Proxy Protocols
[l4proxies]
This section defines Layer 4 proxies, like Shadowsocks and VMess. The key for each entry is a user-defined name for the proxy.
Common Fields
| Key | Type | Description | Required |
|---|---|---|---|
type | String | The proxy type. Supported: shadowsocks, vmess, anytls, vless, trojan, http, socks5. | Yes |
nickname | String | A user-friendly name. | No |
server | String | The server address. | Yes |
port | Integer | The server port. | Yes |
enabled | Boolean | Whether the proxy is enabled. Defaults to true. | No |
route-via-vpn | Boolean | (New in 1.8.0) Whether the proxy need to route over the VPN, thus you can chain it traffic to another VPN/Proxy server. Default to false, server IP must be in IPv4 address. | No |
Shadowsocks Fields
| Key | Type | Description | Required |
|---|---|---|---|
password | String | The password. | Yes |
method | String | The encryption method. Supported AEAD methods: aes-128-gcm, aes-256-gcm, chacha20-ietf-poly1305. Supported Shadowsocks 2022 methods: 2022-blake3-aes-128-gcm, 2022-blake3-aes-256-gcm, 2022-blake3-chacha20-poly1305. | Yes |
obfs-type | String | Obfuscation type (tls or http). | No |
obfs-host | String | Obfuscation host (required for obfs-type). | No |
obfs-path | String | Obfuscation path (required for obfs-type=http). | No |
udp-forward | Boolean | Whether to forward UDP traffic. Defaults to false. | No |
For Shadowsocks 2022 methods, password must be a base64-encoded pre-shared key. The decoded key must be 16 bytes for 2022-blake3-aes-128-gcm, and 32 bytes for 2022-blake3-aes-256-gcm or 2022-blake3-chacha20-poly1305.
VMess Fields
| Key | Type | Description | Required |
|---|---|---|---|
user-id | UUID | The user ID. | Yes |
alter-id | Integer | The alter ID. | Yes |
security | String | Security type. E.g., auto. | Yes |
transport-type | String | Transport type (tcp or ws). | Yes |
ws-path | String | The WebSocket path (required for transport-type=ws). | No |
sni | String | Server Name Indication for TLS. | No |
skip-cert-check | Boolean | If true, skip certificate validation. Defaults to false. | No |
alpn | String | Application-Layer Protocol Negotiation. Defaults to h2,http/1.1. | No |
| Key | Meaning |
|---|---|
ws-host | Optional WebSocket HTTP Host, separate from TLS SNI. |
ws-h2-max-streams | Optional HTTP/2 WebSocket concurrent-stream limit: 1–256. Omit to use the runtime default. |
tls-enabled | Boolean; defaults to true. Enable TLS when required by the server. |
AnyTLS Fields
AnyTLS is configured as an L4 proxy with type=anytls. The fields below configure authentication, TLS, and idle session reuse.
