# Introduction (/docs)



Welcome to the VX documentation. This site covers the **VX**: a network utility app and **vx-core**,
a network utility software that powers the VX app.

## What is VX? [#what-is-vx]

VX is the first free-of-charge, fully open-source, all-platform network utility app. It provides an
easy-to-use GUI for monitoring your local network traffic, establishing proxy tunnels,
managing node subscriptions, and server deployments.

{/* TODO: primary use cases */}

{/* <YouTube id="rqeLQ8426go" title="VX Demo" /> */}

## What is vx-core? [#what-is-vx-core]

vx-core is a network utility software written in Golang. It originates from [v2ray-core](https://github.com/v2fly/v2ray-core), but is
quite differnet from v2ray-core since significant changes have been introduced.

## Documentation Sections [#documentation-sections]

<Cards>
  <Card title="VX Client" href="/docs/vx" description="Features, installation, and deep linking for airport owners" />

  <Card title="vx-core Server" href="/docs/vx-core" description="Protocols, configuration, and building from source" />

  <Card title="Tutorials" href="/docs/tutorials" description="Step-by-step guides for common tasks" />
</Cards>

## Quick Links [#quick-links]

* [Download VX](https://vx.5vnetwork.com)
* [VX on GitHub](https://github.com/5vnetwork/vx)
* [vx-core on GitHub](https://github.com/5vnetwork/vx-core)


# Custom routing (Netflix via a specific node) (/docs/tutorials/custom-routing)



The video walks through a practical example: sending **Netflix** (and related domains) through a
**specific node**.

Watch the walkthrough below, or open it on [YouTube](https://www.youtube.com/watch?v=U0NyYOFC-84).

This video is for Chinese language speakers.

<YouTube id="U0NyYOFC-84" title="Custom routing — route Netflix through a specific node" />

## Related [#related]

* [Customize tab](/docs/vx/manual/customize) — Simplified vs Advanced overview
* [Routing modes](/docs/vx/manual/customize/modes) — rules, conditions, and outbound choices
* [Sets](/docs/vx/manual/customize/sets) — domain sets used in rules
* [Selectors](/docs/vx/manual/customize/selectors) — pick nodes by group instead of a fixed outbound
* [VX installation](/docs/vx/installation) — install the client first


# Deploy multiple protocols at once (/docs/tutorials/deploy-multi-protocol)



VX **All in One** Quick Deploy installs **vx-core** on your VPS and deploys multiple nodes
in a single run. The deployed nodes use self-signed certs with SHA256 peer verification enabled, so you
don't have to worry MITM attacks.

A typical All-in-One deployment includes:

* **Protocols** — VMess, Trojan, AnyTLS, and Hysteria2
* **Transports** — WebSocket and gRPC
* **Security** — TLS on generated certificates; optional **REALITY** when you provide a REALITY domain
* **CDN** — optional CDN hostname for an extra WebSocket + TLS node in front of the server

VX can also enable **BBR** and adjust firewall settings during deploy when needed.

Watch the walkthrough below, or open it on [YouTube](https://www.youtube.com/watch?v=ZJHPvtQQkTo).

This video is for Chinese language speakers.

<YouTube id="ZJHPvtQQkTo" title="Deploy multiple protocols at once with VX All in One Quick Deploy" />

## Prerequisites [#prerequisites]

* A Linux VPS added in VX under **Servers** with working **SSH**

## Related [#related]

* [Deploy REALITY / XHTTP](/docs/tutorials/deploy-reality-xhttp) — focused Reality/XHTTP (Xray) Quick Deploy
* [VX-core panel](/docs/vx/manual/vx-core-panel) — server panel overview
* [Proxy protocols](/docs/vx-core/configuration/protocols) — protocol reference
* [Multi-protocol support](/docs/vx/manual/multi-protocol) — using many protocols in the client
* [VX installation](/docs/vx/installation) — install the client first


# Deploy REALITY / XHTTP nodes (/docs/tutorials/deploy-reality-xhttp)



VX can deploy **REALITY** and **XHTTP** (SplitHTTP) nodes on your VPS without editing config files by hand. From a connected server, use **Quick Deploy → Reality/XHTTP**: VX installs Xray-core, writes the inbound config, enables BBR when needed, and adds matching **outbound nodes** to your client so you can connect right away.

<Callout type="warn">
  This deploy profile **replaces an existing Xray configuration** on the server if Xray is already installed.
</Callout>

Watch the walkthrough below, or open it on [YouTube](https://www.youtube.com/watch?v=BW23h3-2T-A).

This video is for Chinese language speakers.

<YouTube id="BW23h3-2T-A" title="Deploy REALITY and XHTTP nodes with VX Quick Deploy" />

## Prerequisites [#prerequisites]

* A Linux VPS reachable over **SSH** (added in VX under **Servers**)
* A domain or site to use as the REALITY **destination** / SNI target (as shown in the video)
* Optional: a **CDN hostname** if you front XHTTP through a CDN

## Related [#related]

* [VX-core panel](/docs/vx/manual/vx-core-panel) — SSH deploy, service control, and inbound wizard
* [VPS monitor](/docs/vx/manual/vps-monitor) — server health over SSH
* [REALITY](/docs/vx-core/configuration/security/reality) — vx-core REALITY settings
* [SplitHTTP (XHTTP)](/docs/vx-core/configuration/transport/splithttp) — transport reference
* [VX installation](/docs/vx/installation) — install the client first


# Import a subscription (/docs/tutorials/import-subscription)



A **subscription** is a URL your provider hosts.
VX fetches it periodically and turns the content into nodes you can connect to.
This tutorial is for users that do not know how to import subscription into VX.

Watch the walkthrough below, or open it on [YouTube](https://www.youtube.com/watch?v=rpGnbPtFMXI).

This video is for Chinese language speakers.

<YouTube id="rpGnbPtFMXI" title="How to import subscription in VX" />

## Related [#related]

* [Installation](/docs/vx/installation) — first launch checklist
* [Deep linking](/docs/vx/deep-linking) — one-click subscribe links for providers
* [VX client overview](/docs/vx) — subscriptions and automatic updates


# Tutorials (/docs/tutorials)



Step-by-step tutorials for common tasks.

<Cards>
  <Card title="Import a subscription" href="/docs/tutorials/import-subscription" description="Add a subscription URL by paste, QR, file, or deep link" />

  <Card title="UWP loopback exemption (Windows)" href="/docs/tutorials/windows-uwp-loopback" description="Allow Microsoft Store apps to use VX via localhost" />

  <Card title="WARP chain proxy" href="/docs/tutorials/warp-chain-proxy" description="Use WARP as the final land node in a chain" />

  <Card title="Deploy REALITY / XHTTP" href="/docs/tutorials/deploy-reality-xhttp" description="Quick Deploy on a VPS from the VX server panel" />

  <Card title="Deploy multiple protocols" href="/docs/tutorials/deploy-multi-protocol" description="All-in-One Quick Deploy — VMess, Trojan, AnyTLS, Hysteria, and more" />

  <Card title="Backup and sync" href="/docs/tutorials/sync-and-backup" description="Cloud sync and encrypted backup across devices (Pro)" />

  <Card title="Custom routing (Netflix)" href="/docs/tutorials/custom-routing" description="Send Netflix traffic through a specific node" />
</Cards>


# Backup and sync (/docs/tutorials/sync-and-backup)



**Sync and backup** keeps your VX setup consistent across phones and computers, and lets you
restore after reinstall or on a new device.

Watch the walkthrough below, or open it on [YouTube](https://www.youtube.com/watch?v=afnmMWIqAP0).

This video is for Chinese language speakers.

<YouTube id="afnmMWIqAP0" title="Backup and sync in VX" />

## Related [#related]

* [Sync and backup (manual)](/docs/vx/manual/sync-and-backup) — feature reference
* [VX client overview](/docs/vx) — Pro and cloud features
* [VX installation](/docs/vx/installation) — install the client first


# Chain Proxy with Warp as land node (/docs/tutorials/warp-chain-proxy)



**Chain proxy** sends your traffic through multiple proxy hops in order.
This tutorial shows how to build a chain that use **Warp** as the final land node.
This can hide your online activity from being known by the first nodes, when you do not
trust those nodes. This can also be used to unlock certain websites when your current node cannot, such as
Gemini.

Watch the walkthrough below, or open it on [YouTube](https://www.youtube.com/watch?v=TrdLZ5gS6pI).

This video is for Chinese language speakers.

<YouTube id="TrdLZ5gS6pI" title="WireGuard chain proxy in VX" />

## Related [#related]

* [WireGuard (vx-core)](/docs/vx-core/configuration/protocols/wireguard) — `DeviceConfig` and `PeerConfig`
* [Outbounds](/docs/vx-core/configuration/outbounds) — handler tags and chaining in config
* [Selectors & node chain](/docs/vx/manual/customize/selectors) — land handlers after the selected node
* [VX installation](/docs/vx/installation) — install the client first


# UWP loopback exemption (Windows) (/docs/tutorials/windows-uwp-loopback)









On Windows, **UWP apps** (apps installed from the Microsoft Store) are blocked from connecting to `127.0.0.1` and
other loopback addresses by default. That restriction makes traffic from Store apps not entering VX
when using VX is System Proxy inbound mode.

This tutorial shows how to **remove the UWP loopback restriction** so that store apps will be proxied when using System Proxy
inbound mode. If you are using TUN mode, then you can skip this step since TUN mode handle all network traffic.

<Tabs groupId="windows-uwp-loopback" items="['Video', 'Step-by-step']" defaultIndex="0">
  <Tab value="Video">
    Watch the walkthrough below, or open it on [YouTube](https://www.youtube.com/watch?v=xarHLgNEbkM).

    This video is for Chinese language speakers

    <YouTube id="xarHLgNEbkM" title="Remove UWP loopback restriction on Windows" />
  </Tab>

  <Tab value="Step-by-step">
    Follow these steps if you prefer text and screenshots.

    ### 1. Download the loopback exemption tool [#1-download-the-loopback-exemption-tool]

    [https://telerik-fiddler.s3.amazonaws.com/fiddler/addons/enableloopbackutility.exe](https://telerik-fiddler.s3.amazonaws.com/fiddler/addons/enableloopbackutility.exe)

    ### 2. Install the loopback exemption tool [#2-install-the-loopback-exemption-tool]

    ### 3. Open the loopback exemption tool [#3-open-the-loopback-exemption-tool]

    Run the UWP loopback exemption utility **as Administrator** (the same tool shown in the video).

    ### 4. Pick the apps to exempt [#4-pick-the-apps-to-exempt]

        <img alt="Pick the apps that you want to remove restriction of" src="__img0" />

    ### 5. Click "Save Changes" [#5-click-save-changes]

        <img alt="Click &#x22;Save Changes&#x22;" src="__img1" />

    ### 7. Verify success [#7-verify-success]

        <img alt="If left bottom corner shows that successfully updated, then it works!" src="__img2" />

    <Callout>
      To undo later, return to the same tool and remove the exemption for those apps.
    </Callout>
  </Tab>
</Tabs>

## When you need this [#when-you-need-this]

* You use System Proxy inbound mode on windows and a **Microsoft Store** app fails
  to be proxied.

## Related [#related]

* [VX installation](/docs/vx/installation) — install the Windows client first.


# Deep Linking (/docs/vx/deep-linking)



VX supports custom URL schemes so airport (proxy provider) owners can let users add subscriptions with one click.

## Format 1: Base64 Encoded Subscription URL [#format-1-base64-encoded-subscription-url]

```
vx://add/sub://<base64_encoded_url>?remarks=<subscription_name>
```

**Example:**

```
vx://add/sub://aHR0cHM6Ly9leGFtcGxlLmNvbS9hYmNk?remarks=My%20Airport
```

The subscription URL is Base64-encoded and placed after `sub://`. The `remarks` parameter sets the display name (URL-encoded).

## Format 2: Direct URL with Parameters [#format-2-direct-url-with-parameters]

```
vx://install-config?url=<subscription_url>&name=<subscription_name>
```

**Example:**

```
vx://install-config?url=https%3A%2F%2Fexample.com%2Fabcd&name=My%20Airport
```

* `url`: The subscription URL (URL-encoded)
* `name`: Display name for the subscription (URL-encoded)

Both formats add a subscription to the VX client. The user must have VX installed and the OS will prompt to open the link in VX.

## Tips for Airport Owners [#tips-for-airport-owners]

* Always URL-encode parameter values (especially non-ASCII names)
* Test links on both mobile and desktop before distributing
* Provide a fallback plain subscription URL for users without VX installed
* Link to [vx.5vnetwork.com](https://vx.5vnetwork.com) for downloads

## QR Codes [#qr-codes]

You can encode either URL format as a QR code. VX supports scanning subscription QR codes from the add-subscription screen.


# VX (/docs/vx)



VX is a cross-platform proxy client built on top of [vx-core](https://github.com/5vnetwork/vx-core). It targets users who want a full-featured proxy tool without editing raw config files.

It is the first fully open-source proxy utility software that supports all major platforms. And all of functionalities are free! (only cloud syncing is for paid users)

All VX releases are built and released by Github Actions. You can check the Github Action log to get the assuarance that the VX app you installed on your devices
is 100% trustworthy.

<GitHubRepoButton repo="vx" />

## Supported Platforms [#supported-platforms]

* Windows
* macOS
* Linux
* Android
* iOS

## Key Capabilities [#key-capabilities]

* Fully open source, built and released automatically by Github Actions
* Completely free of charge with little in-app ads which are only shown in empty areas.
* Support major protocols: VMESS, VLESS, Shadowsocks, Trojan, Hysteria2, and more
* Subscription import and automatic node updates
* Powerful Rule-based routing
* Smart node selection
* Chain Proxy - use multiple proxy servers to enhance privacy
* Realtime logging
* Realtime stats and metrics
* TUN mode with no DNS leak
* VPS server deployment and monitoring via SSH
* Cloud Sync and backup
* Pro User Customer Support
* Local backup

See the [Manual](/docs/vx/manual) for detailed guides on every feature.


# Installation (/docs/vx/installation)



## From Official Website [#from-official-website]

Visit [vx.5vnetwork.com](https://vx.5vnetwork.com) to download the latest version for your platform.

Supported platforms:

* **Windows** — Installer or portable build
* **macOS** — Universal binary (Apple Silicon and Intel)
* **Linux** — AppImage or package
* **Android** — Google Play or APK
* **iOS** — App Store

## First Launch [#first-launch]

After installing:

1. Open VX and accept the privacy policy if prompted
2. Add a subscription or import a single node
3. Select a node and tap **Connect**

## Adding a Subscription [#adding-a-subscription]

You can add subscriptions by:

* Pasting a subscription URL in **Outbounds → Subscriptions → Add**
* Scanning a QR code
* Opening a [deep link](/docs/vx/deep-linking) from an airport provider

## System Requirements [#system-requirements]

### Windows [#windows]

* Windows 10 or later
* Administrator privileges recommended for TUN mode

### macOS [#macos]

* macOS 11 or later
* Network extension permission required for TUN mode

### Linux [#linux]

* Modern glibc-based distribution
* Root privileges required for TUN mode

### Android / iOS [#android--ios]

* Android 7+ / iOS 15+
* VPN permission required for TUN mode

## Building from Source [#building-from-source]

VX is a Flutter project. To build locally:

```bash
git clone https://github.com/5vnetwork/vx.git
git clone https://github.com/5vnetwork/tm-plugin.git
cd vx
flutter pub get
flutter run
```

You also need a built copy of vx-core for your target platform. See [vx-core](/docs/vx-core).


# Overview (/docs/vx-core)



vx-core is the proxy engine that powers [VX](https://github.com/5vnetwork/vx), [UmiVPN](https://github.com/5vnetwork/umivpn), and [Nunu Accelerator](https://github.com/5vnetwork/nunu).
It can also be used as a standalone proxy server on any operating system.

<GitHubRepoButton repo="vx-core" />

## Acknowledgments [#acknowledgments]

vx-core includes code from the following projects:

* [v2ray-core](https://github.com/v2fly/v2ray-core)
* [Xray-core](https://github.com/XTLS/Xray-core)
* [hysteria](https://github.com/apernet/hysteria)
* [sing-box](https://github.com/SagerNet/sing-box)

## Deployment modes [#deployment-modes]

vx-core runs in different scenarios depending on the platform:

* **Server**: Standalone server program
* **Client library**: Embedded in VX via gomobile/c-shared bindings

## Recommended deployment [#recommended-deployment]

We recommend using the [VX client](/docs/vx) to install and configure vx-core on a VPS. The client provides a graphical interface for deploying servers over SSH, editing configuration, and monitoring.

For manual server deployment, see [Quick Start](/docs/vx-core/quick-start).

## License [#license]

See the [LICENSE](https://github.com/5vnetwork/vx-core/blob/main/LICENSE) file in the vx-core repository. Code in some directories (VLESS, REALITY, WireGuard, etc.) is derived from Xray-core and distributed under MPL 2.0.


# Quick Start (/docs/vx-core/quick-start)



This guide explains how to run vx-core in server mode on Linux. For graphical deployment, use the [VX client server panel](/docs/vx/manual/vx-core-panel) instead.

## Prerequisites [#prerequisites]

* Linux VPS (amd64 or arm64)
* root or sudo access

## Script installation [#script-installation]

We recommend the official install script:

```bash
bash -c "$(curl -L https://github.com/5vnetwork/vx-install/raw/main/install-vx.sh)" @ install
```

The script installs the `vx` binary and configures a systemd service.

## Manual configuration [#manual-configuration]

The configuration file can be binary protobuf or JSON in ProtoJSON format. Create `config.json`:

```json
{
  "inbounds": [
    {
      "tag": "vmess",
      "ports": [10000],
      "protocol": {
        "@type": "type.googleapis.com/vx.proxy.vmess.VmessServerConfig",
        "secureEncryptionOnly": true
      }
    }
  ],
  "router": {
    "rules": [
      {
        "matchAll": true,
        "outboundTag": "direct"
      }
    ]
  },
  "outbounds": [
    {
      "tag": "direct",
      "protocol": {
        "@type": "type.googleapis.com/vx.proxy.freedom .FreedomConfig"
      }
    }
  ]
}
```

The full server configuration schema is defined in [`protos/proto/vx/server.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/server.proto). See [Configuration](/docs/vx-core/configuration) for each section.

## Run the server [#run-the-server]

```bash
vx run --config config.json
```

If installed via the install script, manage the service with systemd:

```bash
systemctl start vx
systemctl enable vx
systemctl status vx
```

## Default configuration path [#default-configuration-path]

After installation via the install script, the configuration file is located at:

```
/usr/local/etc/vx/config.json
```

## Next steps [#next-steps]

* See [Configuration](/docs/vx-core/configuration) for configuration file details
* Add more inbounds for different protocols in [Protocols](/docs/vx-core/configuration/protocols)
* Use VX to deploy and manage servers remotely


# Automatic Node Selection (/docs/vx/manual/automatic-node-selection)



**Pro feature** — Automatically pick the best node from a group based on latency tests and health checks.

## Proxy Selector Modes [#proxy-selector-modes]

* `Manual`: You choose a single node or balance across selected nodes
* `Auto`: VX periodically tests nodes and switches to the best available

## Auto Selection [#auto-selection]

In auto mode, VX runs RTT/latency tests against configured nodes and selects the fastest healthy one. If the current node degrades, the selector switches automatically without disconnecting you.

Configure:

* Test interval and timeout
* Which subscriptions or tags participate
* Fallback behavior when all nodes fail

## Manual Multi-Node (Pro) [#manual-multi-node-pro]

Manual mode also supports selecting **multiple** nodes with a balance strategy:

* **Random** — Distribute connections randomly
* **Round robin** — Rotate through nodes
* **Least latency** — Prefer the fastest node per connection

## Free Tier [#free-tier]

Free users can use manual single-node selection only. Upgrade to Pro for auto selection and multi-node balancing.

## Related [#related]

* [Selectors](/docs/vx/manual/customize/selectors) — configure selector filters and strategies
* [Routing modes](/docs/vx/manual/customize/modes) — assign selectors to routing rules


# Customer Support (/docs/vx/manual/customer-support)



VX includes built-in support channels so you can get help without leaving the app.

## Contact Options [#contact-options]

Reach support from **Settings → Contact**. Available channels depend on platform and may include:

* Email
* In-app messaging
* Links to community resources

## Log Upload [#log-upload]

When troubleshooting connection or routing issues, you can upload logs directly from the app. Support receives sanitized diagnostic output from vx-core to help diagnose the problem.

To upload logs:

1. Reproduce the issue with logging enabled
2. Go to **Settings → Contact** or the log upload option
3. Submit — logs are sent securely to the support backend

## Before Contacting Support [#before-contacting-support]

Helpful information to include:

* VX version and platform
* Connection mode (TUN vs system proxy)
* Whether the issue affects all nodes or one subscription
* Exported logs from the realtime logging view

## Airport Owners [#airport-owners]

If you distribute subscriptions to VX users, see [Deep Linking](/docs/vx/deep-linking) for integration docs.


# Home Tab (/docs/vx/manual/home)



The **Home** tab is your control center. It includes widgets to help you manage your network more easily — without leaving the main screen.

VX offers two home layouts. Tap the **edit** icon in the top bar to switch between them or change which widgets are visible.

## Layout modes [#layout-modes]

* **Standard**: Fixed structure with optional show/hide per widget
* **Customizable**: Drag-and-drop layout, multi-column, per-subscription tiles

On **phones**, widgets stack in a single column. On **wider screens** (tablet/desktop), the standard layout splits into two or three columns.

***

## Stats widgets [#stats-widgets]

These four tiles sit at the top of the **standard** layout (or wherever you place them in customizable mode). They update in real time while connected.

You can congigure how often stats are sampled in the Setting page, default interval is 3s.

> **Tip:** If all four stats widgets are hidden, VX stops the stats stream to save resources.

### Upload [#upload]

Shows current **upload speed** of all tunneled traffic in human-readable units (e.g. KB/s, MB/s).

* **Tap** the tile to switch between the number and a **history chart**

### Download [#download]

Same as Upload, but for **download speed**. .

### Memory [#memory]

Shows **vx-core memory usage** while the proxy is running.

It only show memory of the tunnel process, not the ui process. When you are connected, there are
two process, one is tunnel process which handle all your network traffic, the other is ui process which
is the opened VX application.

It typycally ranges from 30MB to 100MB.

### Connections [#connections]

Shows the number of **active proxy connections** handled by vx-core. Green accent color.

***

## Current / Active Nodes [#current--active-nodes]

Label in the app: **Current nodes** or **Active nodes**, depending on state.

* `Disconnected (manual mode)` (`Current nodes`): Nodes you have **selected** in the Proxy selector
* `Connected` (`Active nodes`): Nodes **currently being used**

Each row shows:

* Country flag and node name
* Protocol type
* Observed speed and latency
  * **Rate** — Live throughput for traffic routed through this node (based on a small download sample, typically \~10 KB). Shown while connected; the larger, the better.
  * **Latency** — Round-trip time for a response through the node, in milliseconds. Reflects current path quality, the smaller, the better.

***

## Nodes helper [#nodes-helper]

Label: **Nodes helper** (Recommended nodes).

A quick-pick list to find good nodes without browsing your full outbound list. Three tabs:

* **Speed**: Top 10 nodes by last speed test
* **Latency**: Top 10 nodes by lowest ping
* **Recent**: Nodes you used recently

> **Tip:** For each row, tap the stats data to trigger a speed and latency test.

***

## Mode [#mode]

Label: **Mode**.

Lets you switch the active **routing profile** with one tap. Each chip is a saved routing mode.

* Hover/long-press default modes for a short description

To manage modes, click the **Customize** tab. See [Customize](/docs/vx/manual/customize).

***

## Proxy Node Selctor [#proxy-node-selctor]

Label: **Proxy**.

A selector's job is to select nodes based on your preference. There is a default selector called Proxy.

It is used in the default routing modes to select nodes for proxy traffic.

Proxy Node Selector is special because it supports manual mode: you select the nodes to use in the Node page by toggling switches. Other selectors do
not support this mode.

See [Node Selector](/docs/vx/manual/automatic-node-selection) for detailed explanations of a slector.

***

## Inbound [#inbound]

Label: **Inbound**.

Choose how traffic **enters** vx-core on **desktop** (Windows, macOS, Linux):

* **TUN**: System-wide capture via virtual network interface
* **System proxy**: Sets OS HTTP/SOCKS proxy to localhost

Not shown on Android/iOS — those platforms always use the TUN mode.

***

## Subscription [#subscription]

Shows a widget for your **most recently added subscription** or **starred subscription**.

> **Tip:** Click it will update it.

***

## Customizing the home screen [#customizing-the-home-screen]

In custom layout, you can add more subscription widget and selector widget, you will see the button
when you right click a subscription card or clicking the menu of a selector widget.

***

***

## Related [#related]

* [Features overview](/docs/vx/manual/multi-protocol) — supported protocols and transports


# Manual (/docs/vx/manual)



This section is the **VX user manual** — it explains the UI and features.

## Start here [#start-here]

<Cards>
  <Card title="Home page widgets" href="/docs/vx/manual/home" description="Stats, nodes, routing, and customizable layout" />

  <Card title="Customize page" href="/docs/vx/manual/customize" description="Simplified and advanced routing, sets, selectors, DNS" />

  <Card title="Multi-protocol support" href="/docs/vx/manual/multi-protocol" description="VMESS, VLESS, Shadowsocks, Trojan, Hysteria2, and more" />

  <Card title="Automatic node selection" href="/docs/vx/manual/automatic-node-selection" description="Latency-based auto selection (Pro)" />

  <Card title="Proxy share" href="/docs/vx/manual/proxy-share" description="Local HTTP/SOCKS server" />

  <Card title="Sync and backup" href="/docs/vx/manual/sync-and-backup" description="Cloud sync across devices (Pro)" />

  <Card title="VPS monitor" href="/docs/vx/manual/vps-monitor" description="Remote server health over SSH" />

  <Card title="VX-core panel" href="/docs/vx/manual/vx-core-panel" description="Deploy and manage vx-core from the client" />

  <Card title="Customer support" href="/docs/vx/manual/customer-support" description="In-app help and log upload" />
</Cards>

> **Note**: Most features are free.


# Supported Protocols (/docs/vx/manual/multi-protocol)



VX supports the major proxy protocols through vx-core.

## Supported Protocols [#supported-protocols]

* `VMESS`: AEAD encryption, widely supported by providers
* `VLESS`: Reduced TLS-in-TLS fingerprint
* `Shadowsocks`: Classic protocol with multiple ciphers
* `Shadowsocks2022`: Improved Shadowsocks protocol
* `Trojan`: TLS-wrapped, good for disguised traffic
* `Hysteria2`: QUIC-based, optimized for high-speed links
* `SOCKS5`: Standard SOCKS proxy
* `HTTP`: HTTP CONNECT proxy
* `AnyTLS`: Reduced TLS-in-TLS fingerprint
* `WireGuard`: Popular VPN protocol

## Transports [#transports]

Many protocols support additional transport layers:

* TCP, WebSocket, gRPC
* HTTPUpgrade / SplitHTTP
* KCP
* TLS, uTLS, REALITY

## Related [#related]

* [Protocols reference](/docs/vx-core/configuration/protocols) — full vx-core protocol list
* [Import subscription](/docs/tutorials/import-subscription) — add nodes from a provider URL


# HTTP/SOCKS Server (/docs/vx/manual/proxy-share)



VX can expose a local HTTP and/or SOCKS5 server so other devices or apps on your network use the same proxy connection.

## Proxy Share Mode [#proxy-share-mode]

When enabled, vx-core listens on a configurable address and port and accepts incoming HTTP CONNECT and SOCKS5 connections. Traffic from those clients is routed through the same outbounds and rules as the VX app itself.

## System Proxy Mode [#system-proxy-mode]

Alternatively, VX can set the **system proxy** (HTTP + SOCKS on localhost) without full TUN:

* Lighter weight than TUN mode
* Works for apps that respect system proxy settings
* Dynamic port assignment available to avoid conflicts

## Use Cases [#use-cases]

* Share a VPN/proxy connection with a game console or TV on the LAN
* Let another browser or tool use VX without installing it
* Test clients against your current routing setup

## Settings [#settings]

* Listen address (default localhost; can bind to LAN interface for sharing)
* Port (fixed or dynamically assigned)
* UDP support for SOCKS5

## Security Note [#security-note]

Binding to `0.0.0.0` exposes the proxy to your local network. Only enable LAN sharing on trusted networks and consider firewall rules.


# Sync and Backup (/docs/vx/manual/sync-and-backup)



**Pro feature** — Keep nodes, routing rules, server configs, and selector settings in sync across your devices, with optional encrypted cloud backup.

## Sync [#sync]

When signed in with a Pro account, VX syncs changes through Supabase:

* `Nodes and subscriptions`: Optional
* `Routing rules and modes`: Optional
* `Server SSH configs`: Optional
* `Proxy selector settings`: Optional

Changes on one device propagate to others. Sync runs periodically and on demand. Push notifications (where available) can trigger immediate sync.

## Encryption [#encryption]

Sync data is encrypted with a password you set. The password is stored in secure device storage and never sent in plain text.

## Backup [#backup]

Create encrypted backups of your full configuration:

* Upload to cloud storage tied to your account
* Restore on a new device or after reinstall
* Set a separate backup password

Backups include outbounds, routing, servers, and preferences — not your vx-core binary.

## Enable Sync [#enable-sync]

Go to **Settings → Sync & Backup**, sign in, set your sync password, and choose which categories to sync.


# VPS Monitor (/docs/vx/manual/vps-monitor)



The **Server** tab lets you connect to a Linux VPS over SSH and monitor vx-core runtime status in real time.

