is handled; proxy groups decide which outbound to use.

Rule-Based Routing Rule-based routing: In Rule mode, rule-based routing checks conditions such as domains, IP addresses, and processes in configuration order, then sends the connection to the policy specified by the first match. Specific exceptions usually need to come before broader rules. If traffic takes the wrong route, check the rule that actually matched and the selected proxy group, not just whether the domain appears in the configuration.

Proxy Group Proxy group: A proxy group organizes nodes or other proxy groups into a logical outbound that rules can reference. select lets you choose manually, url-test selects based on test results, and fallback tries options in order based on availability. Group names must match their references. Switching a node affects new connections using that group, but may not move existing connections.

GeoIP IP geolocation matching: GeoIP matches traffic using data about the region associated with an IP address, for example GEOIP,CN,DIRECT. It checks IP address data, not a service's place of registration or the user's location. Shared infrastructure, changes in IP ownership, and database updates can affect results. For precise handling of certain sites, combine GeoIP with domain rules.

GEOSITE Domain category matching: GEOSITE matches services or site collections using domain categorization data, for example GEOSITE,category-ads-all,REJECT. Category names, coverage, and update schedules depend on the data source, and not all sources include the same categories. Unlike GeoIP, GEOSITE matches domain collections rather than inferring a region from the server IP.

MATCH Catch-all rule: MATCH is a catch-all rule with no additional match conditions, usually placed at the end of the rules list, for example MATCH,PROXY. PROXY must refer to a node or proxy group that exists in the configuration; it is not a built-in outbound. If MATCH appears earlier in the list, later rules cannot handle connections it matches.

DNS / NETWORK

DNS and Network Modes

Traffic capture, domain resolution, and connection testing are three separate steps.

TUN Mode Virtual network interface: TUN mode routes traffic into the core through a virtual network interface and routing settings, making it useful for apps that do not follow system proxy settings. It changes how traffic enters the core; it does not replace outbound modes such as Rule or Global. The scope of traffic capture depends on routes, exclusions, system permissions, and the client implementation. After enabling it, check compatibility with your local network and other VPNs.

DNS Domain Name System: DNS looks up records such as the IP addresses associated with domain names. Resolution results affect connection targets and some IP-based rule matches. Mihomo DNS settings control the core's DNS behavior and related query paths, but enabling the DNS service alone does not mean the system or every app is using it. Check browser Secure DNS, app-specific resolution, and system DNS separately.

Fake-IP Synthetic address mapping: Fake IP is a DNS enhancement mode that returns a virtual address to an app and maintains a mapping to the original domain in the core. When the core receives a connection, it can use this mapping to preserve the domain name for rule matching. For local network services or specific apps that depend on real DNS results, check fake-ip-filter. Filtering a domain does not, by itself, route it directly.

DNS Leak DNS leak: A DNS leak usually means queries take an unexpected route and reach an unintended resolver. Secure DNS enabled separately in a browser, an app's own DNS resolver, or system requests that are not captured can all cause routing differences. A detection page's resolver name is only a clue. Check system settings, browser configuration, and core logs rather than drawing conclusions from the name alone.

Latency Test Latency test: A client latency test usually sends a request to a specified target to check the response over a proxy route. Results depend on the target, DNS resolution, connection handshake, network congestion, and the test implementation, so results from different clients may not be directly comparable. A successful test does not mean every website is accessible, and lower test latency does not mean faster downloads.

SUBSCRIPTION / CONFIG

Subscriptions and Configuration Files

Check the content structure first, then distinguish importing, updating, and loading the configuration.

Subscription Subscription: A subscription uses a link to retrieve updatable node information or configuration; it is not a specific proxy protocol. The returned content may contain only nodes or a complete configuration with DNS, proxy groups, and rules. Links often contain account credentials, so redact them in shared screenshots and logs. See the subscription import guide for the import process.

Subscription Format Subscription format: A subscription format is the structure of the content returned by a link, such as a complete YAML configuration, a node list, or a collection of encoded share links. A file extension or link appearance does not confirm that the format is valid; check that the client's import method supports it. A complete configuration usually cannot be used directly as a provider that accepts node data only. If parsing fails, first rule out a login page, error page, or expired link.

YAML Structured configuration text: YAML is the structured text format used for Mihomo configuration. Indentation, key-value pairs, and lists define its hierarchy. Use spaces for indentation and keep items at the same level consistent; strings containing special characters may need quotation marks. Valid YAML syntax only means the structure can be parsed. Check configuration and logs to confirm field names, values, and policy references meet the core's requirements.

rule-providers Rule set providers: rule-providers declares local or remote rule sets, including their content type, format, and update method. After declaring one, reference it with RULE-SET in rules and specify an outbound policy. A rule set provides match conditions; it does not choose a node. Do not confuse it with proxy-providers, which provides node data.

Configuration Update Profile update: A configuration update fetches a subscription or remote resource again; it is not a client or core upgrade. A successful download, successful parsing, and the core loading the new configuration are three separate steps to verify. Remote updates may overwrite edits made directly to subscription content. For long-term customizations, use an override mechanism supported by the client. See the routine maintenance section for troubleshooting steps.