Terms such as VPN, proxy, Clash, TUN, DNS, CDN, firewall, and routing are often discussed as if they describe the same thing.

They do not.

They operate at different layers of the networking stack and solve different problems.

The easiest way to understand them is to start with something simple: what actually happens when a browser opens a website?

What Happens When You Visit a Website?

Suppose you enter:

https://chatgpt.com

A simplified request flow looks like this:

Enter chatgpt.com
↓
DNS resolves the domain name
↓
An IP address is returned
↓
The Mac establishes a network connection
↓
Wi-Fi
↓
Router
↓
ISP
↓
Internet
↓
Destination Server

In other words:

Mac
→ Wi-Fi Router
→ ISP
→ Internet
→ ChatGPT

ISP stands for:

Internet Service Provider

Your home broadband or mobile carrier ultimately connects you to the global Internet through an ISP.

DNS: The Internet's Address Book

DNS stands for:

Domain Name System

Humans prefer names such as:

google.com
github.com
chatgpt.com

Computers ultimately route traffic using IP addresses.

DNS performs the mapping:

chatgpt.com
↓
104.x.x.x

A useful analogy is a contact list:

Alice
↓
+1 555 ...

The domain name is convenient for humans, while the IP address is used by the network.

Because DNS happens very early in the connection process, DNS problems can prevent a website from working even when the proxy itself is perfectly healthy.

IP Addresses

Devices communicate using IP addresses.

An IPv4 address looks like:

8.8.8.8
192.168.1.1
104.18.32.47

IPv4 uses 32 bits.

Because the IPv4 address space is limited, IPv6 was introduced.

An IPv6 address may look like:

2606:4700:4700::1111

Modern systems often support both.

That means a single website may effectively have two possible network paths:

IPv4

and:

IPv6

This is why a machine can sometimes experience:

IPv4 works
IPv6 times out

while the browser simply appears to be slow or broken.

What Does a VPN Change?

Without a VPN:

Mac
→ Router
→ ISP
→ Website

With a VPN:

Mac
→ Router
→ ISP
→ VPN Server
→ Website

The VPN server becomes a new Internet exit point.

For example:

Mac
↓
Local ISP
↓
Japan VPN Server
↓
ChatGPT

The destination generally sees the public IP address of the VPN server rather than the original residential public IP.

An important point is:

A VPN does not bypass the ISP.

The physical connection still starts with:

Mac
→ Router
→ ISP

The difference is that the next meaningful destination is the VPN server instead of the final website.

VPN Tunnels

A VPN typically establishes an encrypted tunnel between:

Client
↔
VPN Server

A simplified model is:

Original packet
↓
Encryption
↓
VPN encapsulation
↓
ISP
↓
VPN Server
↓
Decryption
↓
Internet

The ISP can normally determine that the device is communicating with a VPN endpoint.

However, the contents and ultimate destinations inside the tunnel are less directly visible than in a normal direct connection.

Exactly what is visible depends on:

• VPN protocol
• DNS configuration
• TLS
• IPv4/IPv6 behavior
• DNS leaks
• operating-system implementation

DNS Leaks

Ideally, DNS traffic can also travel through the VPN tunnel:

DNS Request
↓
VPN Tunnel
↓
Remote DNS

But a misconfiguration can result in:

Web Traffic
→ VPN
 
DNS Traffic
→ ISP DNS

For example:

chatgpt.com connection
→ VPN
 
chatgpt.com DNS lookup
→ Local ISP

This is commonly called a:

DNS Leak

What Is a Proxy?

A proxy introduces an intermediate server.

Direct:

Client
→ Website

Through a proxy:

Client
→ Proxy Server
→ Website

The proxy performs the onward connection on behalf of the client.

As a result, the website usually sees the proxy server's public IP as the connection source.

What Is Clash Verge?

Clash Verge is not itself the remote proxy server.

It is better understood as a local traffic controller.

Its job is approximately:

Receive traffic
↓
Identify destination
↓
Match rules
↓
Choose DIRECT or Proxy
↓
Select an outbound node
↓
Forward traffic

For example:

baidu.com
→ DIRECT
 
chatgpt.com
→ Proxy
 
youtube.com
→ Proxy
 
192.168.1.1
→ DIRECT

Modern Clash Verge Rev commonly uses Mihomo as its core networking engine.

A useful simplification is:

Clash Verge
=
Control Panel
 
Mihomo
=
Networking Engine

Nodes

A proxy configuration may contain entries such as:

Hong Kong 01
Japan 02
US Los Angeles
Singapore 03

These normally represent proxy endpoints.

For example:

Mac
→ Japan Node
→ Internet

The node may use a protocol such as:

Shadowsocks
VMess
VLESS
Trojan
Hysteria2
TUIC

A useful distinction is:

Node
=
Which server?
 
Protocol
=
How do we communicate with that server?