## Monitored Metrics [#monitored-metrics]

* **Installed** — Whether vx-core is present on the server
* **Version** — Running vx-core version
* **Uptime** — Service start time
* **Memory** — Current memory usage

## Streaming Updates [#streaming-updates]

Server monitoring uses a streaming connection so metrics refresh continuously while the monitor view is open — no manual refresh needed.

## Server Actions [#server-actions]

From the same panel you can:

* Shut down or reboot the VPS
* Start, stop, or restart the vx-core service
* Install, update, or uninstall vx-core

## Setup [#setup]

Add a server by providing SSH credentials (host, port, username, key or password). VX stores credentials securely and reuses the connection for config editing and deployment.

## Related [#related]

* [VX-core Panel](/docs/vx/manual/vx-core-panel) — edit server configuration
* [vx-core Quick Start](/docs/vx-core/quick-start) — manual server setup


# VX-core Panel (/docs/vx/manual/vx-core-panel)



The server panel in VX is the recommended way to deploy and configure vx-core on a Linux VPS — no SSH terminal or manual JSON editing required.

## Deploy [#deploy]

Connect via SSH and VX can:

* Run the official install script
* Enable the `vx` systemd service
* Apply optional optimizations (BBR, firewall rules)

Deploy supports vx-core as well as Xray and Hysteria configs when migrating or running side-by-side.

## Config Editing [#config-editing]

View and edit the server config at `/usr/local/etc/vx/config.json` directly from the app. Changes are pushed over SSH and the service is restarted automatically.

You can work with:

* Inbound definitions (ports, protocols, TLS settings)
* Router rules
* Outbound handlers

## Service Control [#service-control]

* `Install`: Download and install vx-core
* `Update`: Upgrade to the latest version
* `Start / Stop / Restart`: Control the systemd service
* `Uninstall`: Remove vx-core from the server

## Inbound Wizard [#inbound-wizard]

Add new inbounds through a guided flow — pick protocol, port, and security options. VX generates the correct ProtoJSON config and applies it to the server.

## Related [#related]

* [VPS Monitor](/docs/vx/manual/vps-monitor) — runtime status
* [Configuration](/docs/vx-core/configuration) — config file reference


# Dialer Factory (/docs/vx-core/configuration/dialer-factory)



All outbounds are created by this factory.
Schema definition: [`protos/proto/vx/dialerfactory/dialerfactory.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/dialerfactory/dialerfactory.proto).

Used in `ServerConfig.dialerFactory`.

## DialerFactoryConfig [#dialerfactoryconfig]

<ProtoField name="dialTimeout" type="uint32">
  Connection timeout (seconds)
</ProtoField>

<ProtoField name="shouldBindDevice" type="bool">
  Bind the socket to the default physical network NIC
</ProtoField>

<ProtoField name="resolveDomain" type="bool">
  Use the [internal DNS resolver](/docs/vx-core/configuration/dns) `internalResolver` when resolving domains during dialing
</ProtoField>

## Example [#example]

```json
{
  "dialerFactory": {
    "dialTimeout": 10,
    "shouldBindDevice": false,
    "resolveDomain": true
  }
}
```

## Related [#related]

* [Outbounds](/docs/vx-core/configuration/outbounds) — `address`, `domainStrategy`, ports
* [DNS](/docs/vx-core/configuration/dns) — `internalResolver`


# Dispatcher (/docs/vx-core/configuration/dispatcher)



The dispatcher is configured in `ServerConfig.dispatcher` (`DispatcherConfig`). Schema definition: [`protos/proto/vx/dispatcher/dispatcher.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/dispatcher/dispatcher.proto).

All inbound and DNS server traffic passes through the dispatcher. The dispatcher selects an outbound via routing, then hands the traffic to that outbound for processing.

## DispatcherConfig [#dispatcherconfig]

<ProtoField name="destinationOverride" type="string[]">
  When non-empty, sniff connections and override the destination with the sniffed domain when the protocol matches
</ProtoField>

<ProtoField name="sniff" type="bool">
  Sniff all connections to obtain additional connection metadata, which can make logs more complete
</ProtoField>

<ProtoField name="fallbackTimeout" type="uint32">
  Time to wait for response data (milliseconds). If no response data is received within this period, the connection is treated as failed and fallback begins
</ProtoField>

<ProtoField name="sessionStats" type="bool">
  Enable session metering statistics, shown in logs
</ProtoField>

## Example [#example]

```json
{
  "dispatcher": {
    "sniff": true,
    "destinationOverride": ["http", "tls"],
    "sessionStats": false
  }
}
```

## Related [#related]

* [Router](/docs/vx-core/configuration/router) — `skipSniff`, `protocols`, domain rules after sniffing
* [DNS](/docs/vx-core/configuration/dns) — resolution when using `resolveDomain` rules


# DNS (/docs/vx-core/configuration/dns)



DNS is configured in `ServerConfig.dns` (`DnsConfig`). Schema definition: [`protos/proto/vx/dns/dns.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/dns/dns.proto).

`dnsServers` defines named upstreams; `concurrentDnsServers` / `serialDnsServers` can combine multiple upstreams into new named servers; `internalResolver` and `requestDomainResolver` reference these servers by **name**. `dnsHijack` selects the upstream for hijacked DNS queries.

## DnsConfig [#dnsconfig]

<ProtoField name="records" type="Record[]">
  Static domain records answered by the local static server before querying other upstreams.
</ProtoField>

<ProtoField name="recordStrings" type="string[]">
  Static records in standard DNS RR text format (e.g. `www.example.com. 3600 IN A 192.0.2.1`), equivalent to `records` and convenient for pasting full record lines.
</ProtoField>

<ProtoField name="dnsServers" type="DnsServerConfig[]">
  Named DNS upstream definitions. Each must have a unique `name` and one server type (`type` oneof).
</ProtoField>

<ProtoField name="internalResolver" type="Resolver">
  Resolver used to resolve domains when **dialing** outbounds.
</ProtoField>

<ProtoField name="requestDomainResolver" type="Resolver">
  Resolver used by the **router** and **dispatcher** to resolve request domains.
</ProtoField>

<ProtoField name="concurrentDnsServers" type="ConcurrentDnsServer[]">
  Combine multiple defined DNS servers into a new named server by querying them in parallel.
</ProtoField>

<ProtoField name="serialDnsServers" type="SerialDnsServer[]">
  Combine multiple defined DNS servers into a new named server by trying them in order.
</ProtoField>

<ProtoField name="dnsHijack" type="DnsHijackConfig">
  DNS hijacking.
</ProtoField>

## Record [#record]

<ProtoField name="domain" type="string">
  Hostname
</ProtoField>

<ProtoField name="ip" type="string[]">
  Static IP answers. IPv4 produces A records; IPv6 produces AAAA records.
</ProtoField>

<ProtoField name="proxiedDomain" type="string">
  When non-empty, produce a CNAME to `proxiedDomain` for this domain instead of returning `ip` directly.
</ProtoField>

## Resolver [#resolver]

Resolvers reference `DnsServerConfig`, `ConcurrentDnsServer`, or `SerialDnsServer` by **name** from `dnsServers`. Multiple names are tried serially in order.

<ProtoField name="dnsServers" type="string[]">
  List of named DNS servers to use
</ProtoField>

<ProtoField name="interval" type="uint32">
  Wait time between queries when trying serially (**seconds**)
</ProtoField>

<ProtoField name="name" type="string">
  Resolver name
</ProtoField>

## ConcurrentDnsServer [#concurrentdnsserver]

<ProtoField name="dnsServers" type="string[]">
  Names of DNS servers to query in parallel
</ProtoField>

<ProtoField name="name" type="string">
  Name of the combined server, referenced by `Resolver.dnsServers` and `DnsRuleConfig.dnsServerName`
</ProtoField>

## SerialDnsServer [#serialdnsserver]

<ProtoField name="dnsServers" type="string[]">
  Names of DNS servers to try in order
</ProtoField>

<ProtoField name="interval" type="uint32">
  How long to wait before trying the next server after the current one fails (**seconds**)
</ProtoField>

<ProtoField name="name" type="string">
  Name of the combined server
</ProtoField>

## DnsServerConfig [#dnsserverconfig]

Each server has a unique `name`.

Only one of `plainDnsServer`, `tlsDnsServer`, `dohDnsServer`, `quicDnsServer`, `fakeDnsServer`,
`goDnsServer`, or `emptyDnsServer` may be set.

<ProtoField name="name" type="string">
  Server name; referenced by resolvers, combined servers, and DNS rules

  Do not use `hijack` as a name
</ProtoField>

<ProtoField name="plainDnsServer" type="PlainDnsServer">
  Traditional UDP DNS (TCP optional)
</ProtoField>

<ProtoField name="tlsDnsServer" type="TlsDnsServer">
  DNS over TLS (DoT)
</ProtoField>

<ProtoField name="dohDnsServer" type="DohDnsServer">
  DNS over HTTPS (DoH)
</ProtoField>

<ProtoField name="quicDnsServer" type="QuicDnsServer">
  DNS over QUIC (DoQ)
</ProtoField>

<ProtoField name="fakeDnsServer" type="FakeDnsServer">
  Fake IP pool that assigns fake addresses to matching domains
</ProtoField>

<ProtoField name="goDnsServer" type="GoDnsServer">
  Go standard library system resolver
</ProtoField>

<ProtoField name="emptyDnsServer" type="EmptyDnsServer">
  Empty resolver that returns no upstream results
</ProtoField>

<ProtoField name="clientIp" type="string">
  Client IP sent in EDNS Client Subnet (ECS)
</ProtoField>

<ProtoField name="cacheDuration" type="uint32">
  Answer cache duration (**seconds**). When `0`, the minimum TTL from the answer is used.
</ProtoField>

<ProtoField name="ipTags" type="string[]">
  Keep only answer addresses that fall within these [geo](/docs/vx-core/configuration/geo) IP sets; other IPs are discarded
</ProtoField>

### PlainDnsServer [#plaindnsserver]

<ProtoField name="addresses" type="string[]">
  Upstream addresses in `host:port` format (typically port `53`)
</ProtoField>

<ProtoField name="useDefaultDns" type="bool">
  When `true`, use DNS servers on the system default interface; updates automatically when interface DNS changes. Falls back to `addresses` when no system DNS is available.
</ProtoField>

### TlsDnsServer [#tlsdnsserver]

<ProtoField name="addresses" type="string[]">
  DoT upstream addresses in `host:port` format (typically port `853`)
</ProtoField>

### DohDnsServer [#dohdnsserver]

<ProtoField name="url" type="string">
  DoH endpoint URL (e.g. `https://dns.google/dns-query`)
</ProtoField>

### QuicDnsServer [#quicdnsserver]

<ProtoField name="address" type="string">
  DoQ upstream address (`host:port`)
</ProtoField>

### FakeDnsServer [#fakednsserver]

<ProtoField name="poolConfigs" type="PoolConfig[]">
  Fake IP address pool configuration. Avoid configuring multiple overlapping pools for the same IP version (IPv4 / IPv6).
</ProtoField>

#### PoolConfig [#poolconfig]

<ProtoField name="cidr" type="string">
  CIDR for the fake IP pool (e.g. `198.18.0.0/15`)
</ProtoField>

<ProtoField name="lruSize" type="uint32">
  LRU capacity for domain → fake IP mappings in the pool
</ProtoField>

### GoDnsServer [#godnsserver]

Uses the operating system / Go default resolution path. Its traffic does not go through the dispatcher and is sent directly. This type is typically used on the server side.

### EmptyDnsServer [#emptydnsserver]

Always returns an empty resolution.

## DnsHijackConfig [#dnshijackconfig]

<ProtoField name="dnsRules" type="DnsRuleConfig[]">
  Route hijacked DNS requests to a specified `dnsServerName` by domain, set, and query type. Rules are matched in order.
</ProtoField>

When this configuration is present, a DNS server named `hijack` is added automatically. A `dns` outbound is also added so you can specify the `dns` outbound in routing rules to hijack DNS traffic.

## DnsRuleConfig [#dnsruleconfig]

<ProtoField name="dnsServerName" type="string">
  Target `DnsServerConfig.name` (or combined server name)
</ProtoField>

<ProtoField name="geoDomains" type="Domain[]">
  Match query names
</ProtoField>

<ProtoField name="domainTags" type="string[]">
  Match query names belonging to these [geo](/docs/vx-core/configuration/geo) domain sets
</ProtoField>

<ProtoField name="includedTypes" type="DnsType[]">
  Restrict query types.
</ProtoField>

<ProtoField name="ruleName" type="string">
  Label for debugging and display
</ProtoField>

### DnsType [#dnstype]

DNS query type enum defined in proto, including `DnsType_A`, `DnsType_AAAA`, `DnsType_CNAME`, `DnsType_HTTPS`, `DnsType_ANY`, etc.

## Example [#example]

Static records + direct DoH + hijack rules:

```json
{
  "dns": {
    "records": [
      { "domain": "internal.example", "ip": ["10.0.0.1"] }
    ],
    "dnsServers": [
      {
        "name": "doh",
        "dohDnsServer": { "url": "https://dns.google/dns-query" }
      }
    ],
    "internalResolver": {
      "dnsServers": ["doh"]
    },
    "requestDomainResolver": {
      "dnsServers": ["doh"]
    },
    "dnsHijack": {
      "enableFakeDns": true,
      "dnsRules": [
        {
          "dnsServerName": "doh",
          "domainTags": ["gfw"],
          "includedTypes": ["DnsType_A", "DnsType_AAAA"],
          "ruleName": "proxy-dns"
        }
      ]
    }
  }
}
```

## Related [#related]

* [Geo](/docs/vx-core/configuration/geo) — `domainTags`, `ipTags` on rules and servers
* [Router](/docs/vx-core/configuration/router) — `fakeIp` and domain resolution rules
* [Dialer factory](/docs/vx-core/configuration/dialer-factory) — `useInternalResolver`


# Geo (/docs/vx-core/configuration/geo)



Geographic data sets are defined in `ServerConfig.geo` (`GeoConfig`). Schema definition: [`protos/proto/vx/geo/geo.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/geo/geo.proto).

**Atomic sets** (`atomic*`) hold domains, IPs, or app IDs directly. **Great sets** (`great*`) combine other sets via `inNames` / `exNames`. Names must be unique within each category for both great and atomic sets.

[Router](/docs/vx-core/configuration/router) and [DNS](/docs/vx-core/configuration/dns) reference sets by **name** via `domainTags`, `dstIpTags`, `srcIpTags`, and `appTags`. For client UI details, see [Sets](/docs/vx/manual/customize/sets).

## GeoConfig [#geoconfig]

<ProtoField name="greatDomainSets" type="GreatDomainSetConfig[]">
  Composite domain sets (include / exclude other sets)
</ProtoField>

<ProtoField name="atomicDomainSets" type="AtomicDomainSetConfig[]">
  Atomic domain sets (inline domains, geosite, Clash rules, remote files, etc.)
</ProtoField>

<ProtoField name="greatIpSets" type="GreatIPSetConfig[]">
  Great IP sets
</ProtoField>

<ProtoField name="atomicIpSets" type="AtomicIPSetConfig[]">
  Atomic IP sets
</ProtoField>

<ProtoField name="appSets" type="AppSetConfig[]">
  Application sets
</ProtoField>

Names must be unique within each category (`greatDomainSets` and `atomicDomainSets` cannot share a name; same for IP sets).

## Domain [#domain]

A single domain matching rule. Defined in [`protos/proto/vx/common/geo/geo.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/common/geo/geo.proto).

Used in [router](/docs/vx-core/configuration/router) `geoDomains`, [DNS](/docs/vx-core/configuration/dns) `geoDomains`, and [AtomicDomainSetConfig](#atomicdomainsetconfig) `domains`.

<ProtoField name="type" type="Domain.Type">
  Matching mode:

  * `Plain`: Substring match (keyword)
  * `Regex`: Regular expression match
  * `RootDomain`: Root domain and its subdomains (suffix match)
  * `Full`: Exact full hostname match
</ProtoField>

<ProtoField name="value" type="string">
  Domain or pattern to match
</ProtoField>

## CIDR [#cidr]

A single IP network segment. Defined in [`protos/proto/vx/common/geo/geo.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/common/geo/geo.proto).

Used in [AtomicIPSetConfig](#atomicipsetconfig) `cidrs`.

<ProtoField name="ip" type="bytes">
  IP address, 4 bytes (IPv4) or 16 bytes (IPv6). Usually base64-encoded in ProtoJSON.
</ProtoField>

<ProtoField name="prefix" type="uint32">
  Network prefix length (CIDR mask bits, e.g. `24` for `/24`)
</ProtoField>

## AtomicDomainSetConfig [#atomicdomainsetconfig]

Atomic domain set. `domains`, `geosite`, `geosites`, `clashFiles`, and `remoteGeoFiles` can be combined.

<ProtoField name="name" type="string">
  Set name, referenced by `domainTags`
</ProtoField>

<ProtoField name="domains" type="Domain[]">
  Inline [Domain](#domain) list
</ProtoField>

<ProtoField name="geosite" type="GeositeConfig">
  Load domains from a single geosite configuration
</ProtoField>

<ProtoField name="geosites" type="GeositeConfig[]">
  Load domains from multiple geosite configurations (can be used alongside `geosite`)
</ProtoField>

<ProtoField name="useBloomFilter" type="bool">
  Enable a bloom filter for large sets to reduce memory usage (common on iOS). Has about a 1% false positive rate.
</ProtoField>

<ProtoField name="clashFiles" type="string[]">
  Clash-format rule file paths from which domain rules are extracted
</ProtoField>

<ProtoField name="inverse" type="bool">
  Inverse match: matches when the domain is **not** in this set's sources
</ProtoField>

<ProtoField name="remoteGeoFiles" type="GeoRemoteFile[]">
  Remote geo files downloaded periodically over HTTPS (see [GeoRemoteFile](#georemotefile))
</ProtoField>

## GeositeConfig [#geositeconfig]

Load domains from `geosite.dat` (or compatible format) by category code.

<ProtoField name="codes" type="string[]">
  Geosite category codes (e.g. `cn`, `gfw`, `private`)
</ProtoField>

<ProtoField name="attributes" type="string[]">
  Further filter loaded domains by `Domain.attribute.key` (case-insensitive)
</ProtoField>

<ProtoField name="filepath" type="string">
  Local `geosite.dat` path
</ProtoField>

<ProtoField name="remoteUrl" type="string">
  HTTPS URL for remote `geosite.dat`; refreshed on schedule via `refreshCron`. Downloaded to `filepath`
</ProtoField>

<ProtoField name="refreshCron" type="string">
  5-field cron (minute hour day month weekday). Empty means fetch only on startup / reload
</ProtoField>

## AtomicIPSetConfig [#atomicipsetconfig]

Atomic IP set. `cidrs`, `geoip`, `clashFiles`, and `remoteGeoFiles` can be combined.

<ProtoField name="name" type="string">
  Set name, referenced by `dstIpTags`, `srcIpTags`, and `ipTags`
</ProtoField>

<ProtoField name="cidrs" type="CIDR[]">
  Inline [CIDR](#cidr) list
</ProtoField>

<ProtoField name="geoip" type="GeoIPConfig">
  Load CIDRs from a geoip file by country/region code
</ProtoField>

<ProtoField name="inverse" type="bool">
  Inverse match: matches when the IP is **not** in this set's sources
</ProtoField>

<ProtoField name="clashFiles" type="string[]">
  Clash-format rule file paths from which IP / CIDR rules are extracted
</ProtoField>

<ProtoField name="remoteGeoFiles" type="GeoRemoteFile[]">
  Remote geo files downloaded on schedule
</ProtoField>

## GeoIPConfig [#geoipconfig]

Load IP ranges from `geoip.dat` (or compatible format) by code.

<ProtoField name="codes" type="string[]">
  GeoIP category / country codes (e.g. `cn`, `private`)
</ProtoField>

<ProtoField name="filepath" type="string">
  Local `geoip.dat` path
</ProtoField>

<ProtoField name="remoteUrl" type="string">
  HTTPS URL for remote `geoip.dat`
</ProtoField>

<ProtoField name="refreshCron" type="string">
  5-field cron. Empty means fetch only on startup / reload
</ProtoField>

## GreatDomainSetConfig [#greatdomainsetconfig]

Great domain set that does not hold domains directly; it references other atomic or great domain sets.

Matching logic: check `exNames` first (a hit means **no match**), then check `inNames` (a hit on any means **match**).

<ProtoField name="name" type="string">
  Composite set name
</ProtoField>

<ProtoField name="oppositeName" type="string">
  Paired opposite set name. See opposite set behavior in [Sets](/docs/vx/manual/customize/sets)
</ProtoField>

<ProtoField name="inNames" type="string[]">
  Include domains from these sets (match if any hit)
</ProtoField>

<ProtoField name="exNames" type="string[]">
  Exclude domains from these sets (no match if any hit)
</ProtoField>

Do not include this set's own `name` in `inNames` or `exNames`.

## GreatIPSetConfig [#greatipsetconfig]

Great IP set; same logic as [GreatDomainSetConfig](#greatdomainsetconfig), but for IPs.

<ProtoField name="name" type="string">
  Composite set name
</ProtoField>

<ProtoField name="oppositeName" type="string">
  Paired opposite set name
</ProtoField>

<ProtoField name="inNames" type="string[]">
  Include addresses from these IP sets
</ProtoField>

<ProtoField name="exNames" type="string[]">
  Exclude addresses from these IP sets
</ProtoField>

## AppSetConfig [#appsetconfig]

Application set used by router `appTags`.

<ProtoField name="name" type="string">
  Set name
</ProtoField>

<ProtoField name="appIds" type="AppId[]">
  List of [AppId](#appid)
</ProtoField>

<ProtoField name="clashFiles" type="string[]">
  Clash-format rule files from which AppId rules are extracted
</ProtoField>

## AppId [#appid]

A single application ID matching rule. Defined in [`protos/proto/vx/router/router.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/router/router.proto).

<ProtoField name="type" type="AppId.Type">
  Matching mode:

  * `Keyword`: Substring match
  * `Prefix`: Prefix match
  * `Exact`: Exact match
</ProtoField>

<ProtoField name="value" type="string">
  Application package name or ID string (converted to lowercase when matching)
</ProtoField>

## GeoRemoteFile [#georemotefile]

Scheduled download configuration for remote geo data files, used in `AtomicDomainSetConfig.remoteGeoFiles` and `AtomicIPSetConfig.remoteGeoFiles`.

<ProtoField name="filepath" type="string">
  Local path to write after download
</ProtoField>

<ProtoField name="sourceUrl" type="string">
  HTTPS download URL
</ProtoField>

<ProtoField name="refreshCron" type="string">
  5-field cron (minute hour day month weekday). Empty means fetch once on startup / reload only
</ProtoField>

## Example [#example]

Atomic domain set + composite set + router reference:

```json
{
  "geo": {
    "atomicDomainSets": [
      {
        "name": "gfw",
        "geosite": {
          "filepath": "geosite.dat",
          "codes": ["gfw"]
        }
      },
      {
        "name": "custom-direct",
        "domains": [
          { "type": "Full", "value": "example.com" }
        ]
      }
    ],
    "greatDomainSets": [
      {
        "name": "proxy-domains",
        "inNames": ["gfw"],
        "exNames": ["custom-direct"]
      }
    ]
  },
  "router": {
    "rules": [
      {
        "domainTags": ["proxy-domains"],
        "matchAll": true,
        "outboundTag": "proxy"
      }
    ]
  }
}
```

## Related [#related]

* [Router](/docs/vx-core/configuration/router) — `domainTags`, `dstIpTags`, `geoDomains`, `appTags`
* [DNS](/docs/vx-core/configuration/dns) — `domainTags`, `ipTags`
* [Sets](/docs/vx/manual/customize/sets) — Set types and composition logic in the client


# Inbounds (/docs/vx-core/configuration/inbounds)



Inbound configuration lives in `ServerConfig.inbounds` and `ServerConfig.multiInbounds`.

Schema definition: [`protos/proto/vx/inbound/inbound.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/inbound/inbound.proto).

## ProxyInboundConfig [#proxyinboundconfig]

A standard inbound. You can specify multiple proxy protocols, but only one transport protocol and one security protocol may be active.

<ProtoField name="tag" type="string">
  Name referenced by [router](/docs/vx-core/configuration/router) `inboundTags`
</ProtoField>

<ProtoField name="address" type="string">
  Listen address; empty means all interfaces
</ProtoField>

<ProtoField name="port" type="uint32">
  Single port (can be set alongside `ports`)
</ProtoField>

<ProtoField name="ports" type="uint32[]">
  List of ports to listen on
</ProtoField>

<ProtoField name="transport" type="TransportConfig">
  TLS, REALITY, WebSocket, gRPC, etc.
</ProtoField>

<ProtoField name="protocol" type="Any">
  One proxy server configuration (VMess, VLESS, Trojan, etc.)
</ProtoField>

<ProtoField name="protocols" type="Any[]">
  Multiple protocols on the same listener
</ProtoField>

<ProtoField name="users" type="UserConfig[]">
  Users for this inbound (see [Users](/docs/vx-core/configuration/users))
</ProtoField>

Example:

```json
{
  "tag": "vmess",
  "ports": [10000],
  "protocol": {
    "@type": "type.googleapis.com/vx.proxy.vmess.VmessServerConfig",
    "secureEncryptionOnly": true
  }
}
```

Protocol `@type` values are listed in [Proxy protocols](/docs/vx-core/configuration/protocols). Transport and TLS/REALITY: [Transport](/docs/vx-core/configuration/transport), [Security](/docs/vx-core/configuration/security).

> **Note**: When multiple protocols support UDP, only one protocol's UDP will actually take effect. If Hysteria is present, it is preferred and UDP for other protocols will not be enabled.

## MultiProxyInboundConfig [#multiproxyinboundconfig]

Multi-inbounds can use **multiple transport and security configurations** simultaneously.

<ProtoField name="tag" type="string">
  Inbound tag for routing
</ProtoField>

<ProtoField name="address" type="string">
  Listen address; empty means all interfaces
</ProtoField>

<ProtoField name="ports" type="uint32[]">
  Listen ports
</ProtoField>

<ProtoField name="protocols" type="Any[]">
  Proxy protocol configurations (same `Any` type as above)
</ProtoField>

<ProtoField name="securityConfigs" type="Security[]">
  Security protocols
</ProtoField>

<ProtoField name="transportProtocols" type="Protocol[]">
  Transport protocols
</ProtoField>

<ProtoField name="socket" type="SocketConfig">
  Socket options
</ProtoField>

<ProtoField name="users" type="UserConfig[]">
  Users for all handlers on this inbound
</ProtoField>

<h3 id="inbound-security">
  Security
</h3>

Each entry in `securityConfigs`

Only one of `tls` or `reality` may be set per security block.

<ProtoField name="tls" type="TlsConfig" />

<ProtoField name="reality" type="RealityConfig" />

<ProtoField name="domains" type="string[]">
  Use this security configuration for the specified SNI
</ProtoField>

<ProtoField name="regularExpression" type="string">
  Use this security configuration for SNI matching this regular expression
</ProtoField>

<ProtoField name="always" type="bool">
  Use this security configuration for all connections
</ProtoField>

<h3 id="inbound-transport-protocol">
  Transport protocol
</h3>

Each entry in `transportProtocols`

Only one of `websocket`, `http`, `grpc`, `httpupgrade`, `splithttp`, or `tcp` may be set per transport block.

<ProtoField name="websocket" type="WebsocketConfig">
  WebSocket transport. See [WebSocket](/docs/vx-core/configuration/transport/websocket).
</ProtoField>

<ProtoField name="http" type="HttpConfig">
  HTTP/2 transport camouflage. See [HTTP transport](/docs/vx-core/configuration/transport/http).
</ProtoField>

<ProtoField name="grpc" type="GrpcConfig">
  gRPC transport. See [gRPC](/docs/vx-core/configuration/transport/grpc).
</ProtoField>

<ProtoField name="httpupgrade" type="HttpUpgradeConfig">
  HTTP Upgrade transport. See [HTTPUpgrade](/docs/vx-core/configuration/transport/httpupgrade).
</ProtoField>

<ProtoField name="splithttp" type="SplitHttpConfig">
  Split HTTP (XHTTP) transport. See [SplitHTTP](/docs/vx-core/configuration/transport/splithttp).
</ProtoField>

<ProtoField name="tcp" type="TcpConfig">
  Plain TCP transport. See [TCP](/docs/vx-core/configuration/transport/tcp).
</ProtoField>

<ProtoField name="alpn" type="string">
  Match ALPN
</ProtoField>

<ProtoField name="sni" type="string">
  Match connection SNI
</ProtoField>

<ProtoField name="path" type="string">
  HTTP/1 path
</ProtoField>

<ProtoField name="h2" type="bool">
  Connection uses HTTP/2
</ProtoField>

<ProtoField name="always" type="bool">
  Use this transport for all connections
</ProtoField>

Field details are in [Transport](/docs/vx-core/configuration/transport) and [Security](/docs/vx-core/configuration/security).

## Related [#related]

* [Outbounds](/docs/vx-core/configuration/outbounds) — Where routed traffic goes
* [Router](/docs/vx-core/configuration/router) — Match by `inboundTags`


# Configuration (/docs/vx-core/configuration)



vx-core reads a single **server configuration file**. The root message is `ServerConfig` in [`protos/proto/vx/server.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/server.proto).

## Configuration format [#configuration-format]

The configuration is a protobuf message that can be serialized as:

* **Binary protobuf** — Compact; used in some internal paths
* **ProtoJSON** — Human-readable JSON; suitable for manual editing

Typed settings for protocols and transports use `google.protobuf.Any`. In JSON, set `@type` to the message type URL:

```json
{
  "@type": "type.googleapis.com/vx.proxy.trojan.TrojanServerConfig",
  "users": [{ "secret": "your-password" }]
}
```

JSON field names use **camelCase** (e.g. `matchAll`, `outboundTag`, `multiInbounds`).

