Cores, protocols, rules, and DNS. Look up a term used in your configuration, then identify which layer to adjust.
This page uses common mihomo configurations as a reference. Client button names may differ, and supported fields depend on the core in use. New to configuration? Start with the subscription import guide. If a connection fails, see the troubleshooting guide.
First, distinguish the core that handles network logic, the client that provides the interface, and the configuration you import.
The network core reads configuration, matches rules, establishes proxy connections, and handles DNS. It continues the technical lineage of Clash Meta. Graphical clients typically provide settings around the core, but the core determines which protocols and fields are supported. When troubleshooting compatibility, note the client version and core version separately; the app name alone is not enough.
An application for managing subscriptions, switching modes, viewing logs, and integrating with the operating system, such as Clash Verge Rev. Different clients may use similar cores but have different menu names, configuration directories, and service management. Updating a client does not necessarily update its core. Before following a guide, confirm the app name and the core it uses.
A distribution method that uses a URL to retrieve and periodically update nodes or a complete configuration. A full subscription may include proxy groups, rules, and DNS settings, so an update can change more than the node list. Keep subscription links with access credentials private, and redact them from screenshots and logs. Make local changes in a client-supported override location to avoid having them overwritten during updates.
A set of proxy connection parameters saved in a client, usually including the protocol, server address, port, and authentication details. A node name is just a label; it does not confirm the server location or connection quality. Being able to select a node does not mean authentication or connectivity has succeeded. Check the actual connection and relevant errors in the logs.
A protocol name describes how communication works, not how fast it is. Server settings, the transport layer, and network conditions matter too.
An encrypted proxy protocol, usually configured as type ss in mihomo. The server address, port, encryption method, and password must match the server settings; some connections also require additional plugin parameters. UDP availability depends on both ends. A working web connection does not prove that games or other UDP applications will work.
A proxy protocol that uses credentials such as a UUID for authentication and supports different transport methods and TLS settings. When importing a node, check that the WebSocket path, Host, and server name are present, along with the server address and port. Changing only the protocol name cannot convert a different node type to VMess; the server must support the corresponding connection method.
A proxy protocol with streamlined authentication and forwarding that does not encrypt traffic on its own. Understand the connection in conjunction with settings such as TLS, REALITY, and the transport method; the VLESS name alone does not guarantee encryption. If importing fails, first check that the core supports the combination, then verify the UUID, server name, and handshake settings.
A proxy protocol that typically establishes a TLS connection and authenticates with a password. Even with the correct password, a mismatched server name or certificate can cause the connection to fail during the handshake. Check the system clock, server name, and certificate errors. Skipping certificate verification should not be a routine fix, as it weakens server identity checks.
Rules determine where connections go. In addition to a correct configuration, make sure the current mode allows rules to handle traffic.
A mechanism for choosing an outbound such as direct, proxy, or reject based on the domain, destination IP, or other conditions. Rules are usually evaluated from top to bottom, and the first match determines the policy. A broad rule near the top can shadow more specific rules below it. To check whether routing is working, inspect the matched rule and final outbound in the connection log, not just the currently selected node.
Data and rules that match traffic based on the region associated with an IP address, often used for regional routing. Database attribution does not indicate a company's registration location or actual service availability, and can be affected by database updates and content delivery networks. Domain-based IP matching may also depend on DNS resolution. Check DNS results and rule order as well.
A rule type that references an external rule set in the rules list. The set name must match a declaration in rule-providers. Rule sets keep large collections of entries out of the main configuration, making them easier to maintain and update. A successful reference does not guarantee a match: check the set's parsing behavior, content format, and position in the main rules list.
A catch-all rule with no additional conditions, used for connections not matched earlier and usually placed at the end of the rules list. Its target can be a proxy group or a built-in outbound such as DIRECT. If placed near the start, it will usually prevent later rules from handling connections. If all traffic uses the same outbound, check this rule's position first.