DIRECT and Proxy

In Clash terminology:

DIRECT

means:

Do not use a remote proxy

For example:

Local Website
↓
DIRECT
↓
ISP

Proxy means:

Send traffic through a proxy node

For example:

ChatGPT
↓
Clash
↓
Japan Node
↓
ChatGPT

Why Traffic Splitting Matters

Sending everything through a distant proxy is inefficient.

For example:

Local Chinese Website
→ Japan
→ China

is unnecessarily indirect.

A typical rule set therefore uses:

Local sites
→ DIRECT
 
Foreign services
→ Proxy
 
LAN addresses
→ DIRECT

This is called traffic routing or traffic splitting.

Rule, Global, and Direct Modes

Clash commonly exposes three high-level modes.

Rule

Rules determine the route.

Google
→ Proxy
 
ChatGPT
→ Proxy
 
Taobao
→ DIRECT

This is usually the most practical everyday mode.

Rule: According to the regular expressions in the rule list, determine whether the current visited website complies with a certain rule. If it meets this rule, then decide whether to use a proxy or connect directly according to the rule, or use a specific auto-speed testing proxy group.

Global

Everything uses the configured proxy route:

All Traffic
↓
Proxy

Global mode is also useful for troubleshooting.

If:

Rule Mode
→ ChatGPT fails
 
Global Mode
→ ChatGPT works

then the proxy node and TUN path are probably working.

The problem is more likely related to rule matching.

Direct

Everything bypasses the proxy:

All Traffic
↓
DIRECT

Proxy Groups

Names such as:

AI
Google
Streaming
Auto
Node Selection

often refer to:

Proxy Groups

rather than actual servers.

For example:

AI
├── Japan 01
├── US 01
├── Singapore 01
└── Hong Kong 01

A rule may say:

chatgpt.com
→ AI

and the AI group may currently select:

US 01

The real route becomes:

chatgpt.com
↓
AI Group
↓
US 01
↓
Internet

Proxy groups make configuration easier to maintain.

Proxy Group: A collection of multiple proxy nodes (servers) with similar characteristics or purposes grouped together.

Automatic Speed Test Strategy Group: (commonly referred to as url-test group in tools like Clash) is a fully automated node scheduling mechanism in network proxy tools. In simple terms, it acts like an "automatic network speed referee". You just need to provide it with a bunch of proxy nodes (a proxy group), and it will quietly help you test all the nodes in the background. It automatically allocates your network traffic to the node with the lowest latency based on the test results, without requiring manual testing or switching from your end, only setting up speed test intervals and minimum acceptable latency. The downside is that it often changes IP addresses, making it prone to triggering risk controls.

System Proxy

A local Clash process may listen on an address such as:

127.0.0.1:7890

127.0.0.1 refers to:

localhost

or the current machine itself.

7890 is a port number.

Ports

An IP address can be imagined as a building address.

A port is like a room number inside the building.

For example:

127.0.0.1:7890

means:

This computer
↓
Port 7890

Common examples include:

SSH       → 22
HTTP      → 80
HTTPS     → 443
MySQL     → 3306
Clash     → 7890

How a System Proxy Works

When the macOS system proxy is enabled, supported applications are instructed to send proxy-compatible traffic to something like:

127.0.0.1:7890

The path becomes:

Chrome
↓
System Proxy
↓
Clash
↓
Proxy Server
↓
Website

The important limitation is:

The application must support and respect the system proxy configuration.

Some software may not.

Examples can include:

• games
• command-line utilities
• virtual machines
• Docker workloads
• custom networking applications
• certain UDP applications

HTTP, HTTPS, TCP, and UDP

These protocols belong to different layers.

A simplified model is:

Application Layer
HTTP / HTTPS / DNS / SSH / Game Protocols
        ↓
Transport Layer
TCP / UDP
        ↓
Network Layer
IP
        ↓
Network Interface
Wi-Fi / Ethernet / TUN

HTTP and HTTPS describe how applications communicate.

TCP and UDP describe how data is transported.

HTTP

HTTP is an application protocol for the Web.

A browser might send:

GET /
Host: example.com

and the server might respond:

200 OK

HTTPS

HTTPS can be simplified as:

HTTP
+
TLS Encryption

A classic stack looks like:

HTTP
↓
TLS
↓
TCP
↓
IP

TCP

TCP focuses on reliable delivery.

It provides mechanisms for:

• connections
• sequencing
• retransmission
• ordering
• congestion control

It is suitable for things such as:

Web pages
File transfers
SSH
Email
APIs

UDP

UDP is much simpler.

It prioritizes:

Low overhead
Low latency

but does not itself guarantee:

Delivery
Ordering
Retransmission

It is commonly used by:

DNS
Games
Voice
Video
QUIC

HTTP/3 and QUIC

Traditional HTTPS commonly uses:

HTTP/1.1 or HTTP/2
↓
TLS
↓
TCP

HTTP/3 uses:

HTTP/3
↓
QUIC
↓
UDP

This is why modern proxy implementations increasingly need robust UDP support.

Web traffic no longer always means TCP.

TUN Mode

TUN works at a lower level than the system proxy.