## ServerConfig overview [#serverconfig-overview]

<ProtoField name="inbounds" type="ProxyInboundConfig[]">
  Inbounds
</ProtoField>

<ProtoField name="multiInbounds" type="MultiProxyInboundConfig[]">
  Multi-inbounds
</ProtoField>

<ProtoField name="outbounds" type="OutboundHandlerConfig[]">
  Outbounds
</ProtoField>

<ProtoField name="router" type="RouterConfig">
  Routing configuration
</ProtoField>

<ProtoField name="dns" type="DnsConfig">
  DNS configuration
</ProtoField>

<ProtoField name="geo" type="GeoConfig">
  Sets
</ProtoField>

<ProtoField name="policy" type="PolicyConfig">
  Timeout policy
</ProtoField>

<ProtoField name="log" type="LoggerConfig">
  Logging settings
</ProtoField>

<ProtoField name="users" type="UserConfig[]">
  Users
</ProtoField>

<ProtoField name="dispatcher" type="DispatcherConfig">
  Dispatcher
</ProtoField>

<ProtoField name="dialerFactory" type="DialerFactoryConfig">
  Outbound factory
</ProtoField>

Minimal server example:

```json
{
  "inbounds": [
    {
      "tag": "trojan",
      "ports": [443],
      "protocol": {
        "@type": "type.googleapis.com/vx.proxy.trojan.TrojanServerConfig"
      }
    }
  ],
  "router": {
    "rules": [{ "matchAll": true, "outboundTag": "direct" }]
  },
  "outbounds": [
    {
      "tag": "direct",
      "protocol": {
        "@type": "type.googleapis.com/vx.proxy.freedom.FreedomConfig"
      }
    }
  ]
}
```

## Sections [#sections]

<Cards>
  <Card title="Inbounds" href="/docs/vx-core/configuration/inbounds" description="ProxyInboundConfig and MultiProxyInboundConfig" />

  <Card title="Outbounds" href="/docs/vx-core/configuration/outbounds" description="OutboundHandlerConfig and protocol Any" />

  <Card title="Router" href="/docs/vx-core/configuration/router" description="RuleConfig, conditions, selectors, fallbacks" />

  <Card title="DNS" href="/docs/vx-core/configuration/dns" description="Servers, resolvers, hijacking, Fake DNS" />

  <Card title="Geo" href="/docs/vx-core/configuration/geo" description="Domain/IP/app sets used by rules" />

  <Card title="Policy" href="/docs/vx-core/configuration/policy" description="Timeouts and buffer sizes" />

  <Card title="Log" href="/docs/vx-core/configuration/log" description="LoggerConfig" />

  <Card title="Users" href="/docs/vx-core/configuration/users" description="UserConfig" />

  <Card title="Dispatcher" href="/docs/vx-core/configuration/dispatcher" description="Sniffing and session stats" />

  <Card title="Dialer factory" href="/docs/vx-core/configuration/dialer-factory" description="Dial timeouts and interface binding" />

  <Card title="Proxy protocols" href="/docs/vx-core/configuration/protocols" description="VMess, VLESS, Trojan, Shadowsocks, etc." />

  <Card title="Transport" href="/docs/vx-core/configuration/transport" description="TCP, WebSocket, gRPC, KCP, xhttp, socket" />

  <Card title="Security" href="/docs/vx-core/configuration/security" description="TLS and REALITY" />
</Cards>

## CLI [#cli]

```bash
vx run --config config.json
```

<ProtoField name="`--config`" type="default config.json">
  Path to the configuration file
</ProtoField>

When installed via the [install script](/docs/vx-core/quick-start), the default path is `/usr/local/etc/vx/config.json`.

## Proto source files [#proto-source-files]

<ProtoField name="Root" type="protos/proto/vx/server.proto" />

<ProtoField name="Inbounds" type="protos/proto/vx/inbound/inbound.proto" />

<ProtoField name="Outbounds" type="protos/proto/vx/outbound/outbound.proto" />

<ProtoField name="Router" type="protos/proto/vx/router/router.proto" />

<ProtoField name="DNS" type="protos/proto/vx/dns/dns.proto" />

<ProtoField name="Geo" type="protos/proto/vx/geo/geo.proto" />

<ProtoField name="Policy" type="protos/proto/vx/policy.proto" />

<ProtoField name="Log" type="protos/proto/vx/log/logger.proto" />

<ProtoField name="Users" type="protos/proto/vx/user/user.proto" />

<ProtoField name="Dispatcher" type="protos/proto/vx/dispatcher/dispatcher.proto" />

<ProtoField name="Dialer factory" type="protos/proto/vx/dialerfactory/dialerfactory.proto" />

<ProtoField name="Proxy protocols">
  `protos/proto/vx/proxy/*/` — [Documentation](/docs/vx-core/configuration/protocols)
</ProtoField>

<ProtoField name="Transport">
  `protos/proto/vx/transport/` — [Documentation](/docs/vx-core/configuration/transport)
</ProtoField>

<ProtoField name="Security (TLS/REALITY)">
  `protos/proto/vx/transport/security/` — [Documentation](/docs/vx-core/configuration/security)
</ProtoField>


# Log (/docs/vx-core/configuration/log)



Logging is configured in `ServerConfig.log` (`LoggerConfig`). Schema definition: [`protos/proto/vx/log/logger.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/log/logger.proto).

## LoggerConfig [#loggerconfig]

<ProtoField name="logLevel" type="Level">
  Minimum level: `DEBUG`, `INFO`, `WARN`, `ERROR`, `FATAL`, `DISABLED`
</ProtoField>

<ProtoField name="filePath" type="string">
  Log file path
</ProtoField>

<ProtoField name="logFileDir" type="string">
  When `filePath` is empty, write timestamped files in this directory (`2006-01-02T15:04:05.txt`)
</ProtoField>

<ProtoField name="consoleWriter" type="bool">
  Human-readable console output
</ProtoField>

<ProtoField name="showColor" type="bool">
  Colored logs (with console output)
</ProtoField>

<ProtoField name="showCaller" type="bool">
  Include caller location
</ProtoField>

<ProtoField name="redact" type="bool">
  Redact domains and IPs in log lines
</ProtoField>

## Example [#example]

```json
{
  "log": {
    "logLevel": "INFO",
    "filePath": "/var/log/vx/vx.log",
    "redact": false
  }
}
```


# Outbounds (/docs/vx-core/configuration/outbounds)



Outbounds are configured in `ServerConfig.outbounds`.

Schema definition: [`protos/proto/vx/outbound/outbound.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/outbound/outbound.proto).

Each handler has a unique `tag` referenced by [router](/docs/vx-core/configuration/router) rules (`outboundTag`) or chain targets.

## OutboundHandlerConfig [#outboundhandlerconfig]

<ProtoField name="tag" type="string">
  Handler name for routing
</ProtoField>

<ProtoField name="transport" type="TransportConfig">
  Client transport (TLS, WebSocket, etc.)
</ProtoField>

<ProtoField name="address" type="string">
  Remote host or IP
</ProtoField>

<ProtoField name="port" type="uint32">
  Remote port
</ProtoField>

<ProtoField name="ports" type="PortRange[]">
  Multiple port ranges
</ProtoField>

<ProtoField name="protocol" type="Any">
  Proxy client configuration (Freedom, Blackhole, VMess, etc.)
</ProtoField>

<ProtoField name="enableMux" type="bool">
  Enable connection multiplexing
</ProtoField>

<ProtoField name="muxConfig" type="MuxConfig">
  `maxConnection`, `maxConcurrency`
</ProtoField>

<ProtoField name="uot" type="bool">
  UDP over TCP
</ProtoField>

<ProtoField name="domainStrategy" type="DomainStrategy">
  When `address` is a domain, resolve and select an IP using one of these strategies:

  * `PreferIPv4` (default): Query both A and AAAA records; prefer IPv4, fall back to IPv6 if no IPv4 is available.
  * `PreferIPv6`: Query both A and AAAA records; prefer IPv6, fall back to IPv4 if no IPv6 is available.
  * `IPv4Only`: Query A records only; use IPv4 only.
  * `IPv6Only`: Query AAAA records only; use IPv6 only.
  * `Speed`: Query A and AAAA in parallel and use whichever address family returns first; if the connection fails and the other family is available, try that one next.

  If the network interface does not support IPv6, `PreferIPv4`, `PreferIPv6`, and `Speed` automatically downgrade to `IPv4Only`.
</ProtoField>

<ProtoField name="random" type="RandomPortSelectStrategy">
  Use all ports in `ports` simultaneously
</ProtoField>

<ProtoField name="one" type="OnePortSelectStrategy">
  Rotate a single port (`interval` or `minInterval` / `maxInterval`)
</ProtoField>

### Examples [#examples]

#### Direct (freedom) outbound [#direct-freedom-outbound]

A minimal server needs this to forward traffic without an upstream proxy:

```json
{
  "tag": "direct",
  "protocol": {
    "@type": "type.googleapis.com/vx.proxy.freedom.FreedomConfig"
  }
}
```

#### Block outbound [#block-outbound]

```json
{
  "tag": "block",
  "protocol": {
    "@type": "type.googleapis.com/vx.proxy.blackhole.BlackholeConfig"
  }
}
```

Proxy client configurations are in [Proxy protocols](/docs/vx-core/configuration/protocols) (`*ClientConfig` messages). Use with [Transport](/docs/vx-core/configuration/transport) and [Security](/docs/vx-core/configuration/security) as needed.

## Related [#related]

* [Router](/docs/vx-core/configuration/router) — Select `outboundTag` or `selectorTag`
* [Dialer factory](/docs/vx-core/configuration/dialer-factory)


# Policy (/docs/vx-core/configuration/policy)



Connection policy is set in `ServerConfig.policy` (`PolicyConfig`). Schema definition: [`protos/proto/vx/policy.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/policy.proto).

All timeout values are in **seconds**.

## PolicyConfig [#policyconfig]

<ProtoField name="handshakeTimeout" type="int32">
  Close if no data after connection
</ProtoField>

<ProtoField name="connectionIdleTimeout" type="int32">
  Close when idle (no traffic in either direction)
</ProtoField>

<ProtoField name="udpIdleTimeout" type="int32">
  Close when there is no upstream UDP data
</ProtoField>

<ProtoField name="upLinkOnlyTimeout" type="int32">
  After downstream ends, close if there is no upstream data
</ProtoField>

<ProtoField name="downLinkOnlyTimeout" type="int32">
  After upstream ends, close if there is no downstream data
</ProtoField>

<ProtoField name="defaultBufferSize" type="int32">
  Default per-connection buffer
</ProtoField>

<ProtoField name="userPolicyMap" type="map<uint32, UserPolicy>">
  Overrides by `userLevel`
</ProtoField>

## UserPolicy [#userpolicy]

<ProtoField name="bufferSize">
  Buffer size for users at this level
</ProtoField>

User levels come from each account's `userLevel` in [UserConfig](/docs/vx-core/configuration/users).

## Example [#example]

```json
{
  "policy": {
    "handshakeTimeout": 4,
    "connectionIdleTimeout": 300,
    "udpIdleTimeout": 60,
    "userPolicyMap": {
      "0": { "bufferSize": 4096 }
    }
  }
}
```

## Related [#related]

* [Users](/docs/vx-core/configuration/users) — Per-account `userLevel`


# Router (/docs/vx-core/configuration/router)



Routing is configured in `ServerConfig.router` (`RouterConfig`).

Schema definition: [`protos/proto/vx/router/router.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/router/router.proto).

Rules are evaluated in order; the first matching rule determines the outbound or selector. Subsequent rules are not considered after a match.

## Examples [#examples]

Route everything to direct:

```json
{
  "router": {
    "rules": [
      { "matchAll": true, "outboundTag": "direct" }
    ]
  }
}
```

Route a specific inbound to a specific outbound:

```json
{
  "router": {
    "rules": [
      {
        "conditions": [
          { "inboundTags": ["trojan"] }
        ],
        "outboundTag": "direct"
      }
    ]
  }
}
```

Route to proxy when the domain or app set matches:

```json
{
  "router": {
    "rules": [
      {
        "conditions": [
          { "domainTags": ["proxy"] },
          { "appTags": ["proxy"] }
        ],
        "selectorTag": "proxy"
      }
    ]
  }
}
```

## RouterConfig [#routerconfig]

<ProtoField name="rules" type="RuleConfig[]">
  Ordered routing rules
</ProtoField>

## RuleConfig [#ruleconfig]

**Target:** Exactly one of `outboundTag` and `selectorTag` must be set. If both are empty, the connection will be **blocked**.

<ProtoField name="outboundTag" type="string">
  Send to this outbound handler
</ProtoField>

<ProtoField name="selectorTag" type="string">
  Send to a [selector](#selectorconfig) (client / load balancing)
</ProtoField>

<ProtoField name="matchAll" type="bool">
  Match every connection. When `true`, `conditions` is ignored.
</ProtoField>

<ProtoField name="conditions" type="Condition[]">
  Match predicates. The rule applies when **any** condition matches (logical OR). Ignored when `matchAll` is true. If empty and `matchAll` is false, the rule never matches.

  Prefer this over top-level match fields and the singular `condition` field.
</ProtoField>

<ProtoField name="condition" type="Condition">
  **Legacy.** Single condition; equivalent to one entry in `conditions`. Used only when `conditions` is empty.
</ProtoField>

<ProtoField name="fallbacks" type="Fallback[]">
  Try alternate selectors/outbounds when the primary target fails
</ProtoField>

<ProtoField name="ruleName" type="string">
  Name
</ProtoField>

### Fallback [#fallback]

<ProtoField name="selectorTag" type="string">
  Fallback selector (mutually exclusive with `outboundTag`)
</ProtoField>

<ProtoField name="outboundTag" type="string">
  Fallback outbound (mutually exclusive with `selectorTag`)
</ProtoField>

<ProtoField name="action" type="Action">
  Additional action on fallback
</ProtoField>

<ProtoField name="matchAll" type="bool">
  Apply this fallback for every connection
</ProtoField>

<ProtoField name="conditions" type="Condition[]">
  Match predicates for this fallback. The fallback is eligible when **any** condition matches (logical OR). Ignored when `matchAll` is true.
</ProtoField>

<ProtoField name="condition" type="Condition">
  **Legacy.** Single condition. Used only when `conditions` is empty. Legacy top-level `domainTags` / `dstIpTags` are also supported (merged into one implicit condition).
</ProtoField>

<ProtoField name="last" type="bool">
  If this fallback is used, it is final and later fallbacks are not considered
</ProtoField>

#### Action [#action]

Fields for `Fallback.action`:

<ProtoField name="ipToDomain" type="bool">
  Rewrite the IP back to a domain on fallback
</ProtoField>

## Condition [#condition]

Used in `RuleConfig.conditions`, legacy `RuleConfig.condition`, or `Fallback.conditions` / legacy `Fallback.condition`.

Each `Condition` is one entry in a rule or fallback `conditions` list. The list matches when **any** condition matches (OR). Within one `Condition`, **all** enabled subconditions must match (AND). A `Condition` with no subconditions never matches.

<ProtoField name="usernames" type="string[]">
  Match authenticated user IDs
</ProtoField>

<ProtoField name="srcCidrs" type="string[]">
  Source IP match
</ProtoField>

<ProtoField name="srcIpTags" type="string[]">
  Source IP match using set names from Geo
</ProtoField>

<ProtoField name="dstCidrs" type="string[]">
  Destination IP match
</ProtoField>

<ProtoField name="dstIpTags" type="string[]">
  Destination IP match using set names from Geo
</ProtoField>

<ProtoField name="resolveDomain" type="bool">
  Resolve the domain; all IPs must be in `dstIpTags` or `dstCidrs`
</ProtoField>

<ProtoField name="resolveSoftRewrite" type="bool">
  Resolve the domain; any IP in `dstIpTags` or `dstCidrs` matches, and rewrite the destination to that IP
</ProtoField>

<ProtoField name="resolveSoftNoRewrite" type="bool">
  Resolve the domain; any IP in `dstIpTags` or `dstCidrs` matches, but do not rewrite the destination
</ProtoField>

<ProtoField name="geoDomains" type="Domain[]">
  Inline [Domain](/docs/vx-core/configuration/geo#domain) entries for domain matching
</ProtoField>

<ProtoField name="domainTags" type="string[]">
  Domain match (references [geo](/docs/vx-core/configuration/geo) sets)
</ProtoField>

<ProtoField name="networks" type="Network[]">
  `TCP`, `UDP`, etc.
</ProtoField>

<ProtoField name="srcPortRanges" type="PortRange[]">
  Source port ranges
</ProtoField>

<ProtoField name="dstPortRanges" type="PortRange[]">
  Destination port ranges
</ProtoField>

<ProtoField name="appIds" type="AppId[]">
  Application ID match
</ProtoField>

<ProtoField name="appTags" type="string[]">
  Application set match (references [geo](/docs/vx-core/configuration/geo) sets)
</ProtoField>

<ProtoField name="protocols" type="string[]">
  Protocol sniffing results
</ProtoField>

<ProtoField name="ipv6" type="bool">
  Match IPv6 only
</ProtoField>

<ProtoField name="fakeIp" type="bool">
  Match Fake IP destinations
</ProtoField>

<ProtoField name="hasNoDomain" type="bool">
  Connection uses IP targets and has no sniffed domain
</ProtoField>

<ProtoField name="allTags" type="string[]">
  Combined domain, IP, or app set match (matches if any listed set matches)
</ProtoField>

<ProtoField name="skipSniff" type="bool">
  Disable sniffing for connections to IP destinations
</ProtoField>

<ProtoField name="inboundTags" type="string[]">
  Match inbound `tag`
</ProtoField>

## SelectorConfig [#selectorconfig]

Selectors filter candidate nodes from a group of outbounds, then pick the node actually used for the connection according to a strategy. Defined in `ClientConfig.selectors` (`SelectorsConfig`); primarily used by the **VX client**. [Router](/docs/vx-core/configuration/router) rules reference them via `selectorTag`.

For client UI behavior, see [Selectors](/docs/vx/manual/customize/selectors).

<ProtoField name="tag" type="string">
  Selector name. Referenced by `RuleConfig.selectorTag` and `Fallback.selectorTag`.
</ProtoField>

<ProtoField name="filter" type="Filter">
  Filter for the candidate outbound pool; see [Filter](#filter).
</ProtoField>

<ProtoField name="strategy" type="SelectingStrategy">
  Which nodes to **actually use** from the filtered pool:

  * `ALL`: All nodes in the pool
  * `ALL_OK`: All available nodes (falls back to untested nodes if none are available)
  * `LEAST_PING`: Single node with lowest ping
  * `MOST_THROUGHPUT`: Single node with highest speed-test throughput
  * `TOP_PING`: All nodes within &#x2A;*30%** of the lowest ping (e.g. lowest 100 ms → includes ≤ 130 ms)
  * `TOP_THROUGHPUT`: All nodes with throughput ≥ &#x2A;*70%** of the highest (e.g. highest 100 → includes ≥ 70)

  Single-node strategies (`LEAST_PING`, `MOST_THROUGHPUT`) do not use `balanceStrategy`; multi-node strategies require load balancing.
</ProtoField>

<ProtoField name="balanceStrategy" type="BalanceStrategy">
  For multi-node strategies, which node handles each connection:

  * `RANDOM` (default): Random choice from the active set; IPv6 connections prefer nodes that support IPv6
  * `MEMORY`: Sticky reuse of the same node per app or root domain; assigns randomly on first use and remembers the mapping
</ProtoField>

<ProtoField name="selectFromOm" type="bool">
  On the server, this should be `true`
</ProtoField>

<ProtoField name="speedTestSize" type="uint32">
  Download bytes per speed test. When `speedTestSizeRange` is not set and this is `0`, the core defaults to **1 MiB**.
</ProtoField>

<ProtoField name="speedTestInterval" type="uint32">
  Interval for speed-testing filtered nodes (**minutes**). Only `MOST_THROUGHPUT` and `TOP_THROUGHPUT` run periodic speed tests.
</ProtoField>

<ProtoField name="pingTestInterval" type="uint32">
  Interval for pinging filtered nodes (**minutes**). Only `LEAST_PING` and `TOP_PING` run periodic pings.
</ProtoField>

<ProtoField name="unusableTestInterval" type="uint32">
  Interval for re-checking nodes marked unusable (**minutes**). All strategies except `ALL` check availability.
</ProtoField>

<ProtoField name="speedTestSizeRange" type="SpeedTestSizeRange">
  Random range for speed-test download size (bytes). When `0 < min ≤ max`, each test picks a random value in `[min, max]`; otherwise `speedTestSize` is used.
</ProtoField>

### Filter [#filter]

<ProtoField name="prefixes" type="string[]">
  Outbound `tag` matches if it starts with any prefix
</ProtoField>

<ProtoField name="tags" type="string[]">
  Outbound `tag` matches if it equals any value in the list
</ProtoField>

<ProtoField name="subStrings" type="string[]">
  Outbound `tag` matches if it contains any substring (database mode only)
</ProtoField>

<ProtoField name="inverse" type="bool">
  When `true`, invert: only outbounds that do **not** match `prefixes` / `tags` are included (outbound manager mode)
</ProtoField>

### SpeedTestSizeRange [#speedtestsizerange]

<ProtoField name="min" type="uint32">
  Lower bound for random speed-test size (bytes)
</ProtoField>

<ProtoField name="max" type="uint32">
  Upper bound for random speed-test size (bytes)
</ProtoField>

## Related [#related]

* [Geo](/docs/vx-core/configuration/geo) — `domainTags`, `dstIpTags`, `geoDomains`
* [DNS](/docs/vx-core/configuration/dns) — Resolution for `resolveDomain` rules
* [Dispatcher](/docs/vx-core/configuration/dispatcher) — Sniffing affects protocol/domain matching


# Users (/docs/vx-core/configuration/users)



This message is used in `ServerConfig.users` (`UserConfig[]`). It is also used in the `users` field of [inbounds](/docs/vx-core/configuration/inbounds).

Schema definition: [`protos/proto/vx/user/user.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/user/user.proto).

## UserConfig [#userconfig]

<ProtoField name="id" type="string">
  User identifier (used for routing `usernames`)
</ProtoField>

<ProtoField name="userLevel" type="uint32">
  Policy level for [PolicyConfig](/docs/vx-core/configuration/policy) `userPolicyMap`
</ProtoField>

<ProtoField name="secret" type="string">
  Password of arbitrary length
</ProtoField>

## Example [#example]

```json
{
  "users": [
    {
      "id": "alice",
      "userLevel": 0,
      "secret": "00000000-0000-0000-0000-000000000001"
    }
  ],
  "inbounds": [
    {
      "tag": "vless",
      "ports": [443],
      "users": [
        {
          "id": "alice",
          "userLevel": 0,
          "secret": "00000000-0000-0000-0000-000000000001"
        }
      ],
      "protocol": {
        "@type": "type.googleapis.com/vx.proxy.vless.VlessServerConfig"
      }
    }
  ]
}
```

Inbound-level `users` are added to all proxy handlers on that inbound. Global `users` are added to all proxy handlers on every inbound.

## Related [#related]

* [Router](/docs/vx-core/configuration/router) — match `usernames`
* [Policy](/docs/vx-core/configuration/policy) — `userLevel` → buffers and limits


# DNS Servers (/docs/vx/manual/customize/dns)



DNS servers are referenced by **DNS rules** inside each [routing mode](/docs/vx/manual/customize/modes).
They are also used as **internal DNS servers** when vx-core resolves domain names while dialing outbounds.

## How DNS queries are handled [#how-dns-queries-are-handled]

There are two types of queries:

**Hijacked DNS** — Queries from other apps (TUN mode or when system DNS points at vx-core). The are matched against Dns Rules.

**Internal DNS** — When vx-core itself needs to resolve a domain (for example a node with a domain address). The mode's ordered **internal DNS servers** list is tried left to right until one succeeds.

For **both**, **DNS records** are checked first. If a record matches the query, vx-core returns that answer immediately and does not forward to a DNS server.

## DNS server types [#dns-server-types]

When you add a **DNS Server**, choose a type from the dropdown. Each type is a single resolver implementation.

* **Fake**: Return fake IPs from configured CIDR pools (typically `198.18.0.0/15`).
* **UDP/TCP**: Classic DNS over UDP/TCP to one or more `host:port` addresses. Multiple addresses can be comma-separated; each query is sent to all of them at once and the **first reply** is used.
* **HTTPS**: DNS over HTTPS (DoH) to a resolver URL (for example `https://1.1.1.1/dns-query`).
* **TLS**: DNS over TLS (DoT) to one or more `host:port` addresses.
* **QUIC**: DNS over QUIC.
* **Go**: Uses the Go runtime / system DNS resolver (OS resolver behavior). Its traffic does not go through routing, it is typically used in servers and non-TUN modes.
* **Empty**: Always returns an empty DNS answer (no records).

### Common fields (most types) [#common-fields-most-types]

* **Name**: Unique tag used in DNS rules and internal DNS server lists. Cannot duplicate another server or composite name. The name `hijack` is reserved.
* **Client IP**: Optional ECS (EDNS Client Subnet) source address sent with queries so upstream resolvers return answers for your location.
* **Cache duration**: How long to cache responses in seconds. If empty or `0`, cache until the record TTL expires.
* **Result IP set**: After resolution, drop A/AAAA answers whose IPs are **not** in the selected IP sets. This can be used to prevent DNS pollution

### Fake DNS fields [#fake-dns-fields]

* **Pool**: Comma-separated CIDRs for fake IP allocation (for example `198.18.0.0/15`).
* **LRU size**: How many fake DNS mappings to keep per pool (default in the form is 6666).

## Composite DNS servers [#composite-dns-servers]

Besides single resolvers, you can create **groups** that combine other DNS servers by name:

### Concurrent DNS Server [#concurrent-dns-server]

Runs **all** member servers **in parallel** and returns the first **definitive** answer (NOERROR with at least one record).
Empty NOERROR answers are kept only as fallbacks if no server returns a definitive answer.

Use this when you want the fastest resolver among several upstreams (for example `8.8.8.8` and `1.1.1.1` at the same time).

### Serial DNS Server [#serial-dns-server]

Queries member servers **in order**, but starts the next server after an **interval** (seconds) if no definitive answer has arrived yet. Earlier queries keep running in the background, so a slow-but-correct upstream can still win.

Use this when you prefer a primary resolver with timed fallbacks (for example try domestic DNS first, then foreign DNS resolvers).

Both composite types require at least one member DNS server. Member order matters for serial groups (reorder in the form).

## DNS records [#dns-records]

Each record has:

* **Domain**: Hostname to match (required).
* **IP addresses**: Comma-separated IPv4 and/or IPv6 addresses. Creates **A** and **AAAA** answers.
* **Proxied domain**: Optional **CNAME** target — the domain resolves to this name instead of direct IPs.

### Applied to all DNS queries [#applied-to-all-dns-queries]

**DNS records are evaluated for every DNS query** — hijacked app queries and vx-core internal lookups alike.

vx-core checks static records **before** DNS rules and **before** upstream resolvers. If the query name and type match a record, that answer is returned immediately.

This is useful for:

* Blocking or redirecting specific domains without changing routing rules
* Pinning a domain to a fixed IP for testing
* Local development hostnames

## Related [#related]

* [Routing modes](/docs/vx/manual/customize/modes) — DNS rules and internal DNS servers per mode


# Customize Tab (/docs/vx/manual/customize)



The **Customize** tab lets you control how network traffic is routed — proxy, direct, or blocked — using routing modes, sets, selectors, and DNS rules.

## Two views: Simplified and Advanced [#two-views-simplified-and-advanced]

Open the **Routing** tab. Use the **Advanced** / **Simple** button (top right) to switch views.

* `[Simplified](/docs/vx/manual/customize/simplified)`: Configure domains, IPs, and apps that should go proxy or direct
* `Advanced (**Pro**)`: Full control: routing modes, sets, selectors, and DNS

## Documentation sections [#documentation-sections]

<Cards>
  <Card title="Simplified routing" href="/docs/vx/manual/customize/simplified" description="Proxy / Direct tabs and which set each action modifies" />

  <Card title="Routing modes" href="/docs/vx/manual/customize/modes" description="GFW, CN, Proxy All, custom modes" />

  <Card title="Sets" href="/docs/vx/manual/customize/sets" description="Atomic, great, and custom sets in Advanced → Set" />

  <Card title="Selectors" href="/docs/vx/manual/customize/selectors" description="Advanced → Selector tab" />

  <Card title="Routing DNS" href="/docs/vx/manual/customize/dns" description="Advanced → DNS tab" />
</Cards>

## Related [#related]

* [Home → Routing widget](/docs/vx/manual/home#routing) — switch modes from the home screen


# Modes (/docs/vx/manual/customize/modes)





**Advanced → Mode** lists all **modes**. A mode is a made of:

* **Routing rules** — decide whether each connection goes **proxy**, **direct**, or **block**
* **DNS rules** — decide how **hijacked DNS queries** (from other apps) are answered
* **Internal DNS servers** — used when vx-core itself needs to resolve a domain (for example while dialing an outbound)

## Built-in modes [#built-in-modes]

* **GFW** (blacklist) (`GFW`): Blocked / GFW-listed domains and IPs — **proxy**; everything else — **direct**
* **CN** (whitelist) (`CN`): China mainland domains and IPs — **direct**; others — **proxy**
* **Proxy All** (`Proxy All`): All non-private traffic — **proxy**; private — **direct**
* **RU Blocked** (`Russia Blocked`): Russia-blocked lists — **proxy**; rest — **direct**
* **RU Blocked (All)** (`Russia Blocked(All)`): Broader Russia-blocked list — **proxy**; rest — **direct**

## How routing decisions are made [#how-routing-decisions-are-made]

When vx-core handles a connection, it walks the mode's **routing rules from top to bottom**.
The **first rule whose conditions all match** wins, after matcing, later rules will not be considerd.
A rule has either Direct, a node, a selector or block as the decision, which decides where the traffic go

* **Direct**: Traffic go direct, and is not proxied
* **A node**: Traffic go to the node
* **A [Selector](/docs/vx/manual/customize/selectors)**: Traffic go to the node selected by the selector
* **Block**: Connection is rejected

If no rule matches, the connection fails with "no rule matched."

