Clash Config Reference - config.yaml Field Guide

01 Basic Port & Runtime Fields

These fields sit at the top level of config.yaml and control the core's basic runtime behavior.

Field	Type	Default	Description
port	Number	7890	The HTTP proxy listening port.
socks-port	Number	7891	The SOCKS5 proxy listening port.
mixed-port	Number	None	A mixed port supporting both HTTP and SOCKS5 — we recommend configuring just this one port and pointing your system proxy here.
allow-lan	Boolean	false	Whether to allow other devices on the LAN to connect to this machine's proxy port — needed for router or sharing setups.
bind-address	String	*	Used together with allow-lan to specify which network interface to listen on; * means listen on all interfaces.
mode	String	rule	Run mode: rule (route by rules), global (send everything through the same node), direct (all direct connections).
log-level	String	info	Log verbosity: silent / error / warning / info / debug.
external-controller	String	None	The listening address for the external control API (e.g. 127.0.0.1:9090) — the dashboard relies on this interface.
secret	String	None	The secret key required to access the external-controller interface — recommended if you're exposing this interface on your LAN.
ipv6	Boolean	false	Whether to enable IPv6 support, including IPv6 outbound connections and rule matching.

Tip:We recommend using only mixed-port instead of configuring port and socks-port separately — one less port number to remember.

02 proxies Node Fields

Each node is an entry in the proxies list. Different protocols share some common fields and also have their own protocol-specific fields.

Field	Applies To	Description
name	All	The node's name, used as a unique identifier in proxy groups and the UI — try not to duplicate names.
type	All	Protocol type: ss (Shadowsocks), vmess, trojan, snell, socks5, etc.
server / port	All	The node's server address and port.
cipher	ss / snell	Encryption method, e.g. aes-256-gcm, chacha20-ietf-poly1305.
password	ss / trojan / snell	Connection password or key.
uuid / alterId	vmess	An identity field specific to the VMess protocol.
udp	All	Whether UDP forwarding is enabled — affects whether UDP-based traffic (games, voice, DNS) can go through the proxy.
tls / skip-cert-verify	and more	Whether TLS encryption is enabled, and whether to skip certificate verification (may be needed for self-signed certificates).
network	and more	Transport protocol, e.g. tcp, ws (WebSocket), grpc.

# Example config for a Trojan node
proxies:
  - name: "HK-01"
    type: trojan
    server: example.com
    port: 443
    password: "your-password"
    udp: true
    skip-cert-verify: false

03 proxy-groups Fields

Field	Description
name	The proxy group's name, referenced as a target in rules.
type	select (manual selection), url-test (auto-select lowest latency), fallback (failover), load-balance (load balancing), relay (multi-hop chaining).
proxies	The list of node names in this proxy group — can also reference other proxy group names for nesting.
url	The test URL used by url-test / fallback types, usually a lightweight availability-check endpoint.
interval	The interval (in seconds) between automatic latency tests.
tolerance	The tolerance value (in milliseconds) for url-test — latency differences within this range won't trigger frequent node switching.
use	References a node list from a Proxy Provider instead of a manually listed proxies array.

# Example auto latency-test proxy group
proxy-groups:
  - name: "PROXY"
    type: url-test
    proxies: ["HK-01", "SG-01", "JP-01"]
    url: "http://www.gstatic.com/generate_204"
    interval: 300
    tolerance: 50

04 rules Fields

Rules follow a consistent format: TYPE,MATCH_VALUE,TARGET, matched from top to bottom, stopping at the first hit.

Rule Type	Example	Description
DOMAIN	DOMAIN,ad.example.com,REJECT	Exact match on a full domain.
DOMAIN-SUFFIX	DOMAIN-SUFFIX,github.com,PROXY	Matches the domain and all its subdomains — the most commonly used.
DOMAIN-KEYWORD	DOMAIN-KEYWORD,ad-track,REJECT	Matches if the domain contains the given keyword.
GEOIP	GEOIP,CN,DIRECT	Matches by the country/region of the target IP.
IP-CIDR / IP-CIDR6	IP-CIDR,192.168.0.0/16,DIRECT	Matches by an IPv4/IPv6 address range.
SRC-IP-CIDR	SRC-IP-CIDR,192.168.1.100/32,DIRECT	Matches by the source IP of the request — commonly used to route multiple LAN devices differently.
DST-PORT / SRC-PORT	DST-PORT,443,PROXY	Matches by target/source port number.
PROCESS-NAME	PROCESS-NAME,chrome.exe,PROXY	Matches by the process name that made the request — desktop only.
RULE-SET	RULE-SET,reject,REJECT	References a rule set already defined under rule-providers.
MATCH	MATCH,PROXY	The catch-all rule — must be the last line.

05 rule-providers Fields

A rule provider keeps a large batch of rules in a remote file that clients periodically fetch and update, avoiding manual upkeep.

Field	Description
type	http (remote URL) or file (local file).
behavior	domain (domain list), ipcidr (IP range list), classical (mixed list with full rule syntax).
url	The remote address to use when type is http.
path	The local file path where the rule set is cached.
interval	The auto-update interval, in seconds.

# Define a remote rule set and reference it in rules
rule-providers:
  reject:
    type: http
    behavior: domain
    url: "https://example.com/reject.txt"
    path: ./ruleset/reject.yaml
    interval: 86400

rules:
  - RULE-SET,reject,REJECT
  - MATCH,PROXY

Tip:For more on choosing and maintaining rule sets, see the blog post The Complete Guide to Rule Providers.

06 dns & tun Fields

dns Configuration Fields

Field	Description
enable	Whether to enable the core's built-in DNS server (replacing the system DNS) — recommended when using Fake-IP.
listen	The local listening address for the core's DNS service, e.g. 0.0.0.0:53.
enhanced-mode	fake-ip or redir-host — determines how DNS resolution interacts with rule-based routing afterward.
fake-ip-range	The virtual address range used by Fake-IP, usually a private address range to avoid conflicts.
nameserver	The list of upstream DNS servers used for normal resolution.
fallback	The backup DNS list used when a nameserver's result is judged to be polluted.

tun Configuration Fields

Field	Description
enable	Whether TUN mode is enabled — requires admin/root privileges or system network extension authorization.
stack	The network stack implementation: gVisor (userspace, better compatibility) or System (OS-level, higher performance).
auto-route	Whether to automatically take over the system routing table — no need to configure routes manually when enabled.
auto-detect-interface	Automatically detects the outbound network interface, avoiding routing conflicts between the virtual and physical adapters.

Tip:TUN mode and Fake-IP usually work best together — see the advanced configuration guide for setup steps and common issues.

Clash Config Docs Center — The Complete config.yaml Field Reference