A normal stack might be:

Application
↓
TCP / UDP
↓
IP
↓
Wi-Fi

With TUN:

Application
↓
TCP / UDP
↓
IP
↓
TUN
↓
Clash
↓
Physical Interface

TUN behaves like a virtual network interface.

Applications do not necessarily need to know that Clash exists.

System Proxy vs TUN

The accurate distinction is not:

System Proxy = HTTP only

but rather:

System Proxy depends on applications supporting proxy protocols.

TUN instead captures traffic much closer to the IP layer.

SOCKS5

SOCKS is a general-purpose proxy protocol.

For example:

Application
↓
SOCKS5
↓
Clash
↓
Internet

An application can tell the SOCKS server:

Please connect me to example.com:443

SOCKS is useful for many non-HTTP TCP applications.

Mixed Port

Clash can expose a mixed port:

mixed-port: 7890

which may accept multiple proxy styles:

HTTP Proxy ─┐
             ├→ 7890
SOCKS5 ─────┘

Why DNS Becomes Complicated in a Proxy

Ordinary DNS looks like:

Domain
↓
DNS
↓
Real IP

A proxy engine, however, often wants to preserve the domain name.

Rules may be written as:

DOMAIN-SUFFIX,openai.com,Proxy

If the operating system converts everything into an IP too early, the proxy may only receive:

104.x.x.x

rather than:

chatgpt.com

This is why Clash has its own DNS mechanisms.

Fake-IP

Fake-IP is one DNS strategy used by Clash-like proxy engines.

Suppose the application asks:

What is the IP of chatgpt.com?

Clash may temporarily respond with something such as:

198.18.1.23

This is not the real address.

Clash records:

198.18.1.23
=
chatgpt.com

When the application connects to that synthetic address, TUN captures the connection and Clash knows that the original domain was:

chatgpt.com

This enables accurate domain-based routing.

Fake-IP Filter

Some software or LAN devices do not behave well with synthetic IP addresses.

A:

fake-ip-filter

can exclude selected domains from Fake-IP handling.

It does not mean:

Block this domain

It means:

Do not return a Fake-IP for this domain

Sniffing

Sometimes Clash sees only an IP address.

Through protocol information such as:

TLS SNI
HTTP Host

it may infer the original domain.

For example:

104.x.x.x
↓
TLS metadata
↓
chatgpt.com

This process is commonly called:

Sniffing

It is used mainly to improve domain identification and rule matching.

Routing

Routing answers one fundamental question:

Where should this packet go next?

A Mac may have multiple network interfaces:

Wi-Fi
Ethernet
VPN
TUN

The operating system maintains a:

Routing Table

For example:

192.168.1.0/24
→ Wi-Fi
 
Internet
→ TUN
 
Proxy Server
→ Wi-Fi

The last rule is particularly important.

If Clash's own connection to the proxy server is sent back into TUN, the system can create a routing loop:

Clash
↓
TUN
↓
Clash
↓
TUN
↓
...

VPN and TUN implementations therefore need bypass routing for their own transport connections.

CIDR

CIDR stands for:

Classless Inter-Domain Routing

It is a compact way to describe an IP address range.

For example:

192.168.1.0/24

commonly represents:

192.168.1.0
through
192.168.1.255

which contains 256 addresses.

What Does /24 Mean?

IPv4 uses:

32 bits

A /24 means:

The first 24 bits are fixed.

That leaves:

8 variable bits

so:

2^8
=
256 addresses

Common examples:

10.0.0.0/8
192.168.0.0/16
192.168.1.0/24
192.168.1.1/32

The general rule is:

Larger prefix number
=
Smaller network range

A /32 identifies exactly one IPv4 address.

CIDR in Proxy Rules

For example:

192.168.0.0/16
→ DIRECT

means that the entire:

192.168.x.x

private network range should bypass the proxy.

This keeps devices such as:

Router
NAS
Printer
Smart-home devices

accessible directly over the LAN.

Firewalls

A firewall can be thought of as a network gatekeeper.

It evaluates information such as:

Source IP
Destination IP
Source Port
Destination Port
TCP or UDP
Connection State
Interface

and then decides:

Allow
or
Deny

For example:

TCP 80
→ Allow
 
TCP 443
→ Allow
 
TCP 3306
→ Deny

This makes Web traffic available while preventing direct public access to a database port.

Inbound and Outbound Traffic

Inbound:

Internet
→ Local Device

Outbound:

Local Device
→ Internet

Home networks commonly allow outbound connections relatively freely while restricting unsolicited inbound connections.

Stateful Firewalls

Modern firewalls usually track connection state.

For example:

Mac
→ Google

creates a connection.

Google's response:

Google
→ Mac

is technically incoming traffic, but the firewall knows it belongs to an existing outbound session.

It therefore allows it.

This is called:

Stateful Firewalling

The Network Stack

The network stack is not a single application.

It is the collection of layered networking mechanisms inside an operating system.