### Example: google traffic under GFW mode [#example-google-traffic-under-gfw-mode]

For a connection with domain "[www.google.com](http://www.google.com)" from browser, it will be matched against routing rules from the starting
rule "Default Proxy DNS Server" until the rule "GFW Mode Proxy Domains", where it matches since [www.google.com](http://www.google.com) is in the
Domain Set "GFW Mode Proxy Domains".

## Routing rule and its conditions [#routing-rule-and-its-conditions]

Each routing rule has:

* A **name** (for display and debugging)
* An **outbound**: Direct, a node, a selector, or Block
* **Conditions** — optional filters on the connection
* Optional **fallbacks**

### Match all [#match-all]

Enable **Match all** to make a rule apply to every connection (typically used for a catch-all "default proxy" or "default direct" rule at the bottom of the list). When Match all is on, the `conditions` list is ignored.

### Condition types [#condition-types]

When Match all is off, a rule matches when **any** entry in its `conditions` list matches (logical OR). If the list is empty, the rule never matches.

Within a single `Condition`, **every enabled subcondition must match** (logical AND). If a `Condition` has no subconditions enabled, it never matches.

#### Inbound [#inbound]

*Matches when inbound tag of connections is in one of the specified tags.*

This is typically used to match traffic handled by a specific inbound — for example,
connections from DNS-servers will have the name of the dns server as the inbound tag, you can use this condition
to match the traffic from the dns servers.

#### Domain [#domain]

*Matches when destination domain is in one of the selected [domain sets](/docs/vx/manual/customize/sets), or explicitly added geo-domain entries.*

#### IP [#ip]

*Matches when destination IP is in one of the selected IP sets or CIDRs.*

IP conditions can optionally resolve the domain first; see [Domain resolution options](#domain-resolution-options-ip-conditions) below.

#### App [#app]

*Matches when originating application is in one of the selected app sets or app IDs.*

#### Domain / IP / App (combined) [#domain--ip--app-combined]

*If domain of a connection is in the one of the specified domain sets, matches; or if ip of the connection is in one of the specified
ip sets, matches; or if app of the connection is in one of the specified app sets, matches*

This is to reduce number of rules. If you have a ip set named "Netflix", a domain set named "Netflix", an app set named "Netflix", and
you want all of them to go a specific node, you can add one rule with this condition instead of adding three rules.

#### Fake IP [#fake-ip]

*Matches when destination is a fake-IP address issued by Fake DNS (from the `198.18.0.0/15` pool)*

#### Network [#network]

*Matches when a connection has the specified network type*

> **Warning:** Avoid having both **Domain** and **IP** subconditions in the same `Condition` unless you understand why:
> the `Condition` matches only when **both** subconditions are true, which means both domain and IP information should be present,
> which is often not true (many connections only have just one of them, not both). Use separate entries in `conditions` if you want domain **or** IP to match.

### Fallbacks [#fallbacks]

A routing rule can define **fallbacks**. If the outbound chosen by the rule fails (for example the selected node is unreachable),
vx-core tries the node/selector specified in each fallback in order. Each fallback has its own `conditions` list and node/selector — the
fallback is used only when **any** of its conditions matches (or when **Match all** is enabled). If a fallback does not match, the next fallback is considered.

For example, GFW's final rule "Default Direct" uses two fallbacks so traffic that failed when go direct can retry proxy. Each
fallback has conditions to make sure only connections with non-CN domains or ips retry proxy, to prevent domestic connections
from using proxy.

<Accordions type="single">
  <Accordion title="Which problem does this Fallback feature tring to solve" id="why-fallbacks">
    <div>
      Ideally, all domains/ips blocked by GFW should go proxy in GFW mode. However, the commonly used gfw geo file is not complete. Many
      blocked domains are not included. Before fallback feature, connections with those domains will fail, which impact a user's experience.
      This feature is to solve this problem. Those connections will be saved by proxy nodes, which usually succeed when trying proxy. This feature
      significantly improves a user's experience when using GFW mode.
    </div>
  </Accordion>
</Accordions>

## DNS rules [#dns-rules]

DNS rules specify which dns servers should handle a hijacked dns query. A hijacked dns query is a dns query sent by **other processes** on your device that
vx-core intercepts (in TUN mode or when system DNS is pointed at vx-core).

### How hijacked DNS work [#how-hijacked-dns-work]

1. An process, for example system dns, sends a DNS query (UDP/TCP port 53).
2. vx-core intercepts it and hand the queries to the dns hijack component.
3. DNS rules are evaluated from **top to bottom**, same as routing rules.
4. The **first matching rule** picks a **DNS server** to handle the query. If no rules match, an empty dns response message
   will be returned.
5. That vx-core return the response dns messages returned by the dns server to the source process.

> **Note:** Rules that specify Fake DNS servers will be skipped if Fake DNS is disabled in the control drawer.

### DNS rule conditions [#dns-rule-conditions]

A DNS rule matches when **all enabled conditions match**, or when **no condition is enabled** (catch-all).

> **Warning:** This is different from routing rules. If a routing rule has no condition, it never matches, but if a
> dns rule has no conditions, it means "always matches".

* **Domain**: Query name matches is in one of the domains sets or domain entries
* **Query type**: Record type is A, AAAA, etc. (for example Fake DNS rules often limit to A/AAAA)

## Internal DNS servers [#internal-dns-servers]

**Internal DNS servers** are a ordered list of dns servers. They are primarily used when vx-core **dials** a
domain target. When your nodes have domain address, their ips are resolved by internal dns servers.
They are **not** used to answer hijacked DNS queries from other apps. They will be used one by one, until
one returns IP answers.

> **Tip:** You can double click a internal dns server to delete it.

## How to add modes [#how-to-add-modes]

Clicking the add button on the top right corner to add. You can either duplicate an existing built-in mode or create a mode from scratch.

## Related [#related]

* [Sets](/docs/vx/manual/customize/sets) — domain, IP, and app lists referenced by rule conditions
* [Selectors](/docs/vx/manual/customize/selectors) — which node handles "proxy" rules
* [Routing DNS](/docs/vx/manual/customize/dns) — DNS rules vs global DNS Policy
* [Simplified routing](/docs/vx/manual/customize/simplified) — quick edits without changing rule order


# Selectors (/docs/vx/manual/customize/selectors)



**Selector** selector a node to be use by proxied connections from a range of nodes.

## Selector filter [#selector-filter]

The **Range** (selector filter) defines which nodes the selector may choose from.

* **All Nodes**: All nodes.
* **Partial Nodes**: Only nodes you specified.

When **Partial Nodes** is selected, use the filter chips to narrow the pool.

* **Node**: Individual nodes.
* **Group**: Node group or subscription.
* **Prefix**: Nodes that starts with the given prefix string.
* **Sub String**: Nodes that contains the given substring.
* **Area**: Nodes in the area.

Changes to the filter take effect immediately, no need to restart.

## Select strategy [#select-strategy]

After filtering, the **Select Strategy** decides **which** node(s) from that pool are actually used.

* **All**: Every node in the filtered pool
* **Usable**: All nodes that are usable
* **Lowest Latency**: The single node with the lowest ping
* **Speed Highest**: The single node with the highest measured throughput
* **Low Latency**: All nodes whose ping is within &#x2A;*30%** of the best ping (e.g. best 100 ms → include nodes ≤ 130 ms)
* **High Speed**: All nodes with throughput ≥ &#x2A;*70%** of the best (e.g. best 100 → include nodes ≥ 70)

Strategies that pick **one** node (**Lowest Latency**, **Speed Highest**) do not show a balance strategy — each connection uses that single node.

Strategies that pick **multiple** nodes (**All**, **Usable**, **Low Latency**, **High Speed**) show **Balance Strategy** below.

### Test intervals [#test-intervals]

Each selector will test nodes periodically. You can configure how to test:

* **Speed test size** (default `1,000,000 bytes (1 MB)`): Download size for each speed test.
* **Speed test interval** (default `60 minutes`): How often to speed-test filtered nodes.
* **Ping test interval** (default `10 minutes`): How often to ping filtered nodes.
* **Unusable test interval** (default `10 minutes`): How often to re-check nodes marked unusable.

Only **Speed Highest** and **High Speed** test speeds periodically. Only **Lowest Latency** and **Low Latency** test
ping periodically. All strategies except **All** test usablility and unusable nodes periodically.

## Balance strategy [#balance-strategy]

When the select strategy keeps **multiple** nodes active, **Balance Strategy** decides which node handles a connection:

* **Random**: Pick a random node from the active set for a connection. IPv6 traffic prefers IPv6-capable nodes when available.
* **Memory**: Stickiness: reuse the same node for the same **app** or **root domain** when possible. If no mapping exists yet, assign randomly and remember it. IPv6 traffic prefers IPv6-capable nodes.

Use **Memory** when you want stable exits per site or app (fewer IP changes mid-session). Use **Random** when you want even load spread across nodes.

> **Note:** Balance strategy applies only when multiple nodes are selected (**All**, **Usable**, **Low Latency**, or **High Speed**). It does not apply to **Lowest Latency** or **Speed Highest**.

> **Note:** Each selector will test whether a node support IPv6 to make sure IPv6 connections are not sent nodes that do not support IPv6.

## Node chain [#node-chain]

**Node chain** (land handlers) sends traffic through extra proxy hops **after** the node chosen by the selector.

Traffic path:

```
[Your traffic] → [Node(s) selected] → [First node in Node Chain] → … → [Last node in Node Chain] → [Destination]
```

The **last** node in the Node Chain list is the **landing node** (final exit before the destination).

Use node chain when you need a fixed downstream hop (for example exit via a specific region) on top of whatever node the selector picks.

## The Proxy selector [#the-proxy-selector]

This selector is special because it supports Manual node selection, whic means that the nodes to be used are selected by you manually in Node tab. You
will see switches in Node tab when you use the manual node selection.

## Related [#related]

* [Automatic Node Selection](/docs/vx/manual/automatic-node-selection) — manual vs auto on Home for the Proxy selector
* [Routing modes](/docs/vx/manual/customize/modes) — rules that reference selectors as outbounds
* [Customize tab](/docs/vx/manual/customize) — Simplified vs Advanced overview


# Sets (/docs/vx/manual/customize/sets)



**Sets** — named collections used by routing and dns rules.

## Set types [#set-types]

* **Atomic domain set** (Domains, geosite, remote URLs): Custom Proxy, Custom Direct, GFW, CN, Private
* **Atomic IP set** (CIDRs, geoip, remote URLs): Custom Proxy, Custom Direct, CN, Public
* **Great domain set** (Combination of domain sets (include / exclude)): GFW Mode Proxy Domains
* **Great IP set** (Combination of other IP sets): GFW Mode Proxy IPs
* **App set** (Application IDs): Proxy, Direct

**Atomic** sets are building blocks. **Great** sets are built from atomic sets (and other great sets).

## Great domain sets and great IP sets [#great-domain-sets-and-great-ip-sets]

A **great set** does not hold domains or IPs directly. It combines other sets using **Include** and **Exclude** lists.

When vx-core checks whether a domain or IP belongs to a great set:

1. **Exclude first** — if the destination matches any set in **Exclude**, the great set does **not** match.
2. **Include** — if the destination matches any set in **Include**, the great set matches.
3. Otherwise it does not match.

**Great IP sets** work the same way, but with IP sets instead of domain sets.

### Example: GFW Mode Proxy Domains [#example-gfw-mode-proxy-domains]

In GFW mode, the great domain set **GFW Mode Proxy Domains** is defined as:

* **Include:** `GFW`, `Custom Proxy`, `Fallback`
* **Exclude:** `Custom Direct`

A domain in the GFW list (and not in Custom Direct) matches this set.

### Mutually exclusive set name [#mutually-exclusive-set-name]

When creating or editing a **great domain set** or **great IP set**, you can optionally set a **Mutually Exclusive Set Name**.

This names the **paired opposite set**. For example:

* **CN Mode Direct Domains** ↔ **CN Mode Proxy Domains**

They represent two sets: one include all domains in China mainland, the other include all others.

In the UI, when you pick domain or IP sets for routing rules, both a set and its mutually exclusive name appear in the picker. Lookups also work by either name.

## Atomic set [#atomic-set]

### Atomic domain set [#atomic-domain-set]

* **Name**: Unique identifier referenced by routing rules.
* **Use Bloom Filter**: Reduces memory for large sets. There is a small chance (\~1%) of false positives — a domain not in the set may be treated as if it were.
* **Inverse**: Flips membership: the set matches destinations that are **not** in its sources.
* **GeoSite URL**: HTTPS URL to a custom `geosite.dat` file. If empty, VX uses the `geosite.dat` provided by LoyalSoldier.
* **GeoSite Codes**: Categories from geosite data (e.g. `cn`, `gfw`, `private`).
* **GeoSite Attributes**: Sub-filters within a code (e.g. `cn` under `category-games`).
* **URLs**: Remote files downloadable by urls — see [URL file types](#url-file-types) below.
* **Domains**: Manually added domain entries (full domain, suffix, keyword, etc.).

### Atomic IP set [#atomic-ip-set]

* **Name**: Unique identifier referenced by routing rules.
* **Inverse**: Same as for domain sets — matches IPs **not** in the set's sources.
* **GeoIP URL**: HTTPS URL to a custom `geoip.dat` file. If empty, VX uses the `geosite.dat` provided by LoyalSoldier..
* **GeoIP Codes**: Categories from geoip data (e.g. `cn`, `private`).
* **URLs**: Remote files downloadable by urls
* **CIDRs**: Manually added IP ranges.

### Supported URL file types [#supported-url-file-types]

* V2ray GeoSite / GeoIP files

* Clash Rules

### Geo file updates [#geo-file-updates]

VX downloads geo files from urls specified in atomic sets periodically.

Configure automatic updates in **Settings → General → Auto Update Geo Files**:

* **Auto Update Geo Files**: Enables periodic re-download of geo files.
* **Update Interval**: How often to refresh, in **days** (minimum 1). Default is **7 days**.
* **Update Now**: Triggers an immediate download and processing.

## Set name cannot be duplicated [#set-name-cannot-be-duplicated]

Every set name must be unique within its category(domain/ip/app):

* An **atomic domain set** name cannot be same as any other atomic or great domain set name.
* A **great domain set** name cannot be same as any existing atomic or great domain set name.
* A new name also cannot be same as another set's **mutually exclusive set name**.

The same rules apply separately to IP sets (atomic vs great).

## Built-in geo sets [#built-in-geo-sets]

VX always has these built-in sets:

### Atomic Domain Set [#atomic-domain-set-1]

* **Custom Proxy**: This is the set you are editing when you add/remove domains in proxy segment of the simplified view
* **Custom Direct**: This is the set you are editing when you add/remove domains in direct segment of the simplified view

### Atomic IP Set [#atomic-ip-set-1]

* **Custom Proxy**: This is the set you are editing when you add/remove ips in proxy segment of the simplified view
* **Custom Direct**: This is the set you are editing when you add/remove ips in direct segment of the simplified view

### App Set [#app-set]

* **Proxy**: This is the set you are editing when you add/remove apps in proxy segment of the simplified view
* **Direct**: This is the set you are editing when you add/remove apps in direct segment of the simplified view

## Related [#related]

* [Simplified routing](/docs/vx/manual/customize/simplified) — quick edits to Custom Proxy / Custom Direct
* [Routing modes](/docs/vx/manual/customize/modes) — how sets connect to rules


# Simplified View (/docs/vx/manual/customize/simplified)



The **simplified** page is the default view. It hides complex modes, rule ordering, and set composition — you only choose **what** should go proxy or direct.

Your choices will be prefered over the default routing. For example, **google.com** is a domain blocked by GFW, when using GFW mode,
it will go proxy by default. However, if you add google.com to direct, it will go direct as you specified.

## Adding and removing entries [#adding-and-removing-entries]

* Tap &#x2A;*+** (or the add control) to enter a domain, IP, or app
* **Long-press** or **right-click** a chip → Delete
* **Double-click** a chip to delete (desktop)

> **Note:** Adding/removing elements does not need to restart VX, it takes effect immediately.

On Android, app elements in Direct with Exact types will not go through VX, which improve performance and reduce battery usage.
Therefore, it is recommended that you add all apps that should go direct to Direct.

## Relation to set [#relation-to-set]

When you add/remove elements, you are actually adding/removing elements to sets.
For example, when you add an domain under proxy segment because you want it to go proxy, you are actually adding the domain to the "Custom Proxy" set.

#### Domain and IP [#domain-and-ip]

* `Proxy` (`Domain`): **Custom Proxy**
* `Proxy` (`IP`): **Custom Proxy**
* `Direct` (`Domain`): **Custom Direct**
* `Direct` (`IP`): **Custom Direct**

#### App [#app]

* `Proxy` (`App`): **Proxy**
* `Direct` (`App`): **Direct**

## Related [#related]

* [Sets](/docs/vx/manual/customize/sets) — domain set, ip set and app set


# AnyTLS (/docs/vx-core/configuration/protocols/anytls)



AnyTLS is a multiplexed TLS tunnel protocol. Proto: [`protos/proto/vx/proxy/anytls/anytls.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/proxy/anytls/anytls.proto)

Typically used with [TLS](/docs/vx-core/configuration/security/tls) or [WebSocket](/docs/vx-core/configuration/transport/websocket) transport.

## AnytlsServerConfig [#anytlsserverconfig]

<ProtoField name="users" type="UserConfig[]">
  Allowed users; the authentication password is in `secret`
</ProtoField>

```json
{
  "@type": "type.googleapis.com/vx.proxy.anytls.AnytlsServerConfig",
  "users": [{ "secret": "your-password" }]
}
```

## AnytlsClientConfig [#anytlsclientconfig]

<ProtoField name="password" type="string">
  Authentication password; must match a server `users[].secret`
</ProtoField>

<ProtoField name="idleSessionCheckInterval" type="uint32">
  Idle session check interval (**seconds**, default 30)
</ProtoField>

<ProtoField name="idleSessionTimeout" type="uint32">
  Close the session after this idle duration (**seconds**, default 30)
</ProtoField>

<ProtoField name="minIdleSession" type="uint32">
  Minimum number of idle sessions kept in the connection pool (default 5)
</ProtoField>

```json
{
  "@type": "type.googleapis.com/vx.proxy.anytls.AnytlsClientConfig",
  "password": "your-password",
  "idleSessionCheckInterval": 30,
  "idleSessionTimeout": 60,
  "minIdleSession": 4
}
```

## Related [#related]

* [TLS](/docs/vx-core/configuration/security/tls)
* [WebSocket](/docs/vx-core/configuration/transport/websocket)


# Freedom, Blackhole, Dokodemo (/docs/vx-core/configuration/protocols/builtin)



## Freedom [#freedom]

Direct outbound — traffic is sent without passing through an upstream proxy.

Proto: [`freedom.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/proxy/freedom/freedom.proto)

`FreedomConfig` has no fields.

```json
{
  "@type": "type.googleapis.com/vx.proxy.freedom.FreedomConfig"
}
```

Used as the server default `direct` outbound.

***

## Blackhole [#blackhole]

Drops traffic (blocking).

Proto: [`blackhole.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/proxy/blackhole/blackhole.proto)

`BlackholeConfig` has no fields.

```json
{
  "@type": "type.googleapis.com/vx.proxy.blackhole.BlackholeConfig"
}
```

***

## Dokodemo-door [#dokodemo-door]

Transparent redirect / port-forward inbound.

Proto: [`dokodemo.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/proxy/dokodemo/dokodemo.proto)

<ProtoField name="address">
  Forward destination address
</ProtoField>

<ProtoField name="port">
  Destination port
</ProtoField>

<ProtoField name="networks">
  `TCP`, `UDP`, etc.
</ProtoField>

```json
{
  "@type": "type.googleapis.com/vx.proxy.dokodemo.DokodemoConfig",
  "address": "127.0.0.1",
  "port": 8080,
  "networks": ["TCP"]
}
```


# HTTP proxy (/docs/vx-core/configuration/protocols/http-proxy)



Standard HTTP proxy protocol (`CONNECT` tunneling and plain HTTP forwarding). Proto: [`protos/proto/vx/proxy/http/http.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/proxy/http/http.proto)

This is not HTTP **transport** disguise (`TransportConfig.http`) — see [Transport HTTP](/docs/vx-core/configuration/transport/http).

* **Inbound** (`HttpServerConfig`): accepts client HTTP proxy requests, supporting `CONNECT` and plain HTTP (absolute URL)
* **Outbound** (`HttpClientConfig`): initiates `CONNECT` to an upstream HTTP proxy, establishing a TCP tunnel. UDP is not supported

## HttpServerConfig [#httpserverconfig]

Empty message with no configuration fields.

The inbound handler supports:

* **`CONNECT`** — relays the TCP stream after returning `200 Connection established`
* **Plain HTTP** — forwards HTTP/1.1 requests with absolute URLs (not `CONNECT`)

Only TCP (and UNIX socket) inbounds are supported. `HttpServerConfig` itself has no authentication fields.

```json
{
  "@type": "type.googleapis.com/vx.proxy.http.HttpServerConfig"
}
```

## HttpClientConfig [#httpclientconfig]

<ProtoField name="account" type="Account">
  Optional HTTP proxy authentication. When non-empty, sends a `Proxy-Authorization: Basic ...` header in the `CONNECT` request.
</ProtoField>

<ProtoField name="h1SkipWaitForReply" type="bool">
  HTTP/1 `CONNECT` optimization, default `false`.

  * `false`: send the `CONNECT` request first, wait for the proxy to return `200`, then send the first payload
  * `true`: write the first payload in the same write as the `CONNECT` request (for upstreams that require the first packet with the handshake); also extends the timeout for waiting for the first payload to 1 second

  No effect on HTTP/2 `CONNECT` (HTTP/2 can already carry the first payload in the request body).
</ProtoField>

```json
{
  "@type": "type.googleapis.com/vx.proxy.http.HttpClientConfig",
  "account": {
    "username": "user",
    "password": "pass"
  }
}
```

## Account [#account]

<ProtoField name="username" type="string">
  Proxy authentication username
</ProtoField>

<ProtoField name="password" type="string">
  Proxy authentication password
</ProtoField>

## Related [#related]

* [Transport HTTP](/docs/vx-core/configuration/transport/http) — HTTP/2 transport disguise (different purpose)
* [Outbounds](/docs/vx-core/configuration/outbounds) — embed `HttpClientConfig` in `protocol`
* [Inbounds](/docs/vx-core/configuration/inbounds) — embed `HttpServerConfig` in `protocol`


# Hysteria2 (/docs/vx-core/configuration/protocols/hysteria)



Proto: [`protos/proto/vx/proxy/hysteria/hysteria.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/proxy/hysteria/hysteria.proto)

Hysteria2 is built on QUIC. TLS is configured inside the protocol via `tlsConfig` ([TlsConfig](/docs/vx-core/configuration/security/tls)), not via `TransportConfig.tls`.

## Hysteria2ServerConfig [#hysteria2serverconfig]

<ProtoField name="users" type="UserConfig[]">
  Allowed users; the authentication password is in `secret`
</ProtoField>

<ProtoField name="obfs" type="ObfsConfig">
  Traffic obfuscation; see [ObfsConfig](#obfsconfig)
</ProtoField>

<ProtoField name="bandwidth" type="BandwidthConfig">
  Server-side bandwidth limits; see [BandwidthConfig](#bandwidthconfig)
</ProtoField>

<ProtoField name="quic" type="QuicConfig">
  QUIC tuning; see [QuicConfig](#quicconfig)
</ProtoField>

<ProtoField name="ignoreClientBandwidth" type="bool">
  Ignore bandwidth hints reported by the client
</ProtoField>

<ProtoField name="tlsConfig" type="TlsConfig">
  Server TLS certificates and settings
</ProtoField>

<ProtoField name="addresses" type="string[]">
  Listen / advertised addresses
</ProtoField>

```json
{
  "@type": "type.googleapis.com/vx.proxy.hysteria.Hysteria2ServerConfig",
  "users": [{ "secret": "auth-password" }],
  "tlsConfig": {
    "certificates": [{ "certificateFilepath": "/path/cert.pem", "keyFilepath": "/path/key.pem" }]
  }
}
```

## Hysteria2ClientConfig [#hysteria2clientconfig]

<ProtoField name="auth" type="string">
  Authentication password; must match a server `users[].secret`
</ProtoField>

<ProtoField name="tlsConfig" type="TlsConfig">
  Client TLS (SNI, `allowInsecure`, ECH, certificate pinning, etc.)
</ProtoField>

<ProtoField name="quic" type="QuicConfig">
  QUIC tuning
</ProtoField>

<ProtoField name="fastOpen" type="bool">
  Enable QUIC 0-RTT fast open
</ProtoField>

<ProtoField name="bandwidth" type="BandwidthConfig">
  Client bandwidth declaration (upload `maxTx`, download `maxRx`)
</ProtoField>

<ProtoField name="obfs" type="ObfsConfig">
  Salamander obfuscation
</ProtoField>

```json
{
  "@type": "type.googleapis.com/vx.proxy.hysteria.Hysteria2ClientConfig",
  "auth": "auth-password",
  "tlsConfig": { "serverName": "example.com" }
}
```

## QuicConfig [#quicconfig]

Window fields come in two groups: **MB** fields (`initialStreamReceiveWindow`, etc., `uint32`, internally × 1 MiB) and **bytes** fields (`initialStreamReceiveWindowBytes`, etc., `uint64`). MB fields take precedence when non-zero; when both are zero, the bytes fields or platform defaults are used.

<ProtoField name="initialStreamReceiveWindow" type="uint32">
  Initial stream receive window (MiB)
</ProtoField>

<ProtoField name="maxStreamReceiveWindow" type="uint32">
  Maximum stream receive window (MiB)
</ProtoField>

<ProtoField name="initialConnectionReceiveWindow" type="uint32">
  Initial connection receive window (MiB)
</ProtoField>

<ProtoField name="maxConnectionReceiveWindow" type="uint32">
  Maximum connection receive window (MiB)
</ProtoField>

<ProtoField name="initialStreamReceiveWindowBytes" type="uint64">
  Initial stream receive window (bytes)
</ProtoField>

<ProtoField name="maxStreamReceiveWindowBytes" type="uint64">
  Maximum stream receive window (bytes)
</ProtoField>

<ProtoField name="initialConnectionReceiveWindowBytes" type="uint64">
  Initial connection receive window (bytes)
</ProtoField>

<ProtoField name="maxConnectionReceiveWindowBytes" type="uint64">
  Maximum connection receive window (bytes)
</ProtoField>

<ProtoField name="maxIdleTimeout" type="uint32">
  Idle timeout (**seconds**, default 30)
</ProtoField>

<ProtoField name="keepAlivePeriod" type="uint32">
  Keep-alive period (**seconds**, default 10)
</ProtoField>

<ProtoField name="disablePathMtuDiscovery" type="bool">
  Disable QUIC path MTU discovery
</ProtoField>

<ProtoField name="maxIncomingStreams" type="uint32">
  Maximum incoming streams (**server only**)
</ProtoField>

## ObfsConfig [#obfsconfig]

`salamander` is the only obfuscation type currently supported (oneof).

<ProtoField name="salamander" type="SalamanderConfig">
  Salamander obfuscation configuration
</ProtoField>

### SalamanderConfig [#salamanderconfig]

<ProtoField name="password" type="string">
  Obfuscation password
</ProtoField>

## BandwidthConfig [#bandwidthconfig]

`maxTx` / `maxRx` are in **Mbps** (internally converted to bytes per second).

<ProtoField name="maxTx" type="uint32">
  Upload bandwidth limit. On the client, this is upload; on the server, the maximum allowed upload
</ProtoField>

<ProtoField name="maxRx" type="uint32">
  Download bandwidth limit. On the client, this is download; on the server, the maximum allowed download
</ProtoField>

## Related [#related]

* [TLS](/docs/vx-core/configuration/security/tls) — `tlsConfig` field
* [Outbounds](/docs/vx-core/configuration/outbounds) — UDP outbounds


# Proxy Protocols (/docs/vx-core/configuration/protocols)



Proxy protocol settings are embedded in [inbound](/docs/vx-core/configuration/inbounds) `protocol` / `protocols` and [outbound](/docs/vx-core/configuration/outbounds) `protocol`, with type `google.protobuf.Any`.

In ProtoJSON, set `@type` to:

```
type.googleapis.com/<protobuf full name>
```

Protobuf package names use dots (for example `vx.proxy.vmess.VmessServerConfig`).