| Key | Type | Description | Required |
|---|---|---|---|
password | String | AnyTLS password. | Yes |
sni | String | TLS Server Name Indication. Defaults to the server value when omitted. | No |
skip-cert-check | Boolean | If true, skip upstream certificate validation. Defaults to false. | No |
session-reuse | Boolean | Enables AnyTLS idle session reuse. Defaults to true. | No |
idle-session-check-interval | Integer | Interval in seconds for checking idle AnyTLS sessions. Valid range: 1 to 3600. Defaults to 30. | No |
idle-session-timeout | Integer | Idle session timeout in seconds. Valid range: 1 to 3600. Defaults to 60. | No |
min-idle-sessions | Integer | Minimum idle sessions to keep. Valid range: 0 to 64. Defaults to 1. | No |
max-idle-sessions | Integer | Maximum idle sessions to keep. Valid range: 0 to 64. Defaults to 4. | No |
Example:
[l4proxies]
any=type:anytls,nickname:AnyTLS,server:any.example.com,port:443,password:secret,sni:cdn.example.com,skip-cert-check:false,session-reuse:true,idle-session-check-interval:30,idle-session-timeout:60,min-idle-sessions:1,max-idle-sessions:4,enabled:true
HTTP&Socks5 Fields
| Key | Type | Description | Required |
|---|---|---|---|
username | String | Proxy username for upstream authentication. | No |
password | String | Proxy password for upstream authentication. | No |
udp-forward | Boolean | SOCKS5 UDP forwarding flag. Currently kept for profile compatibility; UDP forwarding depends on runtime support. | No |
Example:
[l4proxies]
tshttp=type:http,nickname:tshttp,server:3.3.3.3,port:1055,enabled:true
tssocks=type:socks5,nickname:tssocks,server:10.1.1.1,port:1055,username:user,password:pass,enabled:true,udp-forward:false,route-via-vpn:true
ss2022=type:shadowsocks,nickname:SS2022,server:ss.example.com,port:8388,password:base64-psk,method:2022-blake3-aes-256-gcm,udp-forward:true,enabled:true
any=type:anytls,nickname:AnyTLS,server:any.example.com,port:443,password:secret,sni:cdn.example.com,skip-cert-check:false,session-reuse:true
VLESS: TCP + REALITY + Vision (Pro)
Only this combination is supported in 2.1.0. UDP/XUDP, WebSocket, gRPC, other fingerprints, and plain VLESS/TLS are unsupported. Replace all sample server credentials with your server's values.
| Key | Meaning |
|---|---|
user-id | User UUID. |
transport-type | tcp only; default tcp. |
transport-security | Required: reality. |
flow | Required: xtls-rprx-vision. |
encryption | none only; default none. |
sni | Required REALITY cover server DNS name, as configured by the server. |
reality-public-key | Required canonical 32-byte base64url public key, without padding. |
reality-short-id | Optional; empty or an even number of hexadecimal digits, at most 16. Must match the server. |
reality-fingerprint | chrome only; default chrome. |
udp-forward | Must be false or omitted; TCP only. |
[l4proxies]
vless-1=type:vless,server:proxy.example.com,port:443,user-id:00010203-0405-0607-0809-0a0b0c0d0e0f,transport-type:tcp,transport-security:reality,flow:xtls-rprx-vision,encryption:none,sni:cover.example.com,reality-public-key:E59WjnvZcQMu7tR7_BgyhycuEdBS-CtKxfImRCdAvFM,reality-short-id:0123456789abcdef,reality-fingerprint:chrome,udp-forward:false
Trojan: TCP or WebSocket + TLS (Pro)
TLS is required. UDP, gRPC, mux, and early data are unsupported. Keep certificate verification enabled for normal use.
| Key | Meaning |
|---|---|
password | Required server password. |
transport-type | tcp (default) or ws. |
sni | TLS server name; defaults to server. Must match the certificate. |
skip-cert-check | Defaults to false. true disables server certificate verification. |
alpn | Comma-separated TLS ALPN, quoted as one value. WebSocket requires http/1.1. |
ws-path | WebSocket path beginning with /; used with ws. |
ws-host | Optional WebSocket HTTP Host, independent of TLS SNI. |
tls-enabled | Must be true or omitted. |
udp-forward | Must be false or omitted; TCP only. |
[l4proxies]
trojan-1=type:trojan,server:trojan.example.com,port:443,password:"replace-with-password",sni:trojan.example.com,skip-cert-check:false
trojan-ws=type:trojan,server:trojan.example.com,port:443,password:"replace-with-password",transport-type:ws,ws-path:/proxy,ws-host:trojan.example.com,sni:trojan.example.com,alpn:"http/1.1",skip-cert-check:false
Import share links
Paste a supported vless://, trojan://, vmess://, anytls://, or ss:// link, scan a QR code, or choose a QR image. Review the imported draft and save. Importing fills settings; it does not connect or verify the server. Unsupported options produce errors instead of being silently discarded.