A simplified outgoing flow is:

Application
↓
HTTP
↓
TLS
↓
TCP
↓
IP
↓
Ethernet / Wi-Fi
↓
Network Interface

Incoming data moves through the layers in reverse.

Why Is It Called a Stack?

Because protocols are layered on top of each other.

A delivery analogy is useful.

HTTP data
=
Product
 
TLS
=
Locked packaging
 
TCP
=
Shipping box
 
IP
=
Destination address
 
Wi-Fi
=
Delivery vehicle

Applications generally do not implement IP routing or TCP retransmission themselves.

They ask the operating system's networking APIs to handle those lower layers.

CDN

CDN stands for:

Content Delivery Network

The central idea is:

Keep copies of content close to users.

Without a CDN:

Tokyo User
→ US Origin
 
Taiwan User
→ US Origin
 
European User
→ US Origin

With a CDN:

Tokyo User
→ Tokyo Edge
 
Taiwan User
→ Nearby Edge
 
European User
→ European Edge

This reduces latency and reduces the load on the origin server.

Cloudflare

Cloudflare is a large Internet infrastructure provider.

Its services include:

• CDN
• DNS
• Reverse Proxy
• TLS termination
• DDoS protection
• WAF
• Bot protection
• Load balancing
• Edge computing

A Cloudflare-protected website may look like:

User
↓
Cloudflare
↓
Origin Server

The user may never connect directly to the true origin server.

Origin and Edge Servers

The:

Origin Server

is the website's actual backend infrastructure.

An:

Edge Server

is a CDN server positioned closer to users.

For example:

User
↓
Tokyo Edge
↓
US Origin

If the requested content is already cached:

User
↓
Tokyo Edge

may be enough.

The origin does not necessarily need to participate in every request.

Forward Proxy vs Reverse Proxy

Clash is mainly a form of:

Forward Proxy

It operates on behalf of the client:

User
↓
Proxy
↓
Website

Cloudflare commonly acts as a:

Reverse Proxy

It operates in front of the server:

User
↓
Cloudflare
↓
Origin

A useful simplification is:

Forward Proxy
→ represents the client
 
Reverse Proxy
→ represents the server

DDoS

DDoS stands for:

Distributed Denial of Service

Suppose a server can process:

10,000 requests per second

A distributed attack could attempt:

5,000,000 requests per second

This can exhaust:

Bandwidth
CPU
Connection tables
Application resources

Large providers such as Cloudflare can absorb and filter substantial attack traffic before it reaches the origin.

WAF

WAF stands for:

Web Application Firewall

A WAF understands Web-layer traffic more deeply than a basic IP firewall.

It may detect patterns such as:

SQL injection attempts
Malicious bots
Abusive API calls
Suspicious URLs
Web exploits

A WAF and a conventional network firewall therefore solve related but different problems.

Soft Routers

A consumer router is already a small computer containing:

CPU
RAM
Network Interfaces
Operating System
Routing Software

A soft router usually means:

General-purpose hardware running dedicated routing software.

For example:

Intel N100 Mini PC
+
4 × 2.5GbE
+
OpenWrt

can function as a powerful home router.

Common software platforms include:

OpenWrt
pfSense
OPNsense
RouterOS

What Can a Soft Router Do?

It can perform normal router functions:

Routing
NAT
DHCP
DNS
Firewall

while also supporting more advanced services:

VPN
Proxy
Clash / Mihomo
QoS
VLAN
Ad Blocking
IDS / IPS
Multi-WAN

DHCP

DHCP automatically assigns network configuration to devices.

For example:

Mac
→ 192.168.1.20
 
iPhone
→ 192.168.1.21
 
Apple TV
→ 192.168.1.22

DHCP can also provide:

Default Gateway
DNS Server
Subnet Mask

Without DHCP, these settings would often need to be configured manually.

NAT

A home network may contain:

Mac
iPhone
TV
NAS
PS5

with private addresses such as:

192.168.1.x

but the home may have only one public IPv4 address.

NAT allows:

Many private devices
↓
One public IP

by tracking and translating connections.

Default Gateway

A gateway is the device a computer sends traffic to when the destination is not on the local network.

For example:

Mac
192.168.1.20
 
Router
192.168.1.1

The router at:

192.168.1.1

may be the Mac's default gateway.

Internet traffic follows:

Mac
↓
Default Gateway
↓
Internet

Why Run Clash on a Soft Router?

If Clash runs only on a Mac:

Mac
→ Clash
→ Proxy

only that machine is directly covered.

If Clash runs on the router:

Mac ───────┐
iPhone ────┤
TV ────────┤
PS5 ───────┼→ Soft Router → Clash → Internet
NAS ───────┘

routing policy can be applied to the entire network.

For example:

ChatGPT
→ US Proxy
 
YouTube
→ Japan Proxy
 
Netflix
→ Singapore Proxy
 
Local Sites
→ DIRECT
 
LAN
→ DIRECT

Client devices do not necessarily need their own proxy applications.