## Server and Client Messages [#server-and-client-messages]

* **VMess** — Server: `vx.proxy.vmess.VmessServerConfig`, Client: `vx.proxy.vmess.VmessClientConfig`
* **VLESS** — Server: `vx.proxy.vless.VlessServerConfig`, Client: `vx.proxy.vless.VlessClientConfig`
* **Trojan** — Server: `vx.proxy.trojan.TrojanServerConfig`, Client: `vx.proxy.trojan.TrojanClientConfig`
* **Shadowsocks** — Server: `vx.proxy.shadowsocks.ShadowsocksServerConfig`, Client: `vx.proxy.shadowsocks.ShadowsocksClientConfig`
* **Shadowsocks 2022** — Server: `vx.proxy.shadowsocks2022.Shadowsocks2022ServerConfig`, Client: `vx.proxy.shadowsocks2022.Shadowsocks2022ClientConfig`
* **SOCKS** — Server: `vx.proxy.socks.SocksServerConfig`, Client: `vx.proxy.socks.SocksClientConfig`
* **HTTP proxy** — Server: `vx.proxy.http.HttpServerConfig`, Client: `vx.proxy.http.HttpClientConfig`
* **Hysteria2** — Server: `vx.proxy.hysteria.Hysteria2ServerConfig`, Client: `vx.proxy.hysteria.Hysteria2ClientConfig`
* **AnyTLS** — Server: `vx.proxy.anytls.AnytlsServerConfig`, Client: `vx.proxy.anytls.AnytlsClientConfig`
* **WireGuard** — Client: `vx.proxy.wireguard.DeviceConfig`
* **Freedom** — Server: `vx.proxy.freedom.FreedomConfig`, Client: same as server
* **Blackhole** — Server: `vx.proxy.blackhole.BlackholeConfig`, Client: same as server
* **Dokodemo** — Server: `vx.proxy.dokodemo.DokodemoConfig`, Client: same as server

## Transport and TLS [#transport-and-tls]

Most proxy protocols run over raw TCP or UDP. When TLS, WebSocket, gRPC, REALITY, etc. are needed, set `transport` on the inbound/outbound to [TransportConfig](/docs/vx-core/configuration/transport) (or use [MultiProxyInboundConfig](/docs/vx-core/configuration/inbounds) for per-SNI matrix configuration).

Hysteria2 embeds `tlsConfig` inside the protocol message.

## Sections [#sections]

<Cards>
  <Card title="VMess" href="/docs/vx-core/configuration/protocols/vmess" />

  <Card title="VLESS" href="/docs/vx-core/configuration/protocols/vless" />

  <Card title="Trojan" href="/docs/vx-core/configuration/protocols/trojan" />

  <Card title="Shadowsocks" href="/docs/vx-core/configuration/protocols/shadowsocks" />

  <Card title="SOCKS" href="/docs/vx-core/configuration/protocols/socks" />

  <Card title="HTTP proxy" href="/docs/vx-core/configuration/protocols/http-proxy" />

  <Card title="Hysteria2" href="/docs/vx-core/configuration/protocols/hysteria" />

  <Card title="AnyTLS" href="/docs/vx-core/configuration/protocols/anytls" />

  <Card title="WireGuard" href="/docs/vx-core/configuration/protocols/wireguard" />

  <Card title="Freedom / Blackhole / Dokodemo" href="/docs/vx-core/configuration/protocols/builtin" />
</Cards>

Proto tree: [`protos/proto/vx/proxy/`](https://github.com/5vnetwork/vx-core/tree/main/protos/proto/vx/proxy).


# Shadowsocks (/docs/vx-core/configuration/protocols/shadowsocks)



Classic Shadowsocks and Shadowsocks 2022 use different protobuf messages, configured via the `Any` field in [inbound](/docs/vx-core/configuration/inbounds) `protocol` / [outbound](/docs/vx-core/configuration/outbounds) `protocol`.

## Shadowsocks (classic) [#shadowsocks-classic]

Proto: [`protos/proto/vx/proxy/shadowsocks/shadowsocks.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/proxy/shadowsocks/shadowsocks.proto)

Supports TCP and UDP.

### ShadowsocksCipherType [#shadowsocksciphertype]

<ProtoField name="AES_128_GCM" type="0" />

<ProtoField name="AES_256_GCM" type="1" />

<ProtoField name="CHACHA20_POLY1305" type="2" />

<ProtoField name="NONE" type="3" />

Use enum names in JSON (for example `"cipherType": "CHACHA20_POLY1305"`). `NONE` means no payload encryption, typically used only when combined with outer TLS, etc.

### ShadowsocksServerConfig [#shadowsocksserverconfig]

<ProtoField name="cipherType" type="ShadowsocksCipherType">
  Encryption algorithm
</ProtoField>

<ProtoField name="ivCheck" type="bool">
  When `true`, enable IV replay detection (Bloom filter) and reject duplicate IVs
</ProtoField>

<ProtoField name="user" type="UserConfig">
  Single user; `secret` is the Shadowsocks password
</ProtoField>

<ProtoField name="experimentReducedIvHeadEntropy" type="bool">
  Experimental option: map the first 6 bytes of the IV to printable characters, reducing IV entropy for certain traffic disguise scenarios
</ProtoField>

```json
{
  "@type": "type.googleapis.com/vx.proxy.shadowsocks.ShadowsocksServerConfig",
  "cipherType": "CHACHA20_POLY1305",
  "ivCheck": true,
  "user": { "secret": "your-password" }
}
```

### ShadowsocksClientConfig [#shadowsocksclientconfig]

<ProtoField name="cipherType" type="ShadowsocksCipherType">
  Must match the server `cipherType`
</ProtoField>

<ProtoField name="password" type="string">
  Pre-shared key (PSK), same as the server `user.secret`
</ProtoField>

```json
{
  "@type": "type.googleapis.com/vx.proxy.shadowsocks.ShadowsocksClientConfig",
  "cipherType": "CHACHA20_POLY1305",
  "password": "your-password"
}
```

***

## Shadowsocks 2022 [#shadowsocks-2022]

Proto: [`protos/proto/vx/proxy/shadowsocks2022/shadowsocks2022.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/proxy/shadowsocks2022/shadowsocks2022.proto)

AEAD 2022 implementation based on sing-shadowsocks. Supported `method` values:

* `2022-blake3-aes-128-gcm` — PSK 16 bytes
* `2022-blake3-aes-256-gcm` — PSK 32 bytes
* `2022-blake3-chacha20-poly1305` — PSK 32 bytes

The PSK can be valid base64 (with the required length); otherwise the core derives the required length from the plaintext password using BLAKE3.

### Shadowsocks2022ServerConfig [#shadowsocks2022serverconfig]

<ProtoField name="method" type="string">
  Cipher suite string (see supported list above)
</ProtoField>

<ProtoField name="user" type="UserConfig">
  Single user; `secret` is the PSK (base64 or plaintext; client-side handling is the same)
</ProtoField>

<ProtoField name="networks" type="Network[]">
  Allowed networks (`TCP`, `UDP`, etc.). When empty, defaults to `TCP` and `UDP`.
</ProtoField>

```json
{
  "@type": "type.googleapis.com/vx.proxy.shadowsocks2022.Shadowsocks2022ServerConfig",
  "method": "2022-blake3-aes-128-gcm",
  "user": { "secret": "base64-or-raw-key" }
}
```

### Shadowsocks2022ClientConfig [#shadowsocks2022clientconfig]

<ProtoField name="method" type="string">
  Must match the server `method`
</ProtoField>

<ProtoField name="key" type="string">
  PSK / key material, same as the server `user.secret`
</ProtoField>

```json
{
  "@type": "type.googleapis.com/vx.proxy.shadowsocks2022.Shadowsocks2022ClientConfig",
  "method": "2022-blake3-aes-128-gcm",
  "key": "base64-or-raw-key"
}
```

## Related [#related]

* [Transport](/docs/vx-core/configuration/transport) — WebSocket, TLS, etc.
* [Users](/docs/vx-core/configuration/users) — `UserConfig`


# SOCKS (/docs/vx-core/configuration/protocols/socks)



SOCKS proxy configuration. Proto: [`protos/proto/vx/proxy/socks/socks.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/proxy/socks/socks.proto)

The server inbound supports **SOCKS5** (TCP connections and UDP associate), and is compatible with **SOCKS4/4a** TCP when `authType` is `NO_AUTH`. The client outbound uses the **SOCKS5** handshake.

## AuthType [#authtype]

<ProtoField name="NO_AUTH" type="0" />

<ProtoField name="PASSWORD" type="1" />

Use enum names in JSON (for example `"authType": "PASSWORD"`).

* `NO_AUTH`: no username/password required; SOCKS4/4a clients are allowed
* `PASSWORD`: SOCKS5 username/password authentication required; SOCKS4 requests are rejected

## SocksServerConfig [#socksserverconfig]

<ProtoField name="authType" type="AuthType">
  Authentication mode
</ProtoField>

<ProtoField name="accounts" type="UserConfig[]">
  Allowed users when `PASSWORD` is set. `id` is the username, `secret` is the password.
</ProtoField>

<ProtoField name="address" type="string">
  **BND.ADDR** used in SOCKS replies. Mainly affects the bind address in **UDP ASSOCIATE** replies: if set, this IP is used; otherwise loopback for local clients, or the inbound listen address for external clients.
</ProtoField>

<ProtoField name="udpEnabled" type="bool">
  When `true`, allow SOCKS5 `UDP ASSOCIATE` commands and enable inbound UDP relay. When `false`, UDP commands return not supported.
</ProtoField>

```json
{
  "@type": "type.googleapis.com/vx.proxy.socks.SocksServerConfig",
  "authType": "PASSWORD",
  "udpEnabled": true,
  "address": "203.0.113.1",
  "accounts": [{ "id": "u1", "secret": "pass" }]
}
```

## SocksClientConfig [#socksclientconfig]

<ProtoField name="name" type="string">
  SOCKS5 username. When both `name` and `password` are empty, password authentication is not sent (corresponds to server `NO_AUTH`).
</ProtoField>

<ProtoField name="password" type="string">
  SOCKS5 password, corresponding to server `accounts[].secret`.
</ProtoField>

<ProtoField name="delayAuthWrite" type="bool">
  `false` (default): send authentication in the initial handshake message.

  `true`: send supported authentication methods first, then write the username/password after the server selects `PASSWORD`. Used for upstream SOCKS servers that require a step-by-step handshake.
</ProtoField>

```json
{
  "@type": "type.googleapis.com/vx.proxy.socks.SocksClientConfig",
  "name": "u1",
  "password": "pass"
}
```

## Related [#related]

* [Users](/docs/vx-core/configuration/users) — `UserConfig`
* [Transport](/docs/vx-core/configuration/transport) — often used with TCP inbounds/outbounds


# Trojan (/docs/vx-core/configuration/protocols/trojan)



Proto: [`protos/proto/vx/proxy/trojan/trojan.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/proxy/trojan/trojan.proto)

## TrojanServerConfig [#trojanserverconfig]

<ProtoField name="users" type="UserConfig[]">
  Password is in `secret`
</ProtoField>

<ProtoField name="vision" type="bool">
  Enable **Trojan Vision** (similar to VLESS `xtls-rprx-vision`). Both client and server must be enabled **at the same time**.
</ProtoField>

```json
{
  "@type": "type.googleapis.com/vx.proxy.trojan.TrojanServerConfig",
  "vision": true,
  "users": [{ "id": "user1", "secret": "your-password" }]
}
```

## TrojanClientConfig [#trojanclientconfig]

<ProtoField name="password" type="string">
  Trojan password
</ProtoField>

<ProtoField name="vision" type="bool">
  Enable Trojan Vision
</ProtoField>


# VLESS (/docs/vx-core/configuration/protocols/vless)



Proto: [`protos/proto/vx/proxy/vless/vless.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/proxy/vless/vless.proto)

## VlessServerConfig [#vlessserverconfig]

<ProtoField name="users" type="UserConfig[]" />

## VlessClientConfig [#vlessclientconfig]

<ProtoField name="id" type="string">
  Account UUID
</ProtoField>

<ProtoField name="flow" type="string">
  Flow control, for example `xtls-rprx-vision`
</ProtoField>

<ProtoField name="encryption" type="string">
  Client only; currently `none`
</ProtoField>

```json
{
  "@type": "type.googleapis.com/vx.proxy.vless.VlessClientConfig",
  "id": "66ad4540-b58c-4ad2-9926-ea63445a9b57",
  "flow": "xtls-rprx-vision",
  "encryption": "none"
}
```

Vision flow control is typically used with [REALITY](/docs/vx-core/configuration/security/reality) or [TLS](/docs/vx-core/configuration/security/tls) on the transport.


# VMess (/docs/vx-core/configuration/protocols/vmess)



Proto: [`protos/proto/vx/proxy/vmess/vmess.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/proxy/vmess/vmess.proto)

## VmessServerConfig [#vmessserverconfig]

<ProtoField name="accounts" type="UserConfig[]">
  Allowed users (`id`, `userLevel`, `secret`)
</ProtoField>

<ProtoField name="secureEncryptionOnly" type="bool">
  Reject legacy encryption
</ProtoField>

```json
{
  "@type": "type.googleapis.com/vx.proxy.vmess.VmessServerConfig",
  "secureEncryptionOnly": true,
  "accounts": [{ "id": "uuid-here", "userLevel": 0 }]
}
```

## VmessClientConfig [#vmessclientconfig]

<ProtoField name="id" type="string">
  Like a password; can be any string
</ProtoField>

<ProtoField name="security" type="SecurityType">
  See below
</ProtoField>

<ProtoField name="alterId" type="uint32">
  Legacy alterId (usually 0)
</ProtoField>

### SecurityType [#securitytype]

<ProtoField name="UNKNOWN" type="0" />

<ProtoField name="LEGACY" type="1" />

<ProtoField name="AUTO" type="2" />

<ProtoField name="AES128_GCM" type="3" />

<ProtoField name="CHACHA20_POLY1305" type="4" />

<ProtoField name="NONE" type="5" />

<ProtoField name="ZERO" type="6" />

Use enum names in JSON (for example `"security": "CHACHA20_POLY1305"`).

## Related [#related]

* [Transport](/docs/vx-core/configuration/transport) — WebSocket, TLS, etc.
* [Users](/docs/vx-core/configuration/users)


# WireGuard (/docs/vx-core/configuration/protocols/wireguard)



Proto: [`protos/proto/vx/proxy/wireguard/config.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/proxy/wireguard/config.proto)

WireGuard is used only as an **outbound** `DeviceConfig` (this proto has no `*ServerConfig`).

## DeviceConfig [#deviceconfig]

<ProtoField name="secretKey" type="string">
  Local interface private key (WireGuard key format)
</ProtoField>

<ProtoField name="endpoint" type="string[]">
  Device-level endpoint host list (optional)
</ProtoField>

<ProtoField name="peers" type="PeerConfig[]">
  Remote peers; see [PeerConfig](#peerconfig)
</ProtoField>

<ProtoField name="mtu" type="int32">
  TUN interface MTU
</ProtoField>

<ProtoField name="numWorkers" type="int32">
  Number of encryption worker threads
</ProtoField>

<ProtoField name="reserved" type="bytes">
  WireGuard protocol reserved bytes (3 bytes, used to bypass blocking)
</ProtoField>

<ProtoField name="noKernelTun" type="bool">
  When `true`, use userspace TUN only; do not use kernel WireGuard
</ProtoField>

```json
{
  "@type": "type.googleapis.com/vx.proxy.wireguard.DeviceConfig",
  "secretKey": "...",
  "isClient": true,
  "peers": [
    {
      "publicKey": "...",
      "endpoint": "vpn.example.com:51820",
      "allowedIps": ["0.0.0.0/0", "::/0"]
    }
  ]
}
```

## PeerConfig [#peerconfig]

<ProtoField name="publicKey" type="string">
  Peer public key
</ProtoField>

<ProtoField name="preSharedKey" type="string">
  Optional pre-shared key (PSK)
</ProtoField>

<ProtoField name="endpoint" type="string">
  Peer endpoint `host:port`
</ProtoField>

<ProtoField name="keepAlive" type="uint32">
  Persistent keepalive interval (**seconds**)
</ProtoField>

<ProtoField name="allowedIps" type="string[]">
  List of IP CIDRs routed through this peer
</ProtoField>

## Related [#related]

* [Outbounds](/docs/vx-core/configuration/outbounds)
* [TCP header masking](/docs/vx-core/configuration/transport/tcp) — `wireguard` header type


# Security (/docs/vx-core/configuration/security)



The security layer encrypts or disguises connections beneath the wire protocol. Configure it on [`TransportConfig`](/docs/vx-core/configuration/transport) via `tls` or `reality` (oneof with the transport protocol).

```json
{
  "transport": {
    "tcp": {},
    "reality": {
      "dest": "www.microsoft.com:443",
      "serverNames": ["www.example.com"],
      "privateKey": "...",
      "shortIds": ["abcd1234"]
    }
  }
}
```

Hysteria2 uses an inline `tlsConfig` inside the [protocol message](/docs/vx-core/configuration/protocols/hysteria), not `TransportConfig`.

## Sections [#sections]

<Cards>
  <Card title="TLS" href="/docs/vx-core/configuration/security/tls" description="Certificates, SNI, uTLS, ECH" />

  <Card title="REALITY" href="/docs/vx-core/configuration/security/reality" description="REALITY server and client settings" />
</Cards>

Proto paths:

* [`protos/proto/vx/transport/security/tls/`](https://github.com/5vnetwork/vx-core/tree/main/protos/proto/vx/transport/security/tls)
* [`protos/proto/vx/transport/security/reality/config.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/transport/security/reality/config.proto)


# REALITY (/docs/vx-core/configuration/security/reality)



Proto: [`protos/proto/vx/transport/security/reality/config.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/transport/security/reality/config.proto)

Set on `TransportConfig.reality` or `MultiProxyInboundConfig.securityConfigs[].reality`.

**Mutually exclusive** with `tls` (only one per transport block).

## RealityConfig [#realityconfig]

### Server only [#server-only]

<ProtoField name="dest" type="string">
  Fallback destination (e.g. `www.microsoft.com:443`)
</ProtoField>

<ProtoField name="xver" type="uint64">
  PROXY protocol version sent to `dest` (0 = do not send)
</ProtoField>

<ProtoField name="serverNames" type="string[]">
  Allowed SNI server names
</ProtoField>

<ProtoField name="privateKey" type="bytes">
  X25519 private key
</ProtoField>

<ProtoField name="minClientVer" type="bytes">
  Minimum allowed client version bytes
</ProtoField>

<ProtoField name="maxClientVer" type="bytes">
  Maximum allowed client version bytes
</ProtoField>

<ProtoField name="maxTimeDiff" type="uint64">
  Maximum client clock skew (**milliseconds**)
</ProtoField>

<ProtoField name="shortIds" type="bytes[]">
  Allowed short ID list (each entry up to 8 bytes)
</ProtoField>

### Client [#client]

<ProtoField name="show" type="bool">
  Debug output
</ProtoField>

<ProtoField name="Fingerprint" type="string">
  uTLS fingerprint (e.g. `chrome`, `firefox`)
</ProtoField>

<ProtoField name="serverName" type="string">
  Presented SNI
</ProtoField>

<ProtoField name="publicKey" type="bytes">
  Server public key (bytes)
</ProtoField>

<ProtoField name="pbk" type="string">
  Public key (Base64 string; equivalent to `publicKey`)
</ProtoField>

<ProtoField name="shortId" type="bytes">
  Client short ID (bytes; must be 8 bytes)
</ProtoField>

<ProtoField name="sid" type="string">
  Short ID hex string (8 bytes)
</ProtoField>

<ProtoField name="spiderX" type="string">
  Spider X path
</ProtoField>

<ProtoField name="spiderY" type="int64[]">
  Spider Y value list
</ProtoField>

<ProtoField name="masterKeyLog" type="string">
  Key log path (debugging)
</ProtoField>

```json
{
  "transport": {
    "tcp": {},
    "reality": {
      "dest": "www.microsoft.com:443",
      "serverNames": ["www.example.com"],
      "privateKey": "base64-or-raw",
      "shortIds": ["", "0123456789abcdef"]
    }
  },
  "protocol": {
    "@type": "type.googleapis.com/vx.proxy.vless.VlessServerConfig",
    "users": [{ "id": "uuid", "flow": "" }]
  }
}
```

## Related [#related]

* [TLS](/docs/vx-core/configuration/security/tls) — mutually exclusive with REALITY
* [VLESS](/docs/vx-core/configuration/protocols/vless) — Vision flow control
* [Inbounds](/docs/vx-core/configuration/inbounds) — `securityConfigs` on multi-inbounds


# TLS (/docs/vx-core/configuration/security/tls)



Protos:

* [`tls.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/transport/security/tls/tls.proto) — `TlsConfig`
* [`certificate.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/transport/security/tls/certificate.proto) — `Certificate`

Set on `TransportConfig.tls`, `MultiProxyInboundConfig.securityConfigs[].tls`, Hysteria2 `tlsConfig`, and SplitHTTP `downloadSettings.tls`.

**Mutually exclusive** with `reality` (only one per transport block).

## TlsConfig [#tlsconfig]

<ProtoField name="certificates" type="Certificate[]">
  Server/client certificate chain
</ProtoField>

<ProtoField name="rootCas" type="bytes[]">
  Custom root CA PEM (each entry is a PEM byte blob)
</ProtoField>

<ProtoField name="issueCas" type="Certificate[]">
  CAs used to issue certificates to peers
</ProtoField>

<ProtoField name="serverName" type="string">
  SNI; defaults to the target domain when dialing
</ProtoField>

<ProtoField name="disableSystemRoot" type="bool">
  Do not use system root CAs
</ProtoField>

<ProtoField name="allowInsecure" type="bool">
  Skip certificate verification (**client**)
</ProtoField>

<ProtoField name="nextProtocol" type="string[]">
  ALPN list (e.g. `h2`, `http/1.1`)
</ProtoField>

<ProtoField name="enableSessionResumption" type="bool">
  Enable TLS session tickets / resumption
</ProtoField>

<ProtoField name="pinnedPeerCertificateChainSha256" type="bytes[]">
  Pinned peer certificate chain SHA-256 hashes (each entry is 32 bytes)
</ProtoField>

<ProtoField name="verifyClientCertificate" type="bool">
  Require a valid client certificate (**server**)
</ProtoField>

<ProtoField name="imitate" type="string">
  uTLS client fingerprint name (e.g. `chrome`)
</ProtoField>

<ProtoField name="noSNI" type="bool">
  Do not send SNI (uTLS)
</ProtoField>

<ProtoField name="forceAlpn" type="ForceALPN">
  ALPN behavior; see [ForceALPN](#forcealpn)
</ProtoField>

<ProtoField name="masterKeyLog" type="string">
  NSS key log path (debugging)
</ProtoField>

<ProtoField name="echKey" type="bytes">
  Server ECH key
</ProtoField>

<ProtoField name="echConfig" type="bytes">
  Client ECH config blob
</ProtoField>

<ProtoField name="enableEch" type="bool">
  Client: enable ECH
</ProtoField>

### ForceALPN [#forcealpn]

<ProtoField name="TRANSPORT_PREFERENCE_TAKE_PRIORITY" type="0">
  Use user-configured ALPN if set; otherwise transport default
</ProtoField>

<ProtoField name="NO_ALPN" type="1">
  Do not send ALPN extension
</ProtoField>

<ProtoField name="UTLS_PRESET" type="2">
  Use uTLS preset ALPN
</ProtoField>

## Certificate [#certificate]

Certificates and private keys can be inline PEM bytes or loaded from file paths (paths take precedence over inline).

<ProtoField name="certificate" type="bytes">
  PEM certificate bytes
</ProtoField>

<ProtoField name="key" type="bytes">
  PEM private key bytes
</ProtoField>

<ProtoField name="certificateFilepath" type="string">
  Certificate file path
</ProtoField>

<ProtoField name="keyFilepath" type="string">
  Private key file path
</ProtoField>

```json
{
  "transport": {
    "tcp": {},
    "tls": {
      "serverName": "example.com",
      "certificates": [
        {
          "certificateFilepath": "/etc/vx/fullchain.pem",
          "keyFilepath": "/etc/vx/privkey.pem"
        }
      ],
      "nextProtocol": ["h2", "http/1.1"]
    }
  }
}
```

## Related [#related]

* [REALITY](/docs/vx-core/configuration/security/reality) — alternative security layer mutually exclusive with TLS
* [WebSocket](/docs/vx-core/configuration/transport/websocket) / [gRPC](/docs/vx-core/configuration/transport/grpc) — commonly paired with TLS on port 443
* [VLESS Vision](/docs/vx-core/configuration/protocols/vless) — `flow` with TLS or REALITY


# gRPC (/docs/vx-core/configuration/transport/grpc)



Proto: [`protos/proto/vx/transport/protocols/grpc/config.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/transport/protocols/grpc/config.proto)

Set on `TransportConfig.grpc`.

## GrpcConfig [#grpcconfig]

<ProtoField name="authority" type="string">
  `:authority` pseudo-header
</ProtoField>

<ProtoField name="serviceName" type="string">
  gRPC service name
</ProtoField>

<ProtoField name="multiMode" type="bool">
  Multi-stream mode
</ProtoField>

<ProtoField name="idleTimeout" type="int32">
  Idle timeout (seconds)
</ProtoField>

<ProtoField name="healthCheckTimeout" type="int32">
  Health check timeout
</ProtoField>

<ProtoField name="permitWithoutStream" type="bool">
  Allow pings when no active stream
</ProtoField>

<ProtoField name="initialWindowsSize" type="int32">
  Initial window size
</ProtoField>

<ProtoField name="userAgent" type="string">
  User-Agent override
</ProtoField>

```json
{
  "transport": {
    "grpc": {
      "serviceName": "GunService",
      "multiMode": true
    },
    "tls": { "serverName": "example.com" }
  }
}
```


# HTTP transport (/docs/vx-core/configuration/transport/http)



Proto: [`protos/proto/vx/transport/protocols/http/config.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/transport/protocols/http/config.proto)

HTTP/2 transport camouflage (not the [HTTP proxy](/docs/vx-core/configuration/protocols/http-proxy) protocol). Set on `TransportConfig.http`.

## HttpConfig [#httpconfig]

<ProtoField name="host" type="string[]">
  Host header values (one chosen at random)
</ProtoField>

<ProtoField name="path" type="string">
  Request path
</ProtoField>

<ProtoField name="method" type="string">
  HTTP method
</ProtoField>

<ProtoField name="header" type="HttpHeader[]">
  Custom headers; see [HttpHeader](#httpheader)
</ProtoField>

### HttpHeader [#httpheader]

<ProtoField name="name" type="string">
  Header name (e.g. `Accept`, `Cookie`)
</ProtoField>

<ProtoField name="value" type="string[]">
  Header values; when multiple are set, one is chosen at random
</ProtoField>

```json
{
  "transport": {
    "http": {
      "host": ["example.com"],
      "path": "/download",
      "method": "GET"
    },
    "tls": { "serverName": "example.com" }
  }
}
```


# HTTPUpgrade (/docs/vx-core/configuration/transport/httpupgrade)



Proto: [`protos/proto/vx/transport/protocols/httpupgrade/config.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/transport/protocols/httpupgrade/config.proto)

HTTP Upgrade transport (WebSocket-like over HTTP upgrade). Set on `TransportConfig.httpupgrade`.

## HttpUpgradeConfig [#httpupgradeconfig]

<ProtoField name="config" type="WebsocketConfig">
  Same fields as [WebSocket](/docs/vx-core/configuration/transport/websocket)
</ProtoField>

```json
{
  "transport": {
    "httpupgrade": {
      "config": {
        "path": "/upgrade",
        "host": "example.com"
      }
    },
    "tls": { "serverName": "example.com" }
  }
}
```


# Transport (/docs/vx-core/configuration/transport)



Transport settings wrap proxy protocols via `transport: { ... }` on [inbounds](/docs/vx-core/configuration/inbounds) and [outbounds](/docs/vx-core/configuration/outbounds).

Root message: [`TransportConfig`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/transport/transport.proto), in `protos/proto/vx/transport/transport.proto`.

## TransportConfig [#transportconfig]

<ProtoField name="socket" type="SocketConfig">
  Socket options (mark, TFO, bind, buffers, etc.). See [Socket](/docs/vx-core/configuration/transport/socket).
</ProtoField>

### Link protocols (oneof) [#link-protocols-oneof]

`tcp`, `kcp`, `websocket`, `http`, `grpc`, `httpupgrade`, and `splithttp` are mutually exclusive; each `TransportConfig` may set only one.

<ProtoField name="tcp" type="TcpConfig">
  Plain TCP transport. See [TCP](/docs/vx-core/configuration/transport/tcp).
</ProtoField>

<ProtoField name="kcp" type="KcpConfig">
  UDP-based KCP transport. See [KCP](/docs/vx-core/configuration/transport/kcp).
</ProtoField>

<ProtoField name="websocket" type="WebsocketConfig">
  WebSocket transport. See [WebSocket](/docs/vx-core/configuration/transport/websocket).
</ProtoField>

<ProtoField name="http" type="HttpConfig">
  HTTP/2 transport camouflage. See [HTTP transport](/docs/vx-core/configuration/transport/http).
</ProtoField>

<ProtoField name="grpc" type="GrpcConfig">
  gRPC transport. See [gRPC](/docs/vx-core/configuration/transport/grpc).
</ProtoField>

<ProtoField name="httpupgrade" type="HttpUpgradeConfig">
  HTTP Upgrade transport. See [HTTPUpgrade](/docs/vx-core/configuration/transport/httpupgrade).
</ProtoField>

<ProtoField name="splithttp" type="SplitHttpConfig">
  Split HTTP (XHTTP) transport. See [SplitHTTP](/docs/vx-core/configuration/transport/splithttp).
</ProtoField>

### Security layer (oneof) [#security-layer-oneof]

`tls` and `reality` are mutually exclusive. See [Security](/docs/vx-core/configuration/security).

<ProtoField name="tls" type="TlsConfig">
  TLS certificates, SNI, uTLS, ECH
</ProtoField>

<ProtoField name="reality" type="RealityConfig">
  REALITY camouflage
</ProtoField>

### Extensions [#extensions]

<ProtoField name="transportProtocol" type="Any">
  `Any` escape hatch for custom transport protocols
</ProtoField>

<ProtoField name="securityProtocol" type="Any">
  `Any` escape hatch for custom security protocols
</ProtoField>

Each configuration should set at most one **link protocol** and one **security** field (or neither).

