A focused guide to the protocols, cores, subscriptions, DNS, and traffic-capture concepts commonly found in Clash Nyanpasu configurations. When a setting is unfamiliar, first identify which layer it belongs to before continuing with installation, configuration, or troubleshooting.
The protocol determines how the client and proxy server establish a connection, authenticate, and transfer data. After importing a subscription, protocol fields usually need no manual changes, but understanding them helps diagnose handshake failures, authentication errors, and mismatched transport parameters.
HTTP proxy
HTTP proxying forwards application requests through an HTTP proxy interface, which browsers and many desktop applications can use directly. HTTPS websites generally use the CONNECT method to establish a tunnel, while TLS continues to protect the webpage content. The HTTP and HTTPS addresses in system proxy settings usually point to Clash's local listening port.
Socket Secure 5
SOCKS5 is a more general proxy interface that can carry connections for different application protocols. It does not interpret webpage content; it only forwards data between the client and the destination. If a command-line or developer tool does not read system proxy settings, its SOCKS5 address can often be entered in the tool's own settings.
SS
Shadowsocks is a common encrypted proxy protocol. Node settings typically include the server, port, password, and encryption method. Parameters must match on the client and server, or the connection cannot be established. Some configurations also use an additional transport plugin, whose parameters should be checked at the same time.
VMess protocol
VMess comes from the V2Ray ecosystem. Common settings include a user ID, transport method, TLS, path, and hostname. Each transport combination corresponds to specific server-side settings. Missing a path or server name when copying node parameters often results in a handshake failure or connection timeout.
Trojan protocol
Trojan establishes an encrypted connection through TLS. Nodes typically include a password, server name, and certificate-related options. An incorrect device clock can cause certificate validation to fail. When troubleshooting, check the domain, port, SNI, and system time before changing routing rules.
The GUI client and proxy core have different responsibilities. The interface imports subscriptions, selects modes, and displays logs; the core handles ports, parses configuration, establishes connections, and applies rules.
Clash core
The core is the configuration execution layer. It reads YAML, starts local listeners, establishes proxy connections, and matches rules. Whether it continues running after the GUI window closes depends on the client's background and exit settings. Protocol errors, port conflicts, and DNS details in the logs usually come from the core.
mihomo core
mihomo is an open-source proxy core that extends Clash Meta capabilities, supporting a broad range of protocols, rule providers, TUN, and DNS settings. The client version and core version are separate concepts. If behavior changes after a client upgrade, check the selected core and configuration compatibility as well.
Desktop client
Clash Nyanpasu is a desktop GUI client for managing subscriptions, configuration, proxy modes, system proxy settings, and core status. It organizes common settings in an interface, but the selected core still handles the actual traffic. Troubleshooting requires distinguishing unsaved interface settings from a configuration load failure in the core.
Graphical user interface client
A GUI client is the visual management layer for a proxy core, typically providing pages for subscriptions, nodes, rules, connections, and logs. Clients may have different entry points and defaults even when they use the same core. When switching clients, recheck the ports, DNS, TUN, and configuration storage location.
Service mode
Service mode usually runs components that require elevated permissions through an operating system service, often to support TUN. First-time activation may require system authorization or service installation. If the service is unhealthy, reinstall it from the client, then check security software and system permission logs.
Routing is central to Clash: a request first matches a rule, then goes to a proxy group, direct connection, or reject policy. Once the processing order is clear, it becomes easier to determine whether an unexpected outbound is caused by a rule, DNS resolution, or policy selection.
Rule mode
Rule mode determines the outbound for each connection according to configured match conditions. Common conditions include domains, IP addresses, network types, process names, and rule sets. Rules are usually evaluated from top to bottom, so a broad rule placed too early may override more specific entries below it.
Global mode
Global mode sends all traffic entering the core through a specified proxy policy instead of selecting an outbound through ordinary routing rules. It is useful for temporarily confirming that a node works and for separating node issues from rule issues. Return to rule mode after testing to restore destination-based routing.
DIRECT
Direct means the local network accesses the destination without a remote proxy node. Configuration and logs usually represent this policy as DIRECT. If a direct destination is unreachable, check the local network, DNS, and firewall instead of simply changing proxy nodes.