Main Router and Side Router

A main router normally handles:

Default Gateway
NAT
DHCP
Internet connectivity

For example:

ISP
↓
Main Router
↓
LAN

A side router can be added for specialized processing such as:

Proxy
DNS
Filtering
Policy Routing

For example:

Main Router
↓
LAN
├── Normal Client
├── Normal Client
└── Side Router
       ↓
     Proxy

Selected devices can use the side router as a gateway while others continue using the main router normally.

Putting Everything Together

Suppose:

• a Mac uses TUN
• Clash is in Rule mode
• ChatGPT uses a proxy
• the home network uses a soft router
• the destination uses Cloudflare

A simplified flow may look like:

Browser
↓
HTTPS
↓
HTTP/3 or HTTP/2
↓
UDP or TCP
↓
IP
↓
macOS Network Stack
↓
TUN
↓
Clash / Mihomo
↓
Rule Matching
↓
Proxy Node
↓
Physical Wi-Fi
↓
Soft Router
↓
Firewall
↓
NAT
↓
ISP
↓
Internet
↓
Proxy Server
↓
Cloudflare Edge
↓
Origin Server

DNS may be handled somewhere along the path through:

System DNS
Clash DNS
DoH
DoT
Remote DNS

depending on the configuration.

Why Network Troubleshooting Can Be Difficult

Any layer can fail.

DNS can fail:

Domain cannot be resolved

Rules can fail:

ChatGPT
→ DIRECT

when it should use:

Proxy

IPv6 can fail:

IPv4 works
IPv6 times out

Fake-IP can cause compatibility issues.

A proxy node may time out.

A firewall may block the connection.

Cloudflare may reject an exit IP.

The origin application itself may be unavailable.

Therefore, the useful question is usually not:

Why is Clash broken?

but rather:

Is DNS working?
 
Did the request enter Clash?
 
Which rule matched?
 
Was the result DIRECT or Proxy?
 
Which proxy group and node were selected?
 
Are IPv4 and IPv6 both working?
 
Is TCP working?
 
Is UDP working?
 
Can the proxy reach the destination?
 
Is Cloudflare rejecting the request?

This layer-by-layer approach is the foundation of practical network troubleshooting.

Interview Review

For Software Engineer, Backend, Cloud, DevOps, or System Design interviews, it is more important to understand the underlying networking concepts than to memorize individual Clash settings.

1. What Problem Does DNS Solve?

A concise answer is:

DNS translates human-readable domain names into IP addresses that computers can use for network communication.

For example:

api.example.com
↓ DNS
203.0.113.10

Useful follow-up points include:

• DNS results can be cached.
• One domain can resolve to multiple IP addresses.
• CDNs may use DNS or Anycast to steer users toward nearby infrastructure.
• DNS does not transport the actual Web content.

2. What Is the Difference Between TCP and UDP?

TCP provides:

Connection-oriented communication
Reliable delivery
Ordered delivery
Retransmission
Congestion control

UDP provides:

Connectionless datagrams
Lower protocol overhead
No built-in delivery guarantee
No built-in ordering guarantee

Typical examples:

TCP
→ HTTP/1.1
→ HTTP/2
→ SSH
→ Database connections
 
UDP
→ DNS
→ Games
→ VoIP
→ QUIC / HTTP/3

Avoid answering only:

TCP is slow and UDP is fast.

A more accurate answer is:

TCP provides a reliable ordered byte stream and therefore maintains more transport state, while UDP provides lightweight datagrams and leaves reliability and ordering to higher-level protocols when needed.

3. How Are HTTP, HTTPS, and TCP Related?

Traditional HTTPS often looks like:

HTTP
↓
TLS
↓
TCP
↓
IP

HTTP is an application-layer protocol.

TLS provides encryption, integrity, and server authentication.

TCP provides reliable transport.

IP provides addressing and routing.

HTTP/3 changes the transport:

HTTP/3
↓
QUIC
↓
UDP
↓
IP

This is a common interview follow-up.

4. Forward Proxy vs Reverse Proxy

A forward proxy sits on the client side:

Client
↓
Forward Proxy
↓
Internet

Examples include:

Clash
Corporate Proxy

A reverse proxy sits in front of servers:

Internet
↓
Reverse Proxy
↓
Application Servers

Examples include:

Nginx
Cloudflare
AWS Application Load Balancer

A concise answer is:

A forward proxy represents clients, while a reverse proxy represents servers.

5. VPN vs Proxy

A proxy usually forwards selected application connections.

A VPN usually operates closer to the network layer and may route a broader set of IP traffic through an encrypted tunnel.

Simplified proxy model:

Application
→ Proxy
→ Server

Simplified VPN model:

Application
→ Network Stack
→ VPN Tunnel
→ VPN Server
→ Internet

Do not say:

A VPN always proxies all traffic.
A proxy only works for browsers.

Actual behavior depends on:

Routing
Split tunneling
Application configuration
Proxy protocol

6. What Is the Difference Between System Proxy and TUN?

System Proxy:

Applications are explicitly configured to connect through a proxy service.