## Example (VLESS + WebSocket + TLS) [#example-vless--websocket--tls]

```json
{
  "tag": "vless-ws",
  "ports": [443],
  "transport": {
    "websocket": { "path": "/ws", "host": "example.com" },
    "tls": {
      "serverName": "example.com",
      "certificates": [
        { "certificateFilepath": "/etc/vx/cert.pem", "keyFilepath": "/etc/vx/key.pem" }
      ]
    }
  },
  "protocol": {
    "@type": "type.googleapis.com/vx.proxy.vless.VlessServerConfig",
    "users": [{ "id": "uuid" }]
  }
}
```

## Link protocols [#link-protocols]

<Cards>
  <Card title="TCP" href="/docs/vx-core/configuration/transport/tcp" />

  <Card title="WebSocket" href="/docs/vx-core/configuration/transport/websocket" />

  <Card title="HTTP" href="/docs/vx-core/configuration/transport/http" />

  <Card title="gRPC" href="/docs/vx-core/configuration/transport/grpc" />

  <Card title="KCP" href="/docs/vx-core/configuration/transport/kcp" />

  <Card title="HTTPUpgrade" href="/docs/vx-core/configuration/transport/httpupgrade" />

  <Card title="SplitHTTP (xhttp)" href="/docs/vx-core/configuration/transport/splithttp" />

  <Card title="Socket" href="/docs/vx-core/configuration/transport/socket" />
</Cards>

## Multi-inbound transport matrix [#multi-inbound-transport-matrix]

On `MultiProxyInboundConfig`, transport protocols are selected via `transportProtocols[]` by ALPN/SNI/path, rather than a single `TransportConfig`. Security blocks in `securityConfigs[]` work the same way. See [Inbounds](/docs/vx-core/configuration/inbounds).


# KCP (/docs/vx-core/configuration/transport/kcp)



Proto: [`protos/proto/vx/transport/protocols/kcp/config.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/transport/protocols/kcp/config.proto)

UDP-based KCP transport. Set on `TransportConfig.kcp`.

## KcpConfig [#kcpconfig]

<ProtoField name="mtu" type="uint32">
  MTU
</ProtoField>

<ProtoField name="tti" type="uint32">
  Transmission time interval
</ProtoField>

<ProtoField name="uplinkCapacity" type="uint32">
  Uplink capacity (legacy tuning)
</ProtoField>

<ProtoField name="downlinkCapacity" type="uint32">
  Downlink capacity
</ProtoField>

<ProtoField name="congestion" type="bool">
  Enable congestion control
</ProtoField>

<ProtoField name="writeBuffer" type="uint32">
  Write buffer size
</ProtoField>

<ProtoField name="readBuffer" type="uint32">
  Read buffer size
</ProtoField>

<ProtoField name="headerConfig" type="Any">
  Packet header camouflage (same family as [TCP headers](/docs/vx-core/configuration/transport/tcp))
</ProtoField>

<ProtoField name="seed" type="string">
  Obfuscation seed
</ProtoField>

```json
{
  "transport": {
    "kcp": {
      "mtu": 1350,
      "tti": 50,
      "uplinkCapacity": 12,
      "downlinkCapacity": 100
    }
  }
}
```


# Socket (/docs/vx-core/configuration/transport/socket)



Proto: [`protos/proto/vx/transport/dlhelper.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/transport/dlhelper.proto)

`SocketConfig` is set on `TransportConfig.socket` and `MultiProxyInboundConfig.socket`.

## SocketConfig [#socketconfig]

<ProtoField name="mark" type="uint32">
  `SO_MARK` (set when non-zero)
</ProtoField>

<ProtoField name="tfo" type="TCPFastOpenState">
  TCP Fast Open; see [TCPFastOpenState](#tcpfastopenstate)
</ProtoField>

<ProtoField name="tproxy" type="TProxyMode">
  Transparent proxy mode; see [TProxyMode](#tproxymode)
</ProtoField>

<ProtoField name="receiveOriginalDestAddress" type="bool">
  UDP: enable `IP_RECVORIGDSTADDR` to receive the original destination address
</ProtoField>

<ProtoField name="bindAddress" type="bytes">
  Bind local address (**Linux only**)
</ProtoField>

<ProtoField name="bindPort" type="uint32">
  Bind local port (used with `bindAddress`)
</ProtoField>

<ProtoField name="acceptProxyProtocol" type="bool">
  Accept PROXY protocol v1/v2
</ProtoField>

<ProtoField name="tcpKeepAliveInterval" type="int32">
  TCP keepalive probe interval (seconds)
</ProtoField>

<ProtoField name="tcpKeepAliveIdle" type="int32">
  TCP keepalive idle time (seconds)
</ProtoField>

<ProtoField name="tfoQueueLength" type="uint32">
  TFO queue length
</ProtoField>

<ProtoField name="bindToDevice" type="uint32">
  Bind to network interface index
</ProtoField>

<ProtoField name="rxBufSize" type="int64">
  Receive socket buffer size (bytes)
</ProtoField>

<ProtoField name="txBufSize" type="int64">
  Send socket buffer size (bytes)
</ProtoField>

<ProtoField name="forceBufSize" type="bool">
  Force application of `rxBufSize` / `txBufSize`
</ProtoField>

<ProtoField name="localAddr4" type="string">
  Outbound IPv4 local address (dial / UDP listen)
</ProtoField>

<ProtoField name="localAddr6" type="string">
  Outbound IPv6 local address
</ProtoField>

<ProtoField name="dialTimeout" type="uint32">
  Dial timeout override (seconds)
</ProtoField>

### TCPFastOpenState [#tcpfastopenstate]

<ProtoField name="AsIs" type="0">
  Keep the system TFO setting unchanged
</ProtoField>

<ProtoField name="Enable" type="1">
  Explicitly enable TFO
</ProtoField>

<ProtoField name="Disable" type="2">
  Explicitly disable TFO
</ProtoField>

### TProxyMode [#tproxymode]

<ProtoField name="Off" type="0">
  Disable transparent proxy
</ProtoField>

<ProtoField name="TProxy" type="1">
  TProxy mode
</ProtoField>

<ProtoField name="Redirect" type="2">
  Redirect mode
</ProtoField>

```json
{
  "transport": {
    "socket": {
      "tfo": "Enable",
      "tcpKeepAliveIdle": 60
    },
    "tcp": {}
  }
}
```


# SplitHTTP (xhttp) (/docs/vx-core/configuration/transport/splithttp)



Proto: [`protos/proto/vx/transport/protocols/splithttp/config.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/transport/protocols/splithttp/config.proto)

Split HTTP / XHTTP transport. Set on `TransportConfig.splithttp`.

## Related [#related]

* [TLS](/docs/vx-core/configuration/security/tls) — main transport and `downloadSettings.tls`
* [REALITY](/docs/vx-core/configuration/security/reality) — `downloadSettings.reality`


# TCP (/docs/vx-core/configuration/transport/tcp)



Proto: [`protos/proto/vx/transport/protocols/tcp/config.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/transport/protocols/tcp/config.proto)

Plain TCP transport. Set on `TransportConfig.tcp`.

## TcpConfig [#tcpconfig]

<ProtoField name="headerSettings" type="Any">
  Connection header camouflage (HTTP, TLS, SRTP, etc.)
</ProtoField>

### Header types (`headerSettings` @type) [#header-types-headersettings-type]

<ProtoField name="vx.transport.headers.noop.Config">
  No header
</ProtoField>

<ProtoField name="vx.transport.headers.http.Config">
  HTTP request/response camouflage
</ProtoField>

<ProtoField name="vx.transport.headers.tls.Config">
  TLS record camouflage
</ProtoField>

<ProtoField name="vx.transport.headers.srtp.Config">
  SRTP camouflage
</ProtoField>

<ProtoField name="vx.transport.headers.utp.Config">
  uTP camouflage
</ProtoField>

<ProtoField name="vx.transport.headers.wechat.Config">
  WeChat video camouflage
</ProtoField>

<ProtoField name="vx.transport.headers.wireguard.Config">
  WireGuard camouflage
</ProtoField>

HTTP header configuration (`vx.transport.headers.http.Config`) includes `request` and `response`, each with `version`, `method`, `uri`, and a `header` list. See [`headers/http/config.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/transport/headers/http/config.proto).

```json
{
  "transport": {
    "tcp": {
      "headerSettings": {
        "@type": "type.googleapis.com/vx.transport.headers.http.Config",
        "request": {
          "version": { "value": "1.1" },
          "method": { "value": "GET" },
          "uri": ["/"],
          "header": [{ "name": "Host", "value": ["example.com"] }]
        }
      }
    }
  }
}
```

When neither `tcp` nor any other protocol is set, raw TCP is used.


# WebSocket (/docs/vx-core/configuration/transport/websocket)



Proto: [`protos/proto/vx/transport/protocols/websocket/config.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/transport/protocols/websocket/config.proto)

Set on `TransportConfig.websocket`.

## WebsocketConfig [#websocketconfig]

<ProtoField name="host" type="string">
  Host header / authority
</ProtoField>

<ProtoField name="path" type="string">
  URL path; empty = `/`
</ProtoField>

<ProtoField name="header" type="Header[]">
  Extra headers (`key`, `value`)
</ProtoField>

<ProtoField name="maxEarlyData" type="int32">
  Maximum early data bytes
</ProtoField>

<ProtoField name="useBrowserForwarding" type="bool">
  Browser forwarding mode
</ProtoField>

<ProtoField name="earlyDataHeaderName" type="string">
  Header that carries early data
</ProtoField>

### Header [#header]

<ProtoField name="key" type="string">
  Header name
</ProtoField>

<ProtoField name="value" type="string">
  Header value
</ProtoField>

```json
{
  "transport": {
    "websocket": {
      "path": "/ray",
      "host": "example.com"
    },
    "tls": { "serverName": "example.com" }
  }
}
```

Also embedded in [HTTPUpgrade](/docs/vx-core/configuration/transport/httpupgrade).


# 简介 (/zh/docs)



欢迎阅读 VX 文档。本站介绍 **VX** 网络工具应用，以及为其提供能力的 **vx-core** 网络工具软件。

## 什么是 VX？ [#什么是-vx]

VX 是免费、完全开源、支持全平台的网络工具应用。它提供易用的图形界面，它可以用于监控本地网络流量、建立代理隧道、管理节点订阅以及部署服务器。

{/* <YouTube id="rqeLQ8426go" title="VX Demo" /> */}

## 什么是 vx-core？ [#什么是-vx-core]

vx-core 是用 Go 编写的网络工具软件，它是VX的基石，它也可以被用于作为代理服务器。

## 文档分区 [#文档分区]

<Cards>
  <Card title="VX 客户端" href="docs/vx" description="功能、安装与机场深链" />

  <Card title="vx-core 服务端" href="docs/vx-core" description="协议、配置与源码构建" />

  <Card title="教程" href="docs/tutorials" description="常见任务分步指南" />
</Cards>

## 快速链接 [#快速链接]

* [下载 VX](https://vx.5vnetwork.com)
* [VX GitHub](https://github.com/5vnetwork/vx)
* [vx-core GitHub](https://github.com/5vnetwork/vx-core)


# 自定义路由（通过指定节点访问 Netflix） (/zh/docs/tutorials/custom-routing)



本视频通过一个实用示例演示：将 **Netflix**（及相关域名）流量通过 **特定节点** 发送。

请观看下方视频，或在 [YouTube](https://www.youtube.com/watch?v=U0NyYOFC-84) 上打开。

本视频为中文讲解。

<YouTube id="U0NyYOFC-84" title="自定义路由 — 将 Netflix 流量路由到指定节点" />

## 相关文档 [#相关文档]

* [自定义标签页](/zh/docs/vx/manual/customize) — 简易模式与高级模式概览
* [路由模式](/zh/docs/vx/manual/customize/modes) — 规则、条件与出站选择
* [集合](/zh/docs/vx/manual/customize/sets) — 规则中使用的域名集合
* [选择器](/zh/docs/vx/manual/customize/selectors) — 按组选择节点，而非固定出站
* [VX 安装](/zh/docs/vx/installation) — 请先安装客户端


# 一次部署多种协议 (/zh/docs/tutorials/deploy-multi-protocol)



VX **All in One** Quick Deploy 可在 VPS 上安装 **vx-core**，并在单次部署中创建多个节点。部署的节点使用自签名证书并启用 SHA256 对等验证，因此无需担心 MITM 攻击。

典型的 All-in-One 部署包括：

* **协议** — VMess、Trojan、AnyTLS 与 Hysteria2
* **传输** — WebSocket 与 gRPC
* **安全** — 基于生成证书的 TLS；提供 REALITY 域名时可选用 **REALITY**
* **CDN** — 可选 CDN 主机名，在服务器前端增加 WebSocket + TLS 节点

VX 还可在部署时按需启用 **BBR** 并调整防火墙设置。

请观看下方视频，或在 [YouTube](https://www.youtube.com/watch?v=ZJHPvtQQkTo) 上打开。

本视频为中文讲解。

<YouTube id="ZJHPvtQQkTo" title="使用 VX All in One Quick Deploy 一次部署多种协议" />

## 前置条件 [#前置条件]

* 已在 VX 的 **Servers** 中添加 Linux VPS，且 **SSH** 可用

## 相关文档 [#相关文档]

* [部署 REALITY / XHTTP](/zh/docs/tutorials/deploy-reality-xhttp) — 专注 Reality/XHTTP（Xray）的 Quick Deploy
* [VX-core 面板](/zh/docs/vx/manual/vx-core-panel) — 服务器面板概览
* [代理协议](/zh/docs/vx-core/configuration/protocols) — 协议参考
* [多协议支持](/zh/docs/vx/manual/multi-protocol) — 在客户端中使用多种协议
* [VX 安装](/zh/docs/vx/installation) — 请先安装客户端


# 部署 REALITY / XHTTP 节点 (/zh/docs/tutorials/deploy-reality-xhttp)



VX 可在 VPS 上部署 **REALITY** 与 **XHTTP**（SplitHTTP）节点，无需手动编辑配置文件。在已连接的服务器上，使用 **Quick Deploy → Reality/XHTTP**：VX 会安装 Xray-core、写入入站配置、在需要时启用 BBR，并向客户端添加匹配的 **出站节点**，以便立即连接。

<Callout type="warn">
  若服务器上已安装 Xray，此部署配置**会替换现有的 Xray 配置**。
</Callout>

请观看下方视频，或在 [YouTube](https://www.youtube.com/watch?v=BW23h3-2T-A) 上打开。

本视频为中文讲解。

<YouTube id="BW23h3-2T-A" title="使用 VX Quick Deploy 部署 REALITY 与 XHTTP 节点" />

## 前置条件 [#前置条件]

* 可通过 **SSH** 访问的 Linux VPS（已在 VX 的 **Servers** 中添加）
* 用作 REALITY **destination** / SNI 目标的域名或站点（如视频所示）
* 可选：若通过 CDN 前置 XHTTP，需提供 **CDN 主机名**

## 相关文档 [#相关文档]

* [VX-core 面板](/zh/docs/vx/manual/vx-core-panel) — SSH 部署、服务控制与入站向导
* [VPS 监控](/zh/docs/vx/manual/vps-monitor) — 通过 SSH 查看服务器健康状态
* [REALITY](/zh/docs/vx-core/configuration/security/reality) — vx-core REALITY 设置
* [SplitHTTP (XHTTP)](/zh/docs/vx-core/configuration/transport/splithttp) — 传输参考
* [VX 安装](/zh/docs/vx/installation) — 请先安装客户端


# 导入订阅 (/zh/docs/tutorials/import-subscription)



**订阅** 是服务商托管的 URL。VX 会定期拉取订阅内容，并将其转换为可连接的节点。本教程面向尚不清楚如何在 VX 中导入订阅的用户。

请观看下方视频，或在 [YouTube](https://www.youtube.com/watch?v=rpGnbPtFMXI) 上打开。

本视频为中文讲解。

<YouTube id="rpGnbPtFMXI" title="如何在 VX 中导入订阅" />

## 相关文档 [#相关文档]

* [安装](/zh/docs/vx/installation) — 首次启动检查清单
* [深链](/zh/docs/vx/deep-linking) — 服务商一键订阅链接
* [VX 客户端概览](/zh/docs/vx) — 订阅与自动更新


# 教程 (/zh/docs/tutorials)



常见任务的分步教程。

<Cards>
  <Card title="导入订阅" href="/zh/docs/tutorials/import-subscription" description="通过粘贴、二维码、文件或深链添加订阅 URL" />

  <Card title="UWP 环回豁免（Windows）" href="/zh/docs/tutorials/windows-uwp-loopback" description="允许 Microsoft Store 应用通过 localhost 使用 VX" />

  <Card title="WARP 链式代理" href="/zh/docs/tutorials/warp-chain-proxy" description="在链式代理中将 WARP 用作最终落地节点" />

  <Card title="部署 REALITY / XHTTP" href="/zh/docs/tutorials/deploy-reality-xhttp" description="在 VX 服务器面板中通过 Quick Deploy 在 VPS 上部署" />

  <Card title="部署多协议" href="/zh/docs/tutorials/deploy-multi-protocol" description="All-in-One Quick Deploy — VMess、Trojan、AnyTLS、Hysteria 等" />

  <Card title="备份与同步" href="/zh/docs/tutorials/sync-and-backup" description="跨设备云同步与加密备份（Pro）" />

  <Card title="自定义路由（Netflix）" href="/zh/docs/tutorials/custom-routing" description="将 Netflix 流量路由到指定节点" />

  <Card title="启用 ECH" href="/zh/docs/tutorials/ech" description="在节点 TLS 设置中通过 DNS 自动查询并启用 ECH" />

  <Card title="Hysteria Realm 服务器" href="/zh/docs/tutorials/hysteria-realm" description="将 VX 作为 Hysteria Realm 服务器，供其他设备连接" />
</Cards>


# 备份与同步 (/zh/docs/tutorials/sync-and-backup)



**同步与备份** 可在手机与电脑之间保持 VX 配置一致，并在重装或换新设备后恢复。

请观看下方视频，或在 [YouTube](https://www.youtube.com/watch?v=afnmMWIqAP0) 上打开。

本视频为中文讲解。

<YouTube id="afnmMWIqAP0" title="VX 中的备份与同步" />

## 相关文档 [#相关文档]

* [同步与备份（手册）](/zh/docs/vx/manual/sync-and-backup) — 功能说明
* [VX 客户端概览](/zh/docs/vx) — Pro 与云功能
* [VX 安装](/zh/docs/vx/installation) — 请先安装客户端


# 链式代理：以 Warp 作为落地节点 (/zh/docs/tutorials/warp-chain-proxy)



**链式代理** 会按顺序将流量经过多个代理跳。本教程演示如何构建以 **Warp** 作为最终落地节点的链式代理。当你不信任首跳节点时，这可隐藏你的在线活动，使其不被首跳节点获知。也可用于在当前节点无法解锁某些网站时（例如 Gemini）进行访问。

请观看下方视频，或在 [YouTube](https://www.youtube.com/watch?v=TrdLZ5gS6pI) 上打开。

本视频为中文讲解。

<YouTube id="TrdLZ5gS6pI" title="VX 中的 WireGuard 链式代理" />

## 相关文档 [#相关文档]

* [WireGuard (vx-core)](/zh/docs/vx-core/configuration/protocols/wireguard) — `DeviceConfig` 与 `PeerConfig`
* [出站](/zh/docs/vx-core/configuration/outbounds) — 处理器标签与配置中的链式连接
* [选择器与节点链](/zh/docs/vx/manual/customize/selectors) — 所选节点之后的落地处理器
* [VX 安装](/zh/docs/vx/installation) — 请先安装客户端


# UWP 环回豁免（Windows） (/zh/docs/tutorials/windows-uwp-loopback)









在 Windows 上，**UWP 应用**（从 Microsoft Store 安装的应用）默认无法连接 `127.0.0.1` 及其他环回地址。该限制会导致在使用 VX 系统代理入站模式时，来自 Store 应用的流量无法进入 VX。

本教程说明如何 **解除 UWP 环回限制**，使 Store 应用在使用系统代理入站模式时也能被代理。若使用 TUN 模式，可跳过此步骤，因为 TUN 模式会处理所有网络流量。

<Tabs groupId="windows-uwp-loopback" items="['Video', 'Step-by-step']" defaultIndex="0">
  <Tab value="Video">
    请观看下方视频，或在 [YouTube](https://www.youtube.com/watch?v=xarHLgNEbkM) 上打开。

    本视频为中文讲解

    <YouTube id="xarHLgNEbkM" title="在 Windows 上解除 UWP 环回限制" />
  </Tab>

  <Tab value="Step-by-step">
    若偏好文字与截图，请按以下步骤操作。

    ### 1. 下载环回豁免工具 [#1-下载环回豁免工具]

    [https://telerik-fiddler.s3.amazonaws.com/fiddler/addons/enableloopbackutility.exe](https://telerik-fiddler.s3.amazonaws.com/fiddler/addons/enableloopbackutility.exe)

    ### 2. 安装环回豁免工具 [#2-安装环回豁免工具]

    ### 3. 打开环回豁免工具 [#3-打开环回豁免工具]

    以**管理员**身份运行 UWP 环回豁免工具（与视频中相同）。

    ### 4. 选择要豁免的应用 [#4-选择要豁免的应用]

        <img alt="选择要解除限制的应用" src="__img0" />

    ### 5. 点击「Save Changes」 [#5-点击save-changes]

        <img alt="点击「Save Changes」" src="__img1" />

    ### 7. 确认成功 [#7-确认成功]

        <img alt="若左下角显示已成功更新，则表示生效" src="__img2" />

    <Callout>
      若要撤销，请返回同一工具并移除这些应用的豁免。
    </Callout>
  </Tab>
</Tabs>

## 何时需要 [#何时需要]

* 在 Windows 上使用系统代理入站模式，且 **Microsoft Store** 应用无法被代理。

## 相关文档 [#相关文档]

* [VX 安装](/zh/docs/vx/installation) — 请先安装 Windows 客户端。


# 深链 (/zh/docs/vx/deep-linking)



VX 支持自定义 URL 方案，机场（代理服务商）主可让用户一键添加订阅。

## 格式 1：Base64 编码的订阅 URL [#格式-1base64-编码的订阅-url]

```
vx://add/sub://<base64_encoded_url>?remarks=<subscription_name>
```

**示例：**

```
vx://add/sub://aHR0cHM6Ly9leGFtcGxlLmNvbS9hYmNk?remarks=My%20Airport
```

订阅 URL 经 Base64 编码后放在 `sub://` 之后。`remarks` 参数设置显示名称（需 URL 编码）。

## 格式 2：带参数的直接 URL [#格式-2带参数的直接-url]

```
vx://install-config?url=<subscription_url>&name=<subscription_name>
```

**示例：**

```
vx://install-config?url=https%3A%2F%2Fexample.com%2Fabcd&name=My%20Airport
```

* `url`: 订阅 URL（需 URL 编码）
* `name`: 订阅的显示名称（需 URL 编码）

两种格式均会向 VX 客户端添加订阅。用户需已安装 VX，系统会提示在 VX 中打开链接。

## 机场主提示 [#机场主提示]

* 参数值务必进行 URL 编码（尤其非 ASCII 名称）
* 分发前在移动端与桌面端测试链接
* 为未安装 VX 的用户提供纯文本订阅 URL 作为备选
* 下载链接指向 [vx.5vnetwork.com](https://vx.5vnetwork.com)

## 二维码 [#二维码]

可将任一 URL 格式编码为二维码。VX 支持在添加订阅界面扫描订阅二维码。


# VX (/zh/docs/vx)



VX 是一款基于 [vx-core](https://github.com/5vnetwork/vx-core) 构建的跨平台代理客户端。

它支持所有主流平台，完全开源。所有功能均免费！（仅云同步面向付费用户）

所有 VX 版本均由 Github Actions 构建并发布。

<GitHubRepoButton repo="vx" />

## 支持的平台 [#支持的平台]

* Windows
* macOS
* Linux
* Android
* iOS

## 核心能力 [#核心能力]

* 完全开源，由 Github Actions 自动构建与发布
* 完全免费，仅在空白区域展示少量应用内广告
* 支持主流协议：VMESS、VLESS、Shadowsocks、Trojan、Hysteria2 等
* 订阅导入与节点自动更新
* 强大的基于规则的路由
* 智能节点选择
* 链式代理 — 通过多台代理服务器增强隐私
* 实时日志
* 实时统计与指标
* TUN 模式，无 DNS 泄漏
* 通过 SSH 部署与监控 VPS 服务器
* 云同步与备份
* Pro 用户客户支持
* 本地备份

请参阅[用户手册](/zh/docs/vx/manual)了解各功能的详细指南。


# 安装 (/zh/docs/vx/installation)



## 从官网下载 [#从官网下载]

访问 [vx.5vnetwork.com](https://vx.5vnetwork.com) 下载适用于您平台的最新版本。

支持的平台：

* **Windows** — 安装包或便携版
* **macOS** — 通用二进制（Apple Silicon 与 Intel）
* **Linux** — AppImage 或软件包
* **Android** — Google Play 或 APK
* **iOS** — App Store

## 首次启动 [#首次启动]

安装完成后：

1. 添加订阅或导入单个节点
2. 选择节点并点击 **连接**

## 添加订阅 [#添加订阅]

可通过以下方式添加订阅：

* 在 **出站 → 订阅 → 添加** 中粘贴订阅 URL
* 扫描二维码
* 从机场服务商打开[深链](/zh/docs/vx/deep-linking)

## 系统要求 [#系统要求]

### Windows [#windows]

* Windows 10 或更高版本
* TUN 模式建议使用管理员权限

### macOS [#macos]

* macOS 11 或更高版本
* TUN 模式需要网络扩展权限

### Linux [#linux]

* 现代基于 glibc 的发行版
* TUN 模式需要 root 权限

### Android / iOS [#android--ios]

* Android 7+ / iOS 15+
* TUN 模式需要 VPN 权限

## 从源码构建 [#从源码构建]

VX 是 Flutter 项目。你可以参考[Github workflow文件](https://github.com/5VNetwork/VX/tree/main/.github/workflows)来自行构建。

{/* 
  ```bash
  git clone https://github.com/5vnetwork/vx.git
  git clone https://github.com/5vnetwork/tm-plugin.git
  cd vx
  flutter pub get
  flutter run
  ``` */}

VX构建时需要 一些来自vx-core的文件，这些文件已发布在[Github Release](https://github.com/5VNetwork/vx-core/releases/tag/build)。
你可以直接用那些现成的文件。也可以自行构建，请参阅 [vx-core](/zh/docs/vx-core)。


# 概览 (/zh/docs/vx-core)



vx-core 是为 [VX](https://github.com/5vnetwork/vx)、[UmiVPN](https://github.com/5vnetwork/umivpn) 和 [努努加速器](https://github.com/5vnetwork/nunu) 提供能力的代理引擎。
也可在任何操作系统上作为独立代理服务器使用。

<GitHubRepoButton repo="vx-core" />

## 致谢 [#致谢]

vx-core 包含以下来源的代码：

* [v2ray-core](https://github.com/v2fly/v2ray-core)
* [Xray-core](https://github.com/XTLS/Xray-core)
* [hysteria](https://github.com/apernet/hysteria)
* [sing-box](https://github.com/SagerNet/sing-box)

## 部署模式 [#部署模式]

vx-core 根据平台在不同场景下运行：

* **Server**: 独立服务器程序
* **Client library**: 通过 gomobile/c-shared 绑定嵌入 VX

## 推荐部署方式 [#推荐部署方式]

建议使用 [VX 客户端](/zh/docs/vx) 在 VPS 上安装并配置 vx-core。客户端提供图形界面，可通过 SSH 部署服务器、编辑配置并监控。

若需手动部署服务器，请参阅[快速开始](/zh/docs/vx-core/quick-start)。

## 许可证 [#许可证]

请参阅 vx-core 仓库中的 [LICENSE](https://github.com/5vnetwork/vx-core/blob/main/LICENSE) 文件。部分目录（VLESS、REALITY、WireGuard 等）中的代码源自 Xray-core，按 MPL 2.0 分发。


# 快速开始 (/zh/docs/vx-core/quick-start)



本指南介绍在 Linux 上以服务器模式运行 vx-core。若希望通过图形界面部署，请改用 [VX 客户端的服务器面板](/zh/docs/vx/manual/vx-core-panel)。

## 前置条件 [#前置条件]

* Linux VPS（amd64 或 arm64）
* root 或 sudo 权限

## 脚本安装 [#脚本安装]

推荐使用官方安装脚本：

```bash
bash -c "$(curl -L https://github.com/5vnetwork/vx-install/raw/main/install-vx.sh)" @ install
```

该脚本会安装 `vx` 二进制文件并配置 systemd 服务。

## 手动配置 [#手动配置]

配置文件可为 protobuf 二进制或 ProtoJSON 格式的 JSON。创建 `config.json`：

```json
{
  "inbounds": [
    {
      "tag": "vmess",
      "ports": [10000],
      "protocol": {
        "@type": "type.googleapis.com/vx.proxy.vmess.VmessServerConfig",
        "secureEncryptionOnly": true
      }
    }
  ],
  "router": {
    "rules": [
      {
        "matchAll": true,
        "outboundTag": "direct"
      }
    ]
  },
  "outbounds": [
    {
      "tag": "direct",
      "protocol": {
        "@type": "type.googleapis.com/vx.proxy.freedom .FreedomConfig"
      }
    }
  ]
}
```

完整服务器配置模式定义于 [`protos/proto/vx/server.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/server.proto)。各配置节说明见[配置](/zh/docs/vx-core/configuration)。