Proxy group
A proxy group organizes nodes or other policy groups into an outbound that rules can reference. Common types include manual selection, automatic latency testing, failover, and load balancing. After a rule matches a proxy group, the final node depends on the group's type and current selection.
Rule provider
A rule provider loads a rule set from a separate file or remote URL, making it suitable for maintaining many entries that need regular updates. The main configuration references the set by name and specifies the policy applied on a match. Whether cached content remains available after an update fails depends on the core and configuration state.
Geolocation by IP
GeoIP matches a destination IP against its geographic region in a database and is commonly used to build region-based rules. It matches the IP, not the domain text itself. Database coverage and update frequency affect the result, so GeoIP should not be treated as permanently accurate geographic data.
A subscription retrieves content, a configuration file defines the complete runtime behavior, and a node is only one type of resource. Separating these layers prevents subscription update failures, configuration parsing failures, and individual node outages from being mistaken for one another.
Subscription
A subscription retrieves proxy configuration or a node list from a URL maintained by the relevant service provider. The client must reach the URL and successfully parse its response during an update. A failed update does not immediately invalidate existing local configuration, but the old content will not receive later changes.
Proxy node
A node is a single proxy server entry in a configuration, including its protocol, server, port, authentication, and transport parameters. Lower latency does not necessarily mean faster downloads. Consider route stability, protocol overhead, and reachability to the target service when choosing a node.
Profile / configuration
A configuration file describes how the core runs and usually includes ports, DNS, nodes, proxy groups, rules, and external resources. It can be generated from a subscription or maintained manually. Keep a recoverable copy before editing to reduce the impact of indentation or field errors that prevent the entire configuration from loading.
YAML Ain't Markup Language
YAML is the text format commonly used for Clash configuration. Indentation expresses hierarchy, and hyphens mark list items. Tabs, inconsistent spacing, or missing colons can cause parsing failures. Strings containing special characters may need quotation marks to avoid being interpreted as another data type.
Proxy provider
A proxy provider loads a group of nodes from a separate file so the main configuration can reference and combine them. It commonly supports an update interval, health-check URL, and cache path. Proxy providers and rule providers serve different purposes: the former supplies nodes, while the latter supplies matching rules.
System proxy settings, TUN, and DNS operate at different network layers. When a browser works but a command-line tool does not, or a domain fails while its IP responds, inspect traffic capture and domain resolution separately.
TUN mode
TUN mode uses a virtual network interface to capture more system traffic, making it suitable for programs that do not read system proxy settings. It usually requires a service component, administrator privileges, and correct routing. If the network stops working completely after enabling it, check the service status, DNS configuration, and conflicts with other network tools first.
System proxy
System proxy settings point the operating system's HTTP and HTTPS proxy addresses to Clash's local port. Browsers and some desktop applications read these settings automatically, while command-line programs may ignore them. If the system proxy switch is enabled but an application is unaffected, first confirm that the application supports system proxy settings.
Domain Name System
DNS converts domain names into IP addresses that can be reached. Clash can handle queries, select resolution servers according to its configuration, and use the results for rule matching. If a domain will not open but its IP responds directly, the DNS path is usually the first place to investigate.
Fake IP mode
Fake-IP is a DNS enhancement mode in which the core first returns reserved addresses to applications and records their mapping to the original domains. When the connection reaches the core, it can restore the original domain and apply more accurate domain rules. Some LAN devices or applications that require real DNS results may need to be added to a filter list.
DNS leak
A DNS leak occurs when domain queries bypass the expected path and are sent to another DNS server. Causes may include browser secure DNS, parallel system resolution, an application's built-in resolver, or incomplete TUN configuration. Identify which component issued the query, then align the browser, system, and client resolution policies.
mixed-port
A mixed port accepts HTTP and SOCKS proxy connections on the same local port; the common configuration field is mixed-port. Applications must still use the correct proxy type when entering the address. If another process already occupies the port, the core may fail to start or listen.
Latency
Latency is the time between sending a test request and receiving a response, usually measured in milliseconds. It reflects only the specified test address, method, and network conditions at that moment, and does not directly represent bandwidth. Choose nodes by considering sustained stability and real-world access, not just a single test number.