TUN:

The operating system routes IP traffic through a virtual network interface, so applications usually do not need to know that a proxy exists.

TUN is therefore particularly useful for:

• non-HTTP applications
• UDP
• games
• system-wide proxying
• applications that do not support proxy configuration

7. What Is NAT and Why Is It Used at Home?

A typical home network may look like:

Mac       192.168.1.10
iPhone    192.168.1.11
PS5       192.168.1.12
              ↓
            Router
              ↓
        One Public IPv4

NAT translates and tracks mappings between:

Private Address
↔
Public Address

This allows many internal devices to share a limited number of public IPv4 addresses.

8. What Is a Default Gateway?

When a destination is outside the local subnet, the device normally sends the packet to its:

Default Gateway

Example:

Mac
192.168.1.20
 
Gateway
192.168.1.1

When connecting to:

8.8.8.8

the path begins:

Mac
→ 192.168.1.1
→ ISP
→ Internet

9. What Does CIDR /24 Mean?

IPv4 uses:

32 bits

A /24 means:

The first 24 bits are the network prefix.
The remaining 8 bits can vary.

Therefore:

2^8 = 256

addresses are represented.

For example:

192.168.1.0/24

covers:

192.168.1.0
...
192.168.1.255

A common follow-up is:

How many addresses are in a /16?

Answer:

2^(32 - 16)
=
65,536

10. Why Does a CDN Improve Performance?

A CDN serves content from:

Edge Servers

rather than requiring every request to travel to the:

Origin Server

This can reduce:

• RTT
• latency
• intercontinental traffic
• load on the origin

Modern CDNs may also provide:

• TLS termination
• DDoS mitigation
• caching
• compression
• load balancing

11. Firewall vs WAF

A network firewall primarily evaluates things such as:

IP
Port
TCP / UDP
Connection State

A WAF evaluates Web-layer data such as:

HTTP
URL
Headers
Cookies
Request Body
Web attack patterns

Example:

Firewall:
Is TCP port 443 allowed?
 
WAF:
Port 443 is allowed, but does this HTTP request look like SQL injection?

12. What Happens After You Type a URL Into a Browser?

This is a classic interview question.

A good high-level answer is:

URL parsing
↓
DNS lookup
↓
Routing
↓
TCP or QUIC connection
↓
TLS handshake
↓
HTTP request
↓
CDN / Reverse Proxy / Load Balancer
↓
Application Server
↓
Database / Cache / Other Services
↓
HTTP Response
↓
Browser Rendering

If the interviewer asks about rendering, continue with:

HTML parsing
↓
DOM
↓
CSSOM
↓
Render Tree
↓
Layout
↓
Paint
↓
Composite

Common Misconceptions

Misconception 1: A VPN Bypasses the ISP

Incorrect mental model:

Mac
→ VPN
→ Internet

The ISP has seemingly disappeared.

Actual path:

Mac
→ Router
→ ISP
→ VPN Server
→ Internet

The VPN still depends on the ISP to reach the VPN server.

Misconception 2: The ISP Cannot See Anything When a VPN Is Enabled

This is too absolute.

The ISP may still see:

• your Internet connection
• the VPN server's IP address
• connection timing
• traffic volume
• some network metadata

The VPN tunnel primarily protects the traffic carried inside the tunnel from direct inspection.

Misconception 3: HTTPS Means Anonymous

HTTPS provides:

Encryption
Integrity
Authentication

It does not provide:

Anonymity

The destination website may still know:

Your exit IP
Cookies
Account identity
Browser information

Misconception 4: System Proxy Means All Traffic Is Proxied

Not necessarily.

A System Proxy depends on whether applications support and respect the configured proxy.

Some applications may still use:

Application
→ Network Stack
→ Internet

without touching the proxy.

Misconception 5: TUN Is the Same Thing as a VPN

They are related but not identical.

TUN is:

A virtual network interface mechanism.

A VPN additionally involves concepts such as:

Tunnel
Encryption
Authentication
Remote Endpoint

Therefore:

TUN
≠
VPN

A more accurate statement is:

VPN implementations frequently use TUN interfaces to carry virtual network traffic.

Misconception 6: HTTP Is the Same Thing as TCP

They operate at different layers.

Traditional:

HTTP
↓
TCP

HTTP is an application-layer protocol.

TCP is a transport-layer protocol.

HTTP/3 demonstrates that HTTP does not inherently require TCP:

HTTP/3
↓
QUIC
↓
UDP

Misconception 7: UDP Is Bad Because It Is Unreliable

“Unreliable” only means UDP itself does not provide:

Retransmission
Ordering
Delivery guarantees

It does not mean applications built on UDP cannot provide reliability.

QUIC, for example:

QUIC
↓
UDP

implements features such as:

Reliability
Congestion control
Encryption
Streams

at a higher layer.