Proxy groups organize available outbounds. Manual selection, response probing, ordered failover, and connection distribution each work differently.
A proxy group type that lets users choose a member, which can be a node or another proxy group. The selection only takes effect when a connection references that group, so a route that does not change after switching nodes does not necessarily mean the selection failed. Trace the matched rule to confirm its group reference, then test with a new connection; existing connections may continue using their original outbound.
Periodically accesses a test URL to compare candidate members' response times and automatically choose an outbound. The latency shown in the interface generally reflects the response to the test target, not file download speed or the experience across all websites. interval controls how often probes run, while tolerance helps prevent frequent switching when response times are similar.
Uses available outbounds in member-list order, moving to the next when an earlier member is unavailable. This prioritizes a predefined order rather than always selecting the node with the fastest probe response, making it suitable when a fixed preferred route is needed. A successful probe only confirms that the test target responded; the actual service may still have restrictions. Verify failover by testing the service itself.
Distributes different connections among available group members according to a specified strategy; it does not combine the bandwidth of multiple nodes for a single connection. Some strategies try to keep connections to the same destination on the same outbound, while others focus on rotating assignments. For services that rely on stable login sessions, consider the effect of changing outbounds. More group members do not automatically mean a better experience.
Distinguish domain resolution, traffic capture, and the actual outbound route. Enabling a single setting does not replace checking the full connection path.
A system that resolves domain names to addresses and other records, a foundational step before many network connections. Proxy server names, application domains, and the outbound path for DNS requests may use different settings. Browsers may also use their own encrypted DNS. If a website fails in only one application, check that application's resolution settings as well as the core's.
A DNS enhancement that assigns synthetic addresses to domain names and stores the mappings in the core, allowing it to recover the domain and apply routing rules when a connection arrives. The synthetic address received by an application is not the website's real server address, so it cannot be used to determine the website's location. For LAN services or applications that require real addresses, consider specific filter settings rather than immediately disabling DNS entirely.
A domain lookup that should use a specified route instead goes through an unexpected resolver path. Not every direct DNS request is a leak: if the routing design intentionally resolves some domains locally, that may be expected. First define what you want to protect, then check the system resolver, browser encrypted DNS, IPv6, and the scope of core traffic capture. A test page's reported region alone is not enough to draw a conclusion.
A way to capture traffic through a virtual network interface and routing, often used for applications that do not use system proxy settings. It typically requires appropriate permissions or service support, and coverage also depends on routing, DNS capture, and core configuration. TUN is not the same as global mode: traffic can still be routed by rules after entering the core. If connectivity fails after enabling it, check for route conflicts and DNS issues first.
Node definitions, proxy group organization, and rule references each have their place. Names must match for the configuration to form a complete routing chain.
A structured text format commonly used for mihomo configuration. Indentation defines nesting, and hyphens mark list items. Keep indentation consistent with spaces and avoid mixing in tabs; quote values containing special characters when the syntax requires it. Passing YAML parsing only means the structure is basically valid. It does not confirm that the current core supports the fields or that node authentication details are correct.
A list field that defines proxy outbounds in the main configuration. Each entry typically includes name, type, and the connection parameters required by its protocol. Proxy groups and rules must reference nodes by these names; avoid duplicates that could cause ambiguity. Configurations using external node providers may store members elsewhere, so a main configuration without a large list of node entries is not necessarily incomplete.
A list field that defines proxy group names, types, and candidate members, organizing the connection between rules and nodes. Groups can specify members with proxies or reference node providers, depending on the configuration. Group names in rules must match their definitions, and groups must not reference one another in a cycle. When renaming a group, check every reference, not just its displayed name in the interface.
Declares an external rule set's source, parsing behavior, file format, storage location, and update method. After declaring a set, reference it with RULE-SET in rules for it to match connections. If an update fails, check the download log and local file state. If the file exists but no rules match, check the parsing behavior and the rule's position in the main list.