From the mihomo core to the Windows system proxy, get the terminology straight before deciding which layer a setting affects.
Use your browser's find feature to locate English configuration keys. Each glossary card has a direct link you can copy. To edit a field, see the YAML Reference for syntax and examples.
The client handles the interface, the core handles connections, and subscriptions provide configuration sources to load.
A client is the graphical application you use to import subscriptions, choose proxy groups, view logs, and toggle the system proxy. Clients such as Clash Verge Rev manage proxy cores, but the client version and core version are separate. If a field has no effect, check both whether the core supports it and whether the client overrides it when generating the configuration.
mihomo is a proxy core derived from Clash Meta. It reads configuration, matches rules, handles DNS, and establishes outbound connections. It can be managed by a graphical client or run from the command line. Tutorials that mention the “Meta core” generally refer to this branch, but supported fields depend on the version actually running.
A subscription is usually a link for retrieving nodes or a full configuration. The client requests and saves the response as needed. Opening the link in a browser does not guarantee that it returns compatible YAML: a login page, error message, or encoded list for another protocol can all cause parsing to fail. Subscription URLs may contain access credentials, so redact the full URL before sharing logs or screenshots. See the subscription guide for setup steps.
A node is a set of server parameters used to establish a proxy connection, typically including an address, port, protocol, authentication, and transport settings. Its name is just a label; a region in the name does not prove where the server is located. A node can be referenced by multiple proxy groups. If you rename it, update any references to its old name in manually maintained configuration.
The protocol determines how a connection is established. Check TLS, transport, and authentication settings separately.
Shadowsocks is a proxy protocol, usually written as type: ss in mihomo node configuration. The server address, port, encryption method, and password must match the server. Some configurations also use plugin settings. Different encryption methods may require different key formats, so do not assume that similarly named options are interchangeable.
VMess identifies users with parameters such as a UUID and can use transports such as WebSocket or gRPC. A valid UUID alone does not guarantee a valid configuration: the path, service name, TLS, and server name can all affect connectivity. If a node fails after import, compare the full configuration with the parameters provided by the server instead of repeatedly toggling the system proxy.
VLESS identifies users with a UUID but does not encrypt traffic on its own. It is commonly used with TLS or REALITY. REALITY settings such as the public key, short ID, and server name must match the server. VLESS and VMess are different protocols; changing only the type field will not convert one to the other.
Trojan typically uses TLS and password authentication. If a connection fails, check the address and password as well as the system clock, certificate, and server name. Disabling certificate verification weakens authentication and is not a general fix for TLS errors.
Identify the file structure and source before changing a listening port or subscription content.
YAML is the structured text format used for mihomo configuration, with indentation defining fields, lists, and nested structures. Use spaces for indentation, not tabs. Misplaced colons, hyphens, or quotation marks can also cause parsing errors. A file that parses successfully is only structurally readable; its field names, node references, and rule logic may still be incorrect.
mixed-port lets a single local port accept both HTTP proxy and SOCKS proxy requests from apps configured to use a proxy manually. For example, mixed-port: 7897 sets the listening port to 7897, but check the active configuration. After changing the port, update any proxy address entered manually in an app. This is not the server port of a remote node.
proxy-providers defines a source of nodes that can be loaded separately, usually from a remote URL or local file. Proxy groups can reference it with use. It provides a collection of nodes, not a complete main configuration with DNS and rules. Even after a provider updates successfully, its nodes will not appear in a group unless that group references it.
Overrides and merges let you save local changes separately from a subscription configuration, such as adding rules, adjusting DNS, or preserving personal settings. Whether fields are replaced, lists appended, or scripts run depends on the client and the order of operations. Changes made directly to a downloaded subscription file may be lost on the next update, so first check where the client supports persistent changes.
Rules decide where a connection goes; proxy groups determine which outbound option to use. Latency tests are just one measure.
In rule mode, rule-based routing selects a policy for each connection using criteria such as domain, IP, or process. Rules are generally evaluated from top to bottom, and the first match takes effect. A final MATCH rule commonly handles all remaining connections. If a rule selects a proxy group, the group must still choose the actual outbound. See the rule reference for syntax.
A proxy group organizes nodes or other policies under a single outbound name that rules can reference. select lets you choose manually, url-test selects automatically based on test results, and fallback switches to an available option. Group names must match the targets in your rules, and cross-references should not create loops.
GeoIP uses an IP geolocation database to determine the region associated with a destination address for rule matching. It checks address location data, not a site's interface language or domain suffix. CDN routing and database updates can affect results. The no-resolve option on a rule avoids resolving a domain solely for that rule match; it does not mean the connection never needs DNS.
The node latency shown by a client is usually the time taken to reach a test URL through a proxy, not necessarily an ICMP ping. Results depend on the test target, handshake, and current network conditions, and cannot be converted directly into download speed. A timeout may mean the test URL is unreachable, so check actual connectivity and logs before deciding whether a node works.
DNS resolution and outbound connection routes are related, but they are not the same setting.
DNS resolves domain names to IP addresses and other records, usually before an application connects. mihomo can use different resolvers depending on its configuration, but system caches, browser Secure DNS, and app-specific resolution can also affect the route. When a domain is unreachable, troubleshoot resolution failures separately from connection failures. See the DNS configuration reference for field details.
Fake-IP mode returns a virtual IP to an application and keeps its mapping to the original domain in the core, allowing connections to be routed by domain. The virtual address is not the website's real server address, and the corresponding traffic must continue through the core. Some apps that depend on real DNS results may need entries in fake-ip-filter. Adjust it for specific issues rather than excluding every domain.
A DNS leak occurs when a query takes an unintended route and reaches an unexpected resolver. Enabling the system proxy does not guarantee that every DNS query goes through the core. Check browser Secure DNS, IPv6, and routing rules as well. A resolver name shown on a test page is only a clue: compare it with your intended policy and connection logs before drawing conclusions based on its region label.
TUN mode captures IP traffic through a virtual network adapter and routes, covering some apps that do not use the system proxy. On Windows, it usually requires administrator privileges or support from a client service. After TUN is enabled, rules still determine whether traffic goes direct or through a proxy. TUN does not guarantee that all traffic uses the same node; other VPNs, route exclusions, and DNS settings can also affect what gets captured.
Distinguish user sign-in settings, background services, and app proxy settings; one toggle does not control every aspect of network traffic.
The Windows system proxy is an endpoint provided to apps that follow the relevant settings. Clients typically point it to a local listening address. Some command-line tools, games, and apps with their own networking stack do not use it automatically, so enabling the setting does not capture all traffic. If you cannot connect after closing the client, check whether Windows still has a proxy setting that points to a stopped port.
Service mode runs the core or other privileged operations as a Windows service, often to support TUN and background operation. Installing a service usually requires administrator approval. Closing the app window does not necessarily stop the background service. Service implementations differ between clients, so use the relevant service controls when migrating or uninstalling to avoid leftover routes or duplicate cores.
Launch at startup usually means running the application when Windows starts or the user signs in; the exact trigger depends on the client. This is separate from automatically enabling the system proxy, restoring TUN, or starting a background service, so check each setting individually. After enabling it, check the client, core, and proxy status at the next sign-in. The tray icon alone does not confirm that traffic is being captured.
A loopback address points to the local device. Common examples are IPv4 127.0.0.1 and IPv6 ::1. Apps often use one of these for a local proxy, but on a phone, the address points to the phone itself—not the computer. To let other devices connect to a proxy on your computer, check the listening address, LAN access permissions, and Windows Firewall, not just the port.