Misconception 8: DNS Just Looks Up an IP Once

Real DNS resolution can involve:

Browser DNS Cache
OS DNS Cache
Local Resolver
Router
ISP Resolver
Recursive Resolver
Authoritative DNS
TTL

Modern applications may also use:

DoH
DoT
Application-specific DNS

DNS troubleshooting is therefore more complex than simply converting a domain into an IP address.

Misconception 9: A CDN Is Just a Server That Stores Images

Modern CDNs can also provide:

TLS
HTTP/3
Dynamic acceleration
DDoS mitigation
WAF
Bot protection
Load balancing
Edge functions

Cloudflare is a good example of a CDN evolving into a broader edge infrastructure platform.

Misconception 10: Cloudflare Is Just a DNS Provider

Cloudflare does provide DNS, but it can also operate as:

CDN
Reverse Proxy
WAF
DDoS Protection
Edge Network

Misconception 11: A Firewall Is Antivirus Software

They solve different problems.

Antivirus software focuses more on:

Malicious files
Malicious programs
Local behavior

A firewall focuses more on:

Network connections
IP
Port
Protocol
Connection state

Security suites may combine both, but the concepts are different.

Misconception 12: NAT Is a Firewall

NAT primarily performs address translation.

A firewall primarily makes decisions such as:

Allow
or
Deny

Home routers commonly implement:

NAT + Stateful Firewall

which is why the two concepts can appear similar in practice.

Misconception 13: If Web Traffic Uses a Proxy, DNS Must Also Use the Proxy

Not necessarily.

You may have:

Website Traffic
→ Proxy
 
DNS
→ ISP

This is one possible form of DNS leakage.

Misconception 14: Visiting a Website Means Opening One Connection

Modern Web applications often contact many services:

HTML
JavaScript
CSS
Images
API
Authentication
Analytics
CDN
WebSocket

Therefore:

The main domain works

does not imply:

The whole Web application works.

This is why a page may load but authentication fails, or the interface appears while the actual content never arrives.

FAQ

Q1: Clash Is Running, So Why Can Some Websites Still Fail?

These two statements are not equivalent:

Clash is running.

and:

The traffic is actually passing through Clash.

Possible causes include:

• System Proxy is not active
• the application bypasses System Proxy
• TUN was not configured correctly
• the rule selected DIRECT
• DNS resolution failed
• IPv6 routing is broken
• the proxy node cannot reach the target
• the exit IP is restricted by the destination service

Q2: Why Does Global Mode Work While Rule Mode Fails?

If:

Global
→ Works
 
Rule
→ Fails

then the main proxy path is probably functioning.

The next things to inspect are:

Rule Matching
Proxy Group
DIRECT
Domain Rules
IP Rules

Q3: Why Can Google Work While ChatGPT Does Not?

Different services may use:

• different CDNs
• different IP ranges
• different domains
• different protocols
• different IPv4/IPv6 paths
• different anti-abuse policies for proxy IPs

A modern Web application such as ChatGPT also depends on multiple backend and frontend services.

One failed critical request can break the whole page.

Q4: Why Does TUN Work More Consistently System-Wide Than System Proxy?

System Proxy operates at a higher level:

Application
→ Proxy API

Applications must cooperate.

TUN operates much closer to:

The IP layer

so the operating system can route traffic into the virtual interface without requiring each application to support HTTP or SOCKS proxy settings.

Q5: Why Can TUN Cause More Complicated Problems?

Because it interacts with more system components:

Routing Table
Virtual Interface
DNS
IPv4
IPv6
TCP
UDP
Firewall
Bypass Rules

More control also means more possible failure points.

Q6: Does Fake-IP Send Me to a Fake Website?

No.

Fake-IP is only an internal address mapping used by the local proxy engine.

For example:

198.18.1.10
↔
chatgpt.com

Clash still establishes the real outbound connection to the actual destination or through the configured proxy.

Q7: Why Is Sniffing Needed If DNS Already Knows the Domain?

Sometimes a connection reaches Clash with only:

An IP address

available.

Sniffing can try to recover the domain from information such as:

TLS SNI
HTTP Host

This improves:

Domain-based routing

Q8: Why Does Cloudflare Appear When I Visit Many Unrelated Websites?

Because unrelated websites can all use Cloudflare infrastructure.

For example:

site-a.com
site-b.com
site-c.com

may belong to completely different companies while all following:

User
→ Cloudflare
→ Their Origin Server

Seeing a Cloudflare IP does not mean the website is owned by Cloudflare.

Q9: If a Website Uses a CDN, Am I Still Connecting to Its Own Server?

Not always.

For cached content:

User
→ Edge

may be enough.

For dynamic content:

User
→ Edge
→ Origin

the CDN forwards the request to the actual backend.

Q10: Why Can a Soft Router Proxy Traffic for the Whole Home?

Most home devices send Internet traffic through their:

Default Gateway

If the soft router is the gateway:

Mac ───┐
TV ────┤
PS5 ───┼→ Soft Router
Phone ─┘

it can centrally perform:

Routing
Firewall
NAT
DNS
Proxy

The client devices do not necessarily need individual proxy software.