## 运行服务器 [#运行服务器]

```bash
vx run --config config.json
```

若通过安装脚本安装，可使用 systemd 管理服务：

```bash
systemctl start vx
systemctl enable vx
systemctl status vx
```

## 默认配置路径 [#默认配置路径]

通过安装脚本安装后，配置文件位于：

```
/usr/local/etc/vx/config.json
```

## 下一步 [#下一步]

* 参阅[配置](/zh/docs/vx-core/configuration)了解配置文件细节
* 在[协议](/zh/docs/vx-core/configuration/protocols)中为不同协议添加更多入站
* 使用 VX 远程部署并管理服务器


# 自动节点选择 (/zh/docs/vx/manual/automatic-node-selection)



**Pro 功能** — 根据延迟测试与健康检查，从一组节点中自动选择最佳节点。

## 代理选择器模式 [#代理选择器模式]

* `手动`: 您选择单个节点，或在已选节点间负载均衡
* `自动`: VX 定期测试节点并切换到当前最佳可用节点

## 自动选择 [#自动选择]

在自动模式下，VX 对配置的节点进行 RTT/延迟测试，并选择最快且健康的节点。若当前节点性能下降，选择器会自动切换，无需断开连接。

可配置：

* 测试间隔与超时
* 参与测试的订阅或标签
* 所有节点失败时的回退行为

## 手动多节点（Pro） [#手动多节点pro]

手动模式还支持选择 **多个** 节点并配合负载策略：

* **随机** — 随机分配连接
* **轮询** — 依次轮换节点
* **最低延迟** — 每条连接优先使用最快节点

## 免费版 [#免费版]

免费用户仅可使用手动单节点选择。升级 Pro 可使用自动选择与多节点负载均衡。

## 相关 [#相关]

* [选择器](/zh/docs/vx/manual/customize/selectors) — 配置选择器筛选与策略
* [路由模式](/zh/docs/vx/manual/customize/modes) — 将选择器分配给路由规则


# 客户支持 (/zh/docs/vx/manual/customer-support)



## 联系方式 [#联系方式]

在 **设置 → 联系** 中联系支持。

## 日志上传 [#日志上传]

排查连接或路由问题时，可直接从应用上传日志。

上传日志：

1. 在启用日志的情况下复现问题
2. 前往 **设置 → 联系** 或日志上传选项
3. 提交 — 日志会安全发送至支持后端

## 联系支持前 [#联系支持前]

建议提供以下信息：

* VX 版本与平台
* 连接模式（TUN 与系统代理）
* 问题是否影响所有节点或单个订阅
* 从实时日志视图导出的日志

## 机场主 [#机场主]

若向 VX 用户分发订阅，请参阅[深链](/zh/docs/vx/deep-linking)集成文档。


# 主页 (/zh/docs/vx/manual/home)



**主页** 标签页是控制中心，帮助您更便捷管理网络的组件。

VX 提供两种主页布局。点击顶部栏的 **编辑** 图标可在两者之间切换，或调整可见组件。

## 布局模式 [#布局模式]

* **标准**: 固定结构，各组件可单独显示/隐藏
* **可自定义**: 拖放布局、多列、按订阅分块

在 **手机** 上，组件单列堆叠。在 **较宽屏幕**（平板/桌面）上，标准布局分为两列或三列。

***

## 统计组件 [#统计组件]

这四个磁贴位于 **标准** 布局顶部（或在可自定义模式中您放置的位置），连接时实时更新。

可在设置页配置统计采样频率，默认间隔为 3 秒。

> **提示：** 若四个统计组件均隐藏，VX 会停止统计流以节省资源。

### 上传 [#上传]

以可读单位（如 KB/s、MB/s）显示所有隧道流量的当前 **上传速度**。

* **点击** 磁贴可在数字与 **历史图表** 之间切换

### 下载 [#下载]

与上传相同，但显示 **下载速度**。

### 内存 [#内存]

显示代理运行时的 **vx-core 内存占用**。

仅显示隧道进程内存，不含 UI 进程。VX在启动连接时有两个进程：一个处理所有网络流量的隧道进程，另一个是已打开的 VX 应用 UI 进程。

通常在 30MB 至 100MB 之间。

### 连接数 [#连接数]

显示 vx-core 处理的 **活跃代理连接数**。

***

## 当前 / 活跃节点 [#当前--活跃节点]

根据是否连接，显示内容不同

* `未连接（手动模式）` : 您在代理选择器中 **已选择** 的节点
* `已连接` : **正在使用** 的节点

  实时观测速度与延迟

  * **速率** — 经该节点路由流量的实时吞吐量（基于约 10 KB 的小样本下载）。连接时显示，数值越大越好。
  * **延迟** — 经该节点往返响应时间（毫秒），反映当前路径质量，数值越小越好。

***

## 节点助手 [#节点助手]

标签：**节点助手**（推荐节点）。

快速挑选优质节点，无需浏览完整出站列表。三个标签页：

* **速度**: 按最近测速排前 10 的节点
* **延迟**: 按最低 ping 排前 10 的节点
* **最近**: 最近使用过的节点

> **提示：** 点击每行统计数据可触发速度与延迟测试。

***

## 模式 [#模式]

标签：**模式**。

一键切换当前 **路由配置**。每个选项为一个已保存的路由模式。

* 悬停/长按默认模式可查看简短说明

管理模式请点击 **自定义** 标签。参见[自定义](/zh/docs/vx/manual/customize)。

***

## 代理选择器 [#代理选择器]

标签：**代理**。

选择器根据您的偏好选择节点。默认有一个名为 **代理** 的选择器。

默认路由模式用它为代理流量选择节点。

代理节点选择器较特殊，支持手动模式：在节点页通过开关选择要使用的节点。其他选择器不支持此模式。

详见[节点选择器](/zh/docs/vx/manual/automatic-node-selection)了解选择器详解。

***

## 入站 [#入站]

标签：**入站**。

在 **桌面**（Windows、macOS、Linux）上选择流量如何 **进入** vx-core：

* **TUN**: 通过虚拟网卡系统级捕获。该模式接管所有非本地网络流量
* **系统代理**: 将系统 HTTP/SOCKS 代理设为 localhost。该模式直接管部分流量

Android/iOS 不显示 — 这些平台始终使用 TUN 模式。

***

## 订阅 [#订阅]

显示 **最近添加的订阅** 或 **星标订阅** 的组件。

> **提示：** 点击可更新订阅。

***

## 自定义主屏幕 [#自定义主屏幕]

在自定义布局中，可添加更多订阅组件与选择器组件；右键订阅卡片或点击选择器组件菜单即可看到相应按钮。

***

***

## 相关 [#相关]

* [功能概览](/zh/docs/vx/manual/multi-protocol) — 支持的协议与传输方式


# 用户手册 (/zh/docs/vx/manual)



本节为 **VX 用户手册** — 介绍界面与各功能。

<Cards>
  <Card title="主页组件" href="/zh/docs/vx/manual/home" description="统计、节点、路由与可自定义布局" />

  <Card title="自定义页" href="/zh/docs/vx/manual/customize" description="简化与高级路由、集合、选择器、DNS" />

  <Card title="多协议支持" href="/zh/docs/vx/manual/multi-protocol" description="VMESS、VLESS、Shadowsocks、Trojan、Hysteria2 等" />

  <Card title="同步与备份" href="/zh/docs/vx/manual/sync-and-backup" description="跨设备云同步（Pro）" />

  <Card title="VPS 监控" href="/zh/docs/vx/manual/vps-monitor" description="通过 SSH 远程监控服务器健康状态" />

  <Card title="VX-core 面板" href="/zh/docs/vx/manual/vx-core-panel" description="从客户端部署与管理 vx-core" />

  <Card title="客户支持" href="/zh/docs/vx/manual/customer-support" description="应用内帮助与日志上传" />

  <Card title="代理共享" href="/zh/docs/vx/manual/proxy-share" description="使局域网其他设备使用VX" />
</Cards>


# 支持的协议 (/zh/docs/vx/manual/multi-protocol)



VX 通过 vx-core 支持主流代理协议。

## 支持的协议 [#支持的协议]

* `VMESS`: AEAD 加密，服务商广泛支持
* `VLESS`: 降低 TLS-in-TLS 指纹
* `Shadowsocks`: 经典协议，支持多种加密方式
* `Shadowsocks2022`: 改进版 Shadowsocks 协议
* `Trojan`: TLS 封装，适合伪装流量
* `Hysteria2`: 基于 QUIC，针对高速链路优化
* `SOCKS5`: 标准 SOCKS 代理
* `HTTP`: HTTP CONNECT 代理
* `AnyTLS`: 降低 TLS-in-TLS 指纹
* `WireGuard`: 流行的 VPN 协议

## 传输层 [#传输层]

许多协议支持额外传输层：

* TCP、WebSocket、gRPC
* HTTPUpgrade / SplitHTTP
* KCP
* TLS、uTLS、REALITY

## 相关 [#相关]

* [协议参考](/zh/docs/vx-core/configuration/protocols) — vx-core 完整协议列表
* [导入订阅](/zh/docs/tutorials/import-subscription) — 从机场 URL 添加节点


# HTTP/SOCKS 服务器 (/zh/docs/vx/manual/proxy-share)



VX 可暴露本地 HTTP 和/或 SOCKS5 服务器，让网络上其他设备或应用使用同一代理连接。

## 代理共享模式 [#代理共享模式]

启用后，vx-core 在可配置的地址与端口监听，接受 HTTP CONNECT 与 SOCKS5 连接。这些客户端的流量与 VX 应用本身使用相同的出站与规则路由。

## 使用场景 [#使用场景]

* 与局域网内的其他设备通过本机的VX科学上网

## 设置 [#设置]

* 监听地址（默认 0.0.0.0）
* 端口（固定或动态分配）

## 安全说明 [#安全说明]

绑定到 `0.0.0.0` 会将代理暴露给本地网络。仅在可信网络上启用局域网共享。


# 同步与备份 (/zh/docs/vx/manual/sync-and-backup)



**Pro 功能** — 在设备间同步节点、路由规则、服务器配置与选择器设置，并可选加密云备份。

## 同步 [#同步]

使用 Pro 账户登录后，VX 通过 Supabase 同步更改：

* `节点与订阅`: 可选
* `路由规则与模式`: 可选
* `服务器 SSH 配置`: 可选
* `代理选择器设置`: 可选

一台设备上的更改会传播到其他设备。同步定期执行，也可按需触发。推送通知（若可用）可触发实时同步。

## 加密 [#加密]

同步数据使用您设置的密码加密。密码存储在设备安全存储中。

## 备份 [#备份]

创建完整配置的加密备份：

* 上传到与账户关联的云存储
* 在新设备或重装后恢复
* 可设置单独的备份密码

备份只会备份储存在数据库中的数据，包括节点、订阅、模式、选择器、集合、DNS，不包括其他偏好设置。

## 启用同步 [#启用同步]

前往 **设置 → 同步与备份**，登录，设置同步密码，并选择要同步的类别。


# VPS 监控 (/zh/docs/vx/manual/vps-monitor)



**服务器** 标签页可让您通过 SSH 连接 Linux VPS，并实时监控 vx-core 运行时状态。

## 监控指标 [#监控指标]

* **已安装** — 服务器上是否存在 vx-core
* **版本** — 运行中的 vx-core 版本
* **运行时间** — 服务启动时间
* **内存** — 当前内存占用

## 服务器操作 [#服务器操作]

在同一面板中可：

* 关闭或重启 VPS
* 启动、停止或重启 vx-core 服务
* 安装、更新或卸载 vx-core

## 设置 [#设置]

添加服务器时提供 SSH 凭据（主机、端口、用户名、密钥或密码）。VX 将VPS密码等机密加密存储在本地。

## 相关 [#相关]

* [VX-core 面板](/zh/docs/vx/manual/vx-core-panel) — 编辑服务器配置
* [vx-core 快速开始](/zh/docs/vx-core/quick-start) — 手动服务器设置


# vx-core 面板 (/zh/docs/vx/manual/vx-core-panel)



VX 中的服务器面板是在 Linux VPS 上部署与配置 vx-core 的推荐方式 — 无需 SSH 终端或手动编辑 JSON。

## 快捷部署 [#快捷部署]

在服务器面板中通过 **SSH** 连接 VPS 后，可使用 **快捷部署** 一键安装核心、部署节点，启用 **BBR** 。部署完成后，VX 会自动将对应节点添加到客户端，便于立即连接。

面板提供三种预设方案，按目标核心与协议组合区分：

### 应有尽有（All-in-One） [#应有尽有all-in-one]

推荐使用此方案，因为你可以在VX内配置vx-core的入站。此方案在443端口部署多协议节点。支持CDN节点与Reality节点。

* **安装**：vx-core
* **入站组合**：(VMess、Trojan、AnyTLS) × (WebSocket、gRPC) × (TLS、REALITY) + Hysteria2
* **可选**：REALITY 目标域名、CDN 主机名（用于 WebSocket + TLS 前置）

分步视频教程见 [一次部署多种协议](/zh/docs/tutorials/deploy-multi-protocol)。

### 双核四协议 [#双核四协议]

如果你不想使用vx内核，你可以使用这个方案。该方案既会在443端口部署伪装节点，也会在高位端口部署节点，防止443端口被封。

* **安装**：Xray-core、Hysteria
* **入站**：
  * VMess — 五个随机端口
  * Shadowsocks — 五个随机端口
  * Hysteria — 443 端口
  * VLESS XTLS Vision — 443 端口

若服务器上已安装 Xray 或 Hysteria，**原有配置将被替换**。若未开启 BBR，部署时会尝试开启。

### Reality / XHTTP [#reality--xhttp]

面向需要 **REALITY** 与 **XHTTP**（SplitHTTP）伪装入站的场景，基于 **Xray-core**。

* **安装**：Xray-core
* **入站**：REALITY 与 XHTTP（SplitHTTP）组合

若服务器上已安装 Xray，**原有 Xray 配置将被替换**。若未开启 BBR，部署时会尝试开启。
部署 REALITY 时通常需要指定用作 destination / SNI 的目标站点。

分步视频教程见 [部署 REALITY / XHTTP](/zh/docs/tutorials/deploy-reality-xhttp)。

<Callout type="warn">
  **双核四协议** 与 **Reality / XHTTP** 会覆盖服务器上已有的 Xray 或 Hysteria 配置。部署前请确认 VPS 上无需要保留的手动配置；已有 vx-core 且仅需增删入站时，可使用下方的 **入站向导** 或 **配置编辑**。
</Callout>

<Callout type="info">
  VX快捷部署的节点都会使用自签证书，并启用 SHA256 对等验证以防止MITM。若未开启 BBR，部署时会尝试开启。
</Callout>

## 配置编辑 [#配置编辑]

在应用中直接查看并编辑 `/usr/local/etc/vx/config.json`。更改通过 SSH 推送，服务会自动重启。

## 服务控制 [#服务控制]

* `安装`: 下载并安装 vx-core
* `更新`: 升级到最新版本
* `启动 / 停止 / 重启`: 控制 systemd 服务
* `卸载`: 从服务器移除 vx-core

## 入站向导 [#入站向导]

通过引导流程添加入站 — 选择协议、端口与安全选项。VX 生成正确的 ProtoJSON 配置并应用到服务器。

## 相关 [#相关]

* [部署 REALITY / XHTTP](/zh/docs/tutorials/deploy-reality-xhttp) — Reality/XHTTP 快捷部署教程
* [一次部署多种协议](/zh/docs/tutorials/deploy-multi-protocol) — All-in-One 快捷部署教程
* [VPS 监控](/zh/docs/vx/manual/vps-monitor) — 运行时状态
* [配置](/zh/docs/vx-core/configuration) — 配置文件参考


# 出站工厂 (/zh/docs/vx-core/configuration/dialer-factory)



所有的出站都将由此工厂生成。
模式定义：[`protos/proto/vx/dialerfactory/dialerfactory.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/dialerfactory/dialerfactory.proto)。

被用于`ServerConfig.dialerFactory`。

## DialerFactoryConfig [#dialerfactoryconfig]

<ProtoField name="dialTimeout" type="uint32">
  连接超时（秒）
</ProtoField>

<ProtoField name="shouldBindDevice" type="bool">
  将Socket绑定到默认物理网络NIC
</ProtoField>

<ProtoField name="resolveDomain" type="bool">
  拨号解析域名时使用 [内部DNS解析器](/zh/docs/vx-core/configuration/dns) `internalResolver`
</ProtoField>

## 示例 [#示例]

```json
{
  "dialerFactory": {
    "dialTimeout": 10,
    "shouldBindDevice": false,
    "resolveDomain": true
  }
}
```

## 相关 [#相关]

* [出站](/zh/docs/vx-core/configuration/outbounds) — `address`、`domainStrategy`、端口
* [DNS](/zh/docs/vx-core/configuration/dns) — `internalResolver`


# 调度器 (/zh/docs/vx-core/configuration/dispatcher)



调度器在 `ServerConfig.dispatcher`（`DispatcherConfig`）中配置。模式定义：[`protos/proto/vx/dispatcher/dispatcher.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/dispatcher/dispatcher.proto)。

所有的入站，DNS服务器的流量都会经过调度器。调度器会通过路由来选择一个节点，然后把流量交给此节点处理。

## DispatcherConfig [#dispatcherconfig]

<ProtoField name="destinationOverride" type="string[]">
  非空时嗅探连接，协议匹配时用嗅探域名覆盖目标
</ProtoField>

<ProtoField name="sniff" type="bool">
  嗅探所有的连接，以获取额外连接元数据，这些数据可以使日志更全面
</ProtoField>

<ProtoField name="fallbackTimeout" type="uint32">
  等待响应数据的时长（毫秒），若此时间内没有收到响应数据，将连接视为失败，开始回退
</ProtoField>

<ProtoField name="sessionStats" type="bool">
  启用会话计量统计，日志内会显示
</ProtoField>

## 示例 [#示例]

```json
{
  "dispatcher": {
    "sniff": true,
    "destinationOverride": ["http", "tls"],
    "sessionStats": false
  }
}
```

## 相关 [#相关]

* [路由](/zh/docs/vx-core/configuration/router) — `skipSniff`、`protocols`、嗅探后的域名规则
* [DNS](/zh/docs/vx-core/configuration/dns) — 使用 `resolveDomain` 规则时的解析


# DNS (/zh/docs/vx-core/configuration/dns)



DNS 在 `ServerConfig.dns`（`DnsConfig`）中配置。模式定义：[`protos/proto/vx/dns/dns.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/dns/dns.proto)。

`dnsServers` 定义具名上游；`concurrentDnsServers` / `serialDnsServers` 可将多个上游组合为新的具名服务器；`internalResolver` 与 `requestDomainResolver` 通过**名称**引用这些服务器。`dnsHijack` 为被劫持的 DNS 查询选择上游。

## DnsConfig [#dnsconfig]

<ProtoField name="records" type="Record[]">
  静态域名记录，在查询其他上游之前由本地静态服务器应答。
</ProtoField>

<ProtoField name="recordStrings" type="string[]">
  以标准 DNS RR 文本格式编写的静态记录（如 `www.example.com. 3600 IN A 192.0.2.1`），与 `records` 等效，便于粘贴整行记录。
</ProtoField>

<ProtoField name="dnsServers" type="DnsServerConfig[]">
  具名 DNS 上游定义。每条须设置唯一的 `name` 及一种服务器类型（`type` oneof）。
</ProtoField>

<ProtoField name="internalResolver" type="Resolver">
  出站**拨号**时解析域名所用的解析器。
</ProtoField>

<ProtoField name="requestDomainResolver" type="Resolver">
  **路由**与**调度器**解析请求域名时使用的解析器。
</ProtoField>

<ProtoField name="concurrentDnsServers" type="ConcurrentDnsServer[]">
  将多个已定义的 DNS 服务器并行查询，组合为新的具名服务器。
</ProtoField>

<ProtoField name="serialDnsServers" type="SerialDnsServer[]">
  按顺序尝试多个已定义的 DNS 服务器，组合为新的具名服务器。
</ProtoField>

<ProtoField name="dnsHijack" type="DnsHijackConfig">
  DNS 劫持。
</ProtoField>

## Record [#record]

<ProtoField name="domain" type="string">
  主机名
</ProtoField>

<ProtoField name="ip" type="string[]">
  静态 IP 应答。IPv4 生成 A 记录，IPv6 生成 AAAA 记录。
</ProtoField>

<ProtoField name="proxiedDomain" type="string">
  非空时为本域生成指向 `proxiedDomain` 的 CNAME，而非直接返回 `ip`。
</ProtoField>

## Resolver [#resolver]

解析器通过 `dnsServers` 中的**名称**引用 `DnsServerConfig`、`ConcurrentDnsServer` 或 `SerialDnsServer`。多个名称时按串行方式依次尝试。

<ProtoField name="dnsServers" type="string[]">
  要使用的具名 DNS 服务器列表
</ProtoField>

<ProtoField name="interval" type="uint32">
  串行尝试时，两次查询之间的等待时间（**秒**）
</ProtoField>

<ProtoField name="name" type="string">
  解析器名称
</ProtoField>

## ConcurrentDnsServer [#concurrentdnsserver]

<ProtoField name="dnsServers" type="string[]">
  并行查询的具名 DNS 服务器名称
</ProtoField>

<ProtoField name="name" type="string">
  组合服务器的名称，供 `Resolver.dnsServers` 与 `DnsRuleConfig.dnsServerName` 引用
</ProtoField>

## SerialDnsServer [#serialdnsserver]

<ProtoField name="dnsServers" type="string[]">
  按顺序尝试的具名 DNS 服务器名称
</ProtoField>

<ProtoField name="interval" type="uint32">
  当前服务器失败后，等待多久再尝试下一个（**秒**）
</ProtoField>

<ProtoField name="name" type="string">
  组合服务器的名称
</ProtoField>

## DnsServerConfig [#dnsserverconfig]

每条服务器有唯一的 `name`。

`plainDnsServer`、`tlsDnsServer`、`dohDnsServer`、`quicDnsServer`、`fakeDnsServer`、
`goDnsServer`、`emptyDnsServer` 只能指定其中一项。

<ProtoField name="name" type="string">
  服务器名称；被解析器、组合服务器与 DNS 规则引用

  不可以使用`hijack`作为名称
</ProtoField>

<ProtoField name="plainDnsServer" type="PlainDnsServer">
  传统 UDP DNS（可选 TCP）
</ProtoField>

<ProtoField name="tlsDnsServer" type="TlsDnsServer">
  DNS over TLS (DoT)
</ProtoField>

<ProtoField name="dohDnsServer" type="DohDnsServer">
  DNS over HTTPS (DoH)
</ProtoField>

<ProtoField name="quicDnsServer" type="QuicDnsServer">
  DNS over QUIC (DoQ)
</ProtoField>

<ProtoField name="fakeDnsServer" type="FakeDnsServer">
  Fake IP 池，为匹配域名分配假地址
</ProtoField>

<ProtoField name="goDnsServer" type="GoDnsServer">
  Go 标准库系统解析器
</ProtoField>

<ProtoField name="emptyDnsServer" type="EmptyDnsServer">
  空解析器，不返回上游结果
</ProtoField>

<ProtoField name="clientIp" type="string">
  EDNS 客户端子网（ECS）中发送的客户端 IP
</ProtoField>

<ProtoField name="cacheDuration" type="uint32">
  应答缓存时长（**秒**）。`0` 时使用应答中的最小 TTL。
</ProtoField>

<ProtoField name="ipTags" type="string[]">
  仅保留落在这些 [geo](/zh/docs/vx-core/configuration/geo) IP 集合内的应答地址；其余 IP 会被丢弃
</ProtoField>

### PlainDnsServer [#plaindnsserver]

<ProtoField name="addresses" type="string[]">
  上游地址，格式 `host:port`（通常端口 `53`）
</ProtoField>

<ProtoField name="useDefaultDns" type="bool">
  `true` 时使用系统默认网卡的 DNS 服务器；网卡 DNS 变化时自动更新。无可用系统 DNS 时回退到 `addresses`。
</ProtoField>

### TlsDnsServer [#tlsdnsserver]

<ProtoField name="addresses" type="string[]">
  DoT 上游地址，格式 `host:port`（通常端口 `853`）
</ProtoField>

### DohDnsServer [#dohdnsserver]

<ProtoField name="url" type="string">
  DoH 端点 URL（如 `https://dns.google/dns-query`）
</ProtoField>

### QuicDnsServer [#quicdnsserver]

<ProtoField name="address" type="string">
  DoQ 上游地址（`host:port`）
</ProtoField>

### FakeDnsServer [#fakednsserver]

<ProtoField name="poolConfigs" type="PoolConfig[]">
  Fake IP 地址池配置。同一 IP 版本（IPv4 / IPv6）不宜配置多个重叠池。
</ProtoField>

#### PoolConfig [#poolconfig]

<ProtoField name="cidr" type="string">
  假 IP 地址池的 CIDR（如 `198.18.0.0/15`）
</ProtoField>

<ProtoField name="lruSize" type="uint32">
  池内域名 → 假 IP 映射的 LRU 容量
</ProtoField>

### GoDnsServer [#godnsserver]

使用操作系统 / Go 默认解析路径。它的流量不经过调度器，直接发出。本类型通常用于服务端

### EmptyDnsServer [#emptydnsserver]

永远返回空解析。

## DnsHijackConfig [#dnshijackconfig]

<ProtoField name="dnsRules" type="DnsRuleConfig[]">
  按域名、集合与查询类型将劫持的 DNS 请求路由到指定 `dnsServerName`。规则按顺序匹配。
</ProtoField>

若有此配置，那么一个叫 `hijack` 的DNS Server将被添加。同时，一个名为 `dns` 的出站将被添加，这样就可以在
路由规则中指定 `dns` 出站来劫持DNS流量

## DnsRuleConfig [#dnsruleconfig]

<ProtoField name="dnsServerName" type="string">
  目标 `DnsServerConfig.name`（或组合服务器名称）
</ProtoField>

<ProtoField name="geoDomains" type="Domain[]">
  匹配查询名
</ProtoField>

<ProtoField name="domainTags" type="string[]">
  匹配属于这些 [geo](/zh/docs/vx-core/configuration/geo) 域名集合的查询名
</ProtoField>

<ProtoField name="includedTypes" type="DnsType[]">
  限制的查询类型。
</ProtoField>

<ProtoField name="ruleName" type="string">
  调试与展示用标签
</ProtoField>

### DnsType [#dnstype]

proto 定义的 DNS 查询类型枚举，包括 `DnsType_A`、`DnsType_AAAA`、`DnsType_CNAME`、`DnsType_HTTPS`、`DnsType_ANY` 等。

## 示例 [#示例]

静态记录 + 直连 DoH + 劫持规则：

```json
{
  "dns": {
    "records": [
      { "domain": "internal.example", "ip": ["10.0.0.1"] }
    ],
    "dnsServers": [
      {
        "name": "doh",
        "dohDnsServer": { "url": "https://dns.google/dns-query" }
      }
    ],
    "internalResolver": {
      "dnsServers": ["doh"]
    },
    "requestDomainResolver": {
      "dnsServers": ["doh"]
    },
    "dnsHijack": {
      "enableFakeDns": true,
      "dnsRules": [
        {
          "dnsServerName": "doh",
          "domainTags": ["gfw"],
          "includedTypes": ["DnsType_A", "DnsType_AAAA"],
          "ruleName": "proxy-dns"
        }
      ]
    }
  }
}
```

## 相关 [#相关]

* [Geo](/zh/docs/vx-core/configuration/geo) — 规则与服务器上的 `domainTags`、`ipTags`
* [路由](/zh/docs/vx-core/configuration/router) — `fakeIp` 与域名解析规则
* [拨号器工厂](/zh/docs/vx-core/configuration/dialer-factory) — `useInternalResolver`


# Geo (/zh/docs/vx-core/configuration/geo)



地理数据集合在 `ServerConfig.geo`（`GeoConfig`）中定义。模式定义：[`protos/proto/vx/geo/geo.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/geo/geo.proto)。

**原子集合**（`atomic*`）直接持有域名、IP 或应用 ID。**大集合**（`great*`）通过 `inNames` / `exNames` 组合其他集合。大集合与原子集合的 `name` 在同一类别内须唯一。

[路由](/zh/docs/vx-core/configuration/router)与 [DNS](/zh/docs/vx-core/configuration/dns) 通过 `domainTags`、`dstIpTags`、`srcIpTags`、`appTags` 按**名称**引用集合。客户端 UI 说明见[集合](/zh/docs/vx/manual/customize/sets)。

## GeoConfig [#geoconfig]

<ProtoField name="greatDomainSets" type="GreatDomainSetConfig[]">
  组合域名集合（包含 / 排除其他集合）
</ProtoField>

<ProtoField name="atomicDomainSets" type="AtomicDomainSetConfig[]">
  原子域名集合（内联域名、geosite、Clash 规则、远程文件等）
</ProtoField>

<ProtoField name="greatIpSets" type="GreatIPSetConfig[]">
  大IP集合
</ProtoField>

<ProtoField name="atomicIpSets" type="AtomicIPSetConfig[]">
  小IP集合
</ProtoField>

<ProtoField name="appSets" type="AppSetConfig[]">
  应用集合
</ProtoField>

各类别内名称须唯一（`greatDomainSets` 与 `atomicDomainSets` 之间不可重名，IP 集合同理）。

## Domain [#domain]

单条域名匹配规则。定义于 [`protos/proto/vx/common/geo/geo.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/common/geo/geo.proto)。

用于 [路由](/zh/docs/vx-core/configuration/router) 的 `geoDomains`、[DNS](/zh/docs/vx-core/configuration/dns) 的 `geoDomains`，以及 [AtomicDomainSetConfig](#atomicdomainsetconfig) 的 `domains`。