Q11: What Is the Difference Between a Main Router and a Side Router?

The main router normally acts as:

Default Gateway
DHCP Server
NAT Device
Internet Gateway

A side router usually handles selected or specialized traffic.

For example:

Selected Device
→ Side Router
→ Proxy

It does not necessarily control the entire home network.

Q12: Why Should 192.168.1.1 Usually Bypass the Proxy?

Because:

192.168.1.1

is normally a LAN address.

If the traffic is sent to an overseas proxy:

Mac
→ Japan Proxy
→ 192.168.1.1

the remote proxy cannot reach the router inside your home network.

Private LAN addresses therefore normally use:

DIRECT

Q13: What Is the Difference Between 127.0.0.1 and 192.168.1.1?

127.0.0.1 means:

This machine itself

It is:

localhost

192.168.1.1 usually means:

Another device on the local network

often the router.

Therefore:

127.0.0.1:7890

means:

Port 7890 on the current computer.

Q14: If Port 443 Is for HTTPS, How Can Other Protocols Also Use It?

Port numbers are conventions, not absolute protocol restrictions.

Normally:

443
→ HTTPS

but software can technically listen on any available port if both sides agree on the protocol.

Q15: Why Does an Origin Server Still Need a Firewall If It Uses Cloudflare?

Cloudflare should not be the only security boundary.

The origin should still:

• use a firewall
• expose only necessary ports
• restrict administrative interfaces
• protect database services
• require authentication
• keep software patched

This is part of:

Defense in Depth

Q16: What Is a Good Order for Troubleshooting a Website That Does Not Load?

A layer-by-layer approach works well:

1. Is the domain correct?
↓
2. Does DNS resolve?
↓
3. Is the IP reachable?
↓
4. Is routing correct?
↓
5. Is a firewall blocking it?
↓
6. Can TCP or UDP connect?
↓
7. Does TLS succeed?
↓
8. Does HTTP return a response?
↓
9. Is the proxy rule correct?
↓
10. Are the CDN and origin healthy?

For Clash-specific troubleshooting:

Connections
↓
Rule
↓
Proxy Group
↓
Node
↓
DNS
↓
IPv4 / IPv6
↓
Logs

This is much more effective than immediately reinstalling the proxy application.

Complete Mental Model

┌──────────────────────────────┐
│ Application                  │
│ Chrome / App / Game / SSH    │
└───────────────┬──────────────┘
                ↓
┌──────────────────────────────┐
│ Application Protocol         │
│ HTTP / HTTPS / DNS / SSH     │
└───────────────┬──────────────┘
                ↓
┌──────────────────────────────┐
│ Transport                    │
│ TCP / UDP / QUIC             │
└───────────────┬──────────────┘
                ↓
┌──────────────────────────────┐
│ Network                      │
│ IP / IPv4 / IPv6             │
└───────────────┬──────────────┘
                ↓
          System Proxy / TUN
                ↓
         Clash / Mihomo
                ↓
        Rule / Proxy Group
          ↙             ↘
      DIRECT           Proxy
        ↓                ↓
     Router        Proxy Server
        ↓                ↓
   Firewall / NAT         │
        ↓                 │
       ISP ───────────────┘
                ↓
            Internet
                ↓
       Cloudflare / CDN
                ↓
         Origin Server

Summary

DNS maps domain names to IP addresses.

HTTP/HTTPS describe how Web applications communicate.

TCP/UDP transport application data.

IP provides addressing and routing.

The Network Stack is the operating system's layered implementation of network protocols.

System Proxy depends on applications explicitly using a proxy.

TUN captures traffic closer to the IP layer through a virtual network interface.

Clash/Mihomo applies routing rules and chooses DIRECT or Proxy.

A Proxy Server becomes an alternate Internet exit point for selected connections.

A VPN commonly sends a broader range of IP traffic through an encrypted tunnel.

CIDR is a compact way to describe IP address ranges.

A Firewall controls whether network traffic is allowed or denied.

NAT allows multiple private devices to share public IPv4 connectivity.

A Default Gateway is the next hop used for destinations outside the local network.

A Soft Router uses general-purpose hardware and routing software to provide programmable routing, firewall, DNS, VPN, and proxy features.

A CDN serves content from Edge Servers located closer to users.

Cloudflare combines CDN, reverse proxy, DNS, security, DDoS mitigation, and other edge-network services.

A modern Web request is therefore rarely just:

Computer
→ Website

It may be closer to:

Application
→ Network Stack
→ TUN / Proxy
→ Router
→ ISP
→ VPN / Proxy
→ CDN
→ Reverse Proxy
→ Origin

Once these layers are understood, tools such as Clash stop looking like mysterious networking switches.

They are simply controlling several fundamental networking decisions:

DNS resolution
Traffic interception
Routing
Protocol handling
Exit selection
Policy rules
Network interfaces

And practical network troubleshooting becomes the process of identifying exactly which layer stopped behaving as expected.