<ProtoField name="type" type="Domain.Type">
  匹配方式：

  * `Plain`：子串匹配（关键词）
  * `Regex`：正则匹配
  * `RootDomain`：根域及其子域（后缀匹配）
  * `Full`：完整主机名精确匹配
</ProtoField>

<ProtoField name="value" type="string">
  要匹配的域名或模式
</ProtoField>

## CIDR [#cidr]

单条 IP 网段。定义于 [`protos/proto/vx/common/geo/geo.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/common/geo/geo.proto)。

用于 [AtomicIPSetConfig](#atomicipsetconfig) 的 `cidrs`。

<ProtoField name="ip" type="bytes">
  IP 地址，4 字节（IPv4）或 16 字节（IPv6）。ProtoJSON 中通常为 base64 编码。
</ProtoField>

<ProtoField name="prefix" type="uint32">
  网络前缀长度（CIDR 掩码位数，如 `24` 表示 `/24`）
</ProtoField>

## AtomicDomainSetConfig [#atomicdomainsetconfig]

小域名集合。`domains`、`geosite`、`geosites`、`clashFiles`、`remoteGeoFiles` 可组合使用。

<ProtoField name="name" type="string">
  集合名称，供 `domainTags` 引用
</ProtoField>

<ProtoField name="domains" type="Domain[]">
  内联 [Domain](#domain) 列表
</ProtoField>

<ProtoField name="geosite" type="GeositeConfig">
  从单个 geosite 配置加载域名
</ProtoField>

<ProtoField name="geosites" type="GeositeConfig[]">
  从多个 geosite 配置加载域名（与 `geosite` 可同时使用）
</ProtoField>

<ProtoField name="useBloomFilter" type="bool">
  对大集合启用布隆过滤器以降低内存占用（常见于 iOS）。有约 1% 误报率。
</ProtoField>

<ProtoField name="clashFiles" type="string[]">
  Clash 格式规则文件路径，从中提取域名规则
</ProtoField>

<ProtoField name="inverse" type="bool">
  反向匹配：域名**不在**本集合源中时才匹配
</ProtoField>

<ProtoField name="remoteGeoFiles" type="GeoRemoteFile[]">
  定时从 HTTPS 下载的远程 geo 文件（见 [GeoRemoteFile](#georemotefile)）
</ProtoField>

## GeositeConfig [#geositeconfig]

从 `geosite.dat`（或兼容格式）按分类代码加载域名。

<ProtoField name="codes" type="string[]">
  geosite 分类代码（如 `cn`、`gfw`、`private`）
</ProtoField>

<ProtoField name="attributes" type="string[]">
  在已加载域名中按 `Domain.attribute.key` 进一步筛选（不区分大小写）
</ProtoField>

<ProtoField name="filepath" type="string">
  本地 `geosite.dat` 路径
</ProtoField>

<ProtoField name="remoteUrl" type="string">
  远程 `geosite.dat` 的 HTTPS URL；配合 `refreshCron` 定时更新。将下载至`filepath`
</ProtoField>

<ProtoField name="refreshCron" type="string">
  5 段 cron（分 时 日 月 周）。空表示仅在启动 / 重载时拉取
</ProtoField>

## AtomicIPSetConfig [#atomicipsetconfig]

小IP集合。`cidrs`、`geoip`、`clashFiles`、`remoteGeoFiles` 可组合使用。

<ProtoField name="name" type="string">
  集合名称，供 `dstIpTags`、`srcIpTags`、`ipTags` 引用
</ProtoField>

<ProtoField name="cidrs" type="CIDR[]">
  内联 [CIDR](#cidr) 列表
</ProtoField>

<ProtoField name="geoip" type="GeoIPConfig">
  从 geoip 文件按国家/地区代码加载 CIDR
</ProtoField>

<ProtoField name="inverse" type="bool">
  反向匹配：IP **不在**本集合源中时才匹配
</ProtoField>

<ProtoField name="clashFiles" type="string[]">
  Clash 格式规则文件路径，从中提取 IP / CIDR 规则
</ProtoField>

<ProtoField name="remoteGeoFiles" type="GeoRemoteFile[]">
  定时下载的远程 geo 文件
</ProtoField>

## GeoIPConfig [#geoipconfig]

从 `geoip.dat`（或兼容格式）按代码加载 IP 段。

<ProtoField name="codes" type="string[]">
  geoip 分类 / 国家代码（如 `cn`、`private`）
</ProtoField>

<ProtoField name="filepath" type="string">
  本地 `geoip.dat` 路径
</ProtoField>

<ProtoField name="remoteUrl" type="string">
  远程 `geoip.dat` 的 HTTPS URL
</ProtoField>

<ProtoField name="refreshCron" type="string">
  5 段 cron。空表示仅在启动 / 重载时拉取
</ProtoField>

## GreatDomainSetConfig [#greatdomainsetconfig]

大域名集合，不直接持有域名，而是引用其他原子或大域名集合。

匹配逻辑：先检查 `exNames`（命中则**不匹配**），再检查 `inNames`（命中任一则**匹配**）。

<ProtoField name="name" type="string">
  组合集合名称
</ProtoField>

<ProtoField name="oppositeName" type="string">
  互斥配对集合名称。见 [集合](/zh/docs/vx/manual/customize/sets) 中的互斥集合说明
</ProtoField>

<ProtoField name="inNames" type="string[]">
  包含这些集合中的域名（命中任一即匹配）
</ProtoField>

<ProtoField name="exNames" type="string[]">
  排除这些集合中的域名（命中任一则不匹配）
</ProtoField>

不可在 `inNames` 或 `exNames` 中包含自身 `name`。

## GreatIPSetConfig [#greatipsetconfig]

大IP集合，逻辑与 [GreatDomainSetConfig](#greatdomainsetconfig) 相同，但针对 IP。

<ProtoField name="name" type="string">
  组合集合名称
</ProtoField>

<ProtoField name="oppositeName" type="string">
  互斥配对集合名称
</ProtoField>

<ProtoField name="inNames" type="string[]">
  包含这些 IP 集合中的地址
</ProtoField>

<ProtoField name="exNames" type="string[]">
  排除这些 IP 集合中的地址
</ProtoField>

## AppSetConfig [#appsetconfig]

应用集合，供路由 `appTags` 使用。

<ProtoField name="name" type="string">
  集合名称
</ProtoField>

<ProtoField name="appIds" type="AppId[]">
  [AppId](#appid) 列表
</ProtoField>

<ProtoField name="clashFiles" type="string[]">
  Clash 格式规则文件，从中提取AppId 规则
</ProtoField>

## AppId [#appid]

单条应用 ID 匹配规则。定义于 [`protos/proto/vx/router/router.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/router/router.proto)。

<ProtoField name="type" type="AppId.Type">
  匹配方式：

  * `Keyword`：子串匹配
  * `Prefix`：前缀匹配
  * `Exact`：精确匹配
</ProtoField>

<ProtoField name="value" type="string">
  应用包名或 ID 字符串（匹配时转为小写）
</ProtoField>

## GeoRemoteFile [#georemotefile]

远程 geo 数据文件的定时下载配置，用于 `AtomicDomainSetConfig.remoteGeoFiles` 与 `AtomicIPSetConfig.remoteGeoFiles`。

<ProtoField name="filepath" type="string">
  下载后写入的本地路径
</ProtoField>

<ProtoField name="sourceUrl" type="string">
  HTTPS 下载地址
</ProtoField>

<ProtoField name="refreshCron" type="string">
  5 段 cron（分 时 日 月 周）。空表示仅在启动 / 重载时拉取一次
</ProtoField>

## 示例 [#示例]

原子域名集合 + 组合集合 + 路由引用：

```json
{
  "geo": {
    "atomicDomainSets": [
      {
        "name": "gfw",
        "geosite": {
          "filepath": "geosite.dat",
          "codes": ["gfw"]
        }
      },
      {
        "name": "custom-direct",
        "domains": [
          { "type": "Full", "value": "example.com" }
        ]
      }
    ],
    "greatDomainSets": [
      {
        "name": "proxy-domains",
        "inNames": ["gfw"],
        "exNames": ["custom-direct"]
      }
    ]
  },
  "router": {
    "rules": [
      {
        "domainTags": ["proxy-domains"],
        "matchAll": true,
        "outboundTag": "proxy"
      }
    ]
  }
}
```

## 相关 [#相关]

* [路由](/zh/docs/vx-core/configuration/router) — `domainTags`、`dstIpTags`、`geoDomains`、`appTags`
* [DNS](/zh/docs/vx-core/configuration/dns) — `domainTags`、`ipTags`
* [集合](/zh/docs/vx/manual/customize/sets) — 客户端中的集合类型与组合逻辑


# 入站 (/zh/docs/vx-core/configuration/inbounds)



入站配置位于 `ServerConfig.inbounds` 与 `ServerConfig.multiInbounds`。

模式定义：[`protos/proto/vx/inbound/inbound.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/inbound/inbound.proto)。

## ProxyInboundConfig [#proxyinboundconfig]

普通的入站。可以指定多个代理协议，但只可以由一个传输协议和安全协议。

<ProtoField name="tag" type="string">
  供[路由](/zh/docs/vx-core/configuration/router) `inboundTags` 引用的名称
</ProtoField>

<ProtoField name="address" type="string">
  监听地址；空表示所有网卡
</ProtoField>

<ProtoField name="port" type="uint32">
  单个端口（可与 `ports` 同时设置）
</ProtoField>

<ProtoField name="ports" type="uint32[]">
  监听的端口列表
</ProtoField>

<ProtoField name="transport" type="TransportConfig">
  TLS、REALITY、WebSocket、gRPC 等
</ProtoField>

<ProtoField name="protocol" type="Any">
  一种代理服务器配置（VMess、VLESS、Trojan 等）
</ProtoField>

<ProtoField name="protocols" type="Any[]">
  同一监听器上的多种协议
</ProtoField>

<ProtoField name="users" type="UserConfig[]">
  本入站用户（见[用户](/zh/docs/vx-core/configuration/users)）
</ProtoField>

示例：

```json
{
  "tag": "vmess",
  "ports": [10000],
  "protocol": {
    "@type": "type.googleapis.com/vx.proxy.vmess.VmessServerConfig",
    "secureEncryptionOnly": true
  }
}
```

协议 `@type` 值见[代理协议](/zh/docs/vx-core/configuration/protocols)。传输与 TLS/REALITY：[传输](/zh/docs/vx-core/configuration/transport)、[安全](/zh/docs/vx-core/configuration/security)。

> **Note**: 当多个协议都支持UDP时，只会有一个协议的UDP真正生效。如果有Hysteria，它会被优待，其他的协议的UDP不会生效。

## MultiProxyInboundConfig [#multiproxyinboundconfig]

Multi入站同时可以使用**多种传输与安全配置**。

<ProtoField name="tag" type="string">
  路由用的入站标签
</ProtoField>

<ProtoField name="address" type="string">
  监听地址；空表示所有网卡
</ProtoField>

<ProtoField name="ports" type="uint32[]">
  监听端口
</ProtoField>

<ProtoField name="protocols" type="Any[]">
  代理协议配置（与上文相同的 `Any` 类型）
</ProtoField>

<ProtoField name="securityConfigs" type="Security[]">
  安全协议
</ProtoField>

<ProtoField name="transportProtocols" type="Protocol[]">
  传输协议
</ProtoField>

<ProtoField name="socket" type="SocketConfig">
  Socket Option
</ProtoField>

<ProtoField name="users" type="UserConfig[]">
  本入站所有处理器的用户
</ProtoField>

<h3 id="inbound-security">
  Security
</h3>

`securityConfigs` 中的每一项

`tls` 与 `reality` ，每个安全块只能指定其中一项。

<ProtoField name="tls" type="TlsConfig" />

<ProtoField name="reality" type="RealityConfig" />

<ProtoField name="domains" type="string[]">
  对指定的SNI使用本安全配置
</ProtoField>

<ProtoField name="regularExpression" type="string">
  对符合正则的SNI使用本安全配置
</ProtoField>

<ProtoField name="always" type="bool">
  对所有连接使用本安全配置
</ProtoField>

<h3 id="inbound-transport-protocol">
  传输协议
</h3>

`transportProtocols` 中的每一项

`websocket`、`http`、`grpc`、`httpupgrade`、`splithttp`、`tcp` ，每个传输块只能指定其中一项。

<ProtoField name="websocket" type="WebsocketConfig">
  WebSocket 传输。见 [WebSocket](/zh/docs/vx-core/configuration/transport/websocket)。
</ProtoField>

<ProtoField name="http" type="HttpConfig">
  HTTP/2 传输伪装。见 [HTTP transport](/zh/docs/vx-core/configuration/transport/http)。
</ProtoField>

<ProtoField name="grpc" type="GrpcConfig">
  gRPC 传输。见 [gRPC](/zh/docs/vx-core/configuration/transport/grpc)。
</ProtoField>

<ProtoField name="httpupgrade" type="HttpUpgradeConfig">
  HTTP Upgrade 传输。见 [HTTPUpgrade](/zh/docs/vx-core/configuration/transport/httpupgrade)。
</ProtoField>

<ProtoField name="splithttp" type="SplitHttpConfig">
  Split HTTP (XHTTP) 传输。见 [SplitHTTP](/zh/docs/vx-core/configuration/transport/splithttp)。
</ProtoField>

<ProtoField name="tcp" type="TcpConfig">
  纯 TCP 传输。见 [TCP](/zh/docs/vx-core/configuration/transport/tcp)。
</ProtoField>

<ProtoField name="alpn" type="string">
  匹配 ALPN
</ProtoField>

<ProtoField name="sni" type="string">
  匹配连接 SNI
</ProtoField>

<ProtoField name="path" type="string">
  HTTP/1 路径
</ProtoField>

<ProtoField name="h2" type="bool">
  连接使用 HTTP/2
</ProtoField>

<ProtoField name="always" type="bool">
  对所有连接使用本传输
</ProtoField>

字段说明见[传输](/zh/docs/vx-core/configuration/transport)与[安全](/zh/docs/vx-core/configuration/security)。

## 相关 [#相关]

* [出站](/zh/docs/vx-core/configuration/outbounds) — 路由后的流量去向
* [路由](/zh/docs/vx-core/configuration/router) — 按 `inboundTags` 匹配


# 配置 (/zh/docs/vx-core/configuration)



vx-core 读取单个**服务器配置文件**。根消息为 [`protos/proto/vx/server.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/server.proto) 中的 `ServerConfig`。

## 配置格式 [#配置格式]

配置为 protobuf 消息，可序列化为：

* **二进制 protobuf** — 紧凑；部分内部路径使用
* **ProtoJSON** — 人类可读的 JSON；适合手工编辑

协议与传输的类型化设置使用 `google.protobuf.Any`。在 JSON 中，将 `@type` 设为消息的类型 URL：

```json
{
  "@type": "type.googleapis.com/vx.proxy.trojan.TrojanServerConfig",
  "users": [{ "secret": "your-password" }]
}
```

JSON 字段名使用 **camelCase**（例如 `matchAll`、`outboundTag`、`multiInbounds`）。

## ServerConfig 概览 [#serverconfig-概览]

<ProtoField name="inbounds" type="ProxyInboundConfig[]">
  入站
</ProtoField>

<ProtoField name="multiInbounds" type="MultiProxyInboundConfig[]">
  Multi入站
</ProtoField>

<ProtoField name="outbounds" type="OutboundHandlerConfig[]">
  出站
</ProtoField>

<ProtoField name="router" type="RouterConfig">
  路由配置
</ProtoField>

<ProtoField name="dns" type="DnsConfig">
  DNS配置
</ProtoField>

<ProtoField name="geo" type="GeoConfig">
  集合
</ProtoField>

<ProtoField name="policy" type="PolicyConfig">
  超时策略
</ProtoField>

<ProtoField name="log" type="LoggerConfig">
  日志设置
</ProtoField>

<ProtoField name="users" type="UserConfig[]">
  用户
</ProtoField>

<ProtoField name="dispatcher" type="DispatcherConfig">
  调度器
</ProtoField>

<ProtoField name="dialerFactory" type="DialerFactoryConfig">
  出站工厂
</ProtoField>

最小服务器示例：

```json
{
  "inbounds": [
    {
      "tag": "trojan",
      "ports": [443],
      "protocol": {
        "@type": "type.googleapis.com/vx.proxy.trojan.TrojanServerConfig"
      }
    }
  ],
  "router": {
    "rules": [{ "matchAll": true, "outboundTag": "direct" }]
  },
  "outbounds": [
    {
      "tag": "direct",
      "protocol": {
        "@type": "type.googleapis.com/vx.proxy.freedom.FreedomConfig"
      }
    }
  ]
}
```

## 章节 [#章节]

<Cards>
  <Card title="入站" href="/zh/docs/vx-core/configuration/inbounds" description="ProxyInboundConfig 与 MultiProxyInboundConfig" />

  <Card title="出站" href="/zh/docs/vx-core/configuration/outbounds" description="OutboundHandlerConfig 与 protocol Any" />

  <Card title="路由" href="/zh/docs/vx-core/configuration/router" description="RuleConfig、条件、选择器、回退" />

  <Card title="DNS" href="/zh/docs/vx-core/configuration/dns" description="服务器、解析器、劫持、Fake DNS" />

  <Card title="Geo" href="/zh/docs/vx-core/configuration/geo" description="规则使用的域名/IP/应用集合" />

  <Card title="策略" href="/zh/docs/vx-core/configuration/policy" description="超时与缓冲区大小" />

  <Card title="日志" href="/zh/docs/vx-core/configuration/log" description="LoggerConfig" />

  <Card title="用户" href="/zh/docs/vx-core/configuration/users" description="UserConfig" />

  <Card title="调度器" href="/zh/docs/vx-core/configuration/dispatcher" description="嗅探与会话统计" />

  <Card title="拨号器工厂" href="/zh/docs/vx-core/configuration/dialer-factory" description="拨号超时与网卡绑定" />

  <Card title="代理协议" href="/zh/docs/vx-core/configuration/protocols" description="VMess、VLESS、Trojan、Shadowsocks 等" />

  <Card title="传输" href="/zh/docs/vx-core/configuration/transport" description="TCP、WebSocket、gRPC、KCP、xhttp、socket" />

  <Card title="安全" href="/zh/docs/vx-core/configuration/security" description="TLS 与 REALITY" />
</Cards>

## CLI [#cli]

```bash
vx run --config config.json
```

<ProtoField name="`--config`" type="default config.json">
  配置文件路径
</ProtoField>

通过[安装脚本](/zh/docs/vx-core/quick-start)安装时，默认路径为 `/usr/local/etc/vx/config.json`。

## Proto 源文件 [#proto-源文件]

<ProtoField name="根" type="protos/proto/vx/server.proto" />

<ProtoField name="入站" type="protos/proto/vx/inbound/inbound.proto" />

<ProtoField name="出站" type="protos/proto/vx/outbound/outbound.proto" />

<ProtoField name="路由" type="protos/proto/vx/router/router.proto" />

<ProtoField name="DNS" type="protos/proto/vx/dns/dns.proto" />

<ProtoField name="Geo" type="protos/proto/vx/geo/geo.proto" />

<ProtoField name="策略" type="protos/proto/vx/policy.proto" />

<ProtoField name="日志" type="protos/proto/vx/log/logger.proto" />

<ProtoField name="用户" type="protos/proto/vx/user/user.proto" />

<ProtoField name="调度器" type="protos/proto/vx/dispatcher/dispatcher.proto" />

<ProtoField name="拨号器工厂" type="protos/proto/vx/dialerfactory/dialerfactory.proto" />

<ProtoField name="代理协议">
  `protos/proto/vx/proxy/*/` — [文档](/zh/docs/vx-core/configuration/protocols)
</ProtoField>

<ProtoField name="传输">
  `protos/proto/vx/transport/` — [文档](/zh/docs/vx-core/configuration/transport)
</ProtoField>

<ProtoField name="安全（TLS/REALITY）">
  `protos/proto/vx/transport/security/` — [文档](/zh/docs/vx-core/configuration/security)
</ProtoField>


# 日志 (/zh/docs/vx-core/configuration/log)



日志在 `ServerConfig.log`（`LoggerConfig`）中配置。模式定义：[`protos/proto/vx/log/logger.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/log/logger.proto)。

## LoggerConfig [#loggerconfig]

<ProtoField name="logLevel" type="Level">
  最低级别：`DEBUG`、`INFO`、`WARN`、`ERROR`、`FATAL`、`DISABLED`
</ProtoField>

<ProtoField name="filePath" type="string">
  日志文件路径
</ProtoField>

<ProtoField name="logFileDir" type="string">
  `filePath` 为空时，在此目录写入带时间戳的文件（`2006-01-02T15:04:05.txt`）
</ProtoField>

<ProtoField name="consoleWriter" type="bool">
  人类可读的控制台输出
</ProtoField>

<ProtoField name="showColor" type="bool">
  彩色日志（配合控制台输出）
</ProtoField>

<ProtoField name="showCaller" type="bool">
  包含调用位置
</ProtoField>

<ProtoField name="redact" type="bool">
  在日志行中脱敏域名与 IP
</ProtoField>

## 示例 [#示例]

```json
{
  "log": {
    "logLevel": "INFO",
    "filePath": "/var/log/vx/vx.log",
    "redact": false
  }
}
```


# 出站 (/zh/docs/vx-core/configuration/outbounds)



出站在 `ServerConfig.outbounds` 中使用。

模式定义：[`protos/proto/vx/outbound/outbound.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/outbound/outbound.proto)。

每个处理器有唯一的 `tag`，供[路由](/zh/docs/vx-core/configuration/router)规则（`outboundTag`）或链式目标引用。

## OutboundHandlerConfig [#outboundhandlerconfig]

<ProtoField name="tag" type="string">
  路由用的处理器名称
</ProtoField>

<ProtoField name="transport" type="TransportConfig">
  客户端传输（TLS、WebSocket 等）
</ProtoField>

<ProtoField name="address" type="string">
  远程主机或 IP
</ProtoField>

<ProtoField name="port" type="uint32">
  远程端口
</ProtoField>

<ProtoField name="ports" type="PortRange[]">
  多个端口范围
</ProtoField>

<ProtoField name="protocol" type="Any">
  代理客户端配置（Freedom、Blackhole、VMess 等）
</ProtoField>

<ProtoField name="enableMux" type="bool">
  启用连接多路复用
</ProtoField>

<ProtoField name="muxConfig" type="MuxConfig">
  `maxConnection`、`maxConcurrency`
</ProtoField>

<ProtoField name="uot" type="bool">
  UDP over TCP
</ProtoField>

<ProtoField name="domainStrategy" type="DomainStrategy">
  拨号时若 `address` 为域名，按以下策略解析并选择 IP：

  * `PreferIPv4`（默认）：同时查询 A 与 AAAA 记录；优先使用 IPv4，若无 IPv4 则用 IPv6。
  * `PreferIPv6`：同时查询 A 与 AAAA 记录；优先尝试 IPv6，若无 IPv6 则用 IPv4。
  * `IPv4Only`：仅查询 A 记录，只使用 IPv4。
  * `IPv6Only`：仅查询 AAAA 记录，只使用 IPv6。
  * `Speed`：并行查询 A 与 AAAA，使用先返回结果的一组地址；若连接失败且另一地址族可用，再尝试另一组。

  若网卡不支持 IPv6，`PreferIPv4`、`PreferIPv6`、`Speed` 会自动降级为 `IPv4Only`。
</ProtoField>

<ProtoField name="random" type="RandomPortSelectStrategy">
  同时使用 `ports` 中的全部端口
</ProtoField>

<ProtoField name="one" type="OnePortSelectStrategy">
  轮换单个端口（`interval` 或 `minInterval` / `maxInterval`）
</ProtoField>

### 示例 [#示例]

#### 直连（freedom）出站 [#直连freedom出站]

最小服务器需配置此项，以便不经上游代理转发流量：

```json
{
  "tag": "direct",
  "protocol": {
    "@type": "type.googleapis.com/vx.proxy.freedom.FreedomConfig"
  }
}
```

#### 阻断出站 [#阻断出站]

```json
{
  "tag": "block",
  "protocol": {
    "@type": "type.googleapis.com/vx.proxy.blackhole.BlackholeConfig"
  }
}
```

代理客户端配置见[代理协议](/zh/docs/vx-core/configuration/protocols)（`*ClientConfig` 消息）。按需配合[传输](/zh/docs/vx-core/configuration/transport)与[安全](/zh/docs/vx-core/configuration/security)。

## 相关 [#相关]

* [路由](/zh/docs/vx-core/configuration/router) — 选择 `outboundTag` 或 `selectorTag`
* [出站工厂](/zh/docs/vx-core/configuration/dialer-factory)


# 策略 (/zh/docs/vx-core/configuration/policy)



连接策略在 `ServerConfig.policy`（`PolicyConfig`）中设置。模式定义：[`protos/proto/vx/policy.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/policy.proto)。

所有超时值单位为**秒**。

## PolicyConfig [#policyconfig]

<ProtoField name="handshakeTimeout" type="int32">
  连接后无数据则关闭
</ProtoField>

<ProtoField name="connectionIdleTimeout" type="int32">
  空闲时关闭（双向均无传输）
</ProtoField>

<ProtoField name="udpIdleTimeout" type="int32">
  无上行 UDP 数据时关闭
</ProtoField>

<ProtoField name="upLinkOnlyTimeout" type="int32">
  下行结束后，无上行数据则关闭
</ProtoField>

<ProtoField name="downLinkOnlyTimeout" type="int32">
  上行结束后，无下行数据则关闭
</ProtoField>

<ProtoField name="defaultBufferSize" type="int32">
  默认每连接缓冲区
</ProtoField>

<ProtoField name="userPolicyMap" type="map<uint32, UserPolicy>">
  按 `userLevel` 覆盖
</ProtoField>

## UserPolicy [#userpolicy]

<ProtoField name="bufferSize">
  该级别用户的缓冲区大小
</ProtoField>

用户级别来自各账户 [UserConfig](/zh/docs/vx-core/configuration/users) 的 `userLevel`。

## 示例 [#示例]

```json
{
  "policy": {
    "handshakeTimeout": 4,
    "connectionIdleTimeout": 300,
    "udpIdleTimeout": 60,
    "userPolicyMap": {
      "0": { "bufferSize": 4096 }
    }
  }
}
```

## 相关 [#相关]

* [用户](/zh/docs/vx-core/configuration/users) — 每账户 `userLevel`


# 路由 (/zh/docs/vx-core/configuration/router)



路由在 `ServerConfig.router`（`RouterConfig`）中配置。

模式定义：[`protos/proto/vx/router/router.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/router/router.proto)。

规则按顺序评估，第一条匹配的规则决定出站或选择器。命中后后续规则不在考虑。

## 示例 [#示例]

全部路由到直连：

```json
{
  "router": {
    "rules": [
      { "matchAll": true, "outboundTag": "direct" }
    ]
  }
}
```

将某入站路由到某出站：

```json
{
  "router": {
    "rules": [
      {
        "conditions": [
          { "inboundTags": ["trojan"] }
        ],
        "outboundTag": "direct"
      }
    ]
  }
}
```

域名或应用集合任一匹配时走代理：

```json
{
  "router": {
    "rules": [
      {
        "conditions": [
          { "domainTags": ["proxy"] },
          { "appTags": ["proxy"] }
        ],
        "selectorTag": "proxy"
      }
    ]
  }
}
```

## RouterConfig [#routerconfig]

<ProtoField name="rules" type="RuleConfig[]">
  有序路由规则
</ProtoField>

## RuleConfig [#ruleconfig]

**目标：** `outboundTag` 与 `selectorTag` 须恰好设置其一。若均为空，连接将被**阻断**。

<ProtoField name="outboundTag" type="string">
  发往该出站处理器
</ProtoField>

<ProtoField name="selectorTag" type="string">
  发往[选择器](#selectorconfig)（客户端 / 负载均衡）
</ProtoField>

<ProtoField name="matchAll" type="bool">
  匹配所有连接。为 `true` 时忽略 `conditions`。
</ProtoField>

<ProtoField name="conditions" type="Condition[]">
  匹配谓词列表。当**任一**条件成立时规则命中（逻辑 OR）。`matchAll` 为 `true` 时忽略。若为空且 `matchAll` 为 `false`，规则永不命中。

  推荐使用此字段，而非顶层匹配字段或单数 `condition`。
</ProtoField>

<ProtoField name="condition" type="Condition">
  **旧版。** 单个条件；等价于 `conditions` 中的一项。仅在 `conditions` 为空时使用。
</ProtoField>

<ProtoField name="fallbacks" type="Fallback[]">
  主目标失败时尝试备用选择器/出站
</ProtoField>

<ProtoField name="ruleName" type="string">
  名称
</ProtoField>

### Fallback [#fallback]

<ProtoField name="selectorTag" type="string">
  备用选择器（与 `outboundTag` 二选一）
</ProtoField>

<ProtoField name="outboundTag" type="string">
  备用出站（与 `selectorTag` 二选一）
</ProtoField>

<ProtoField name="action" type="Action">
  回退时的附加动作
</ProtoField>

<ProtoField name="matchAll" type="bool">
  匹配所有连接时启用此回退
</ProtoField>

<ProtoField name="conditions" type="Condition[]">
  回退条件列表。当**任一**条件成立时此回退可用（逻辑 OR）。`matchAll` 为 `true` 时忽略。
</ProtoField>

<ProtoField name="condition" type="Condition">
  **旧版。** 单个条件。仅在 `conditions` 为空时使用。也支持旧版顶层 `domainTags` / `dstIpTags`（合并为单个隐式条件）。
</ProtoField>

<ProtoField name="last" type="bool">
  若此回退被选用，则为最终回退，后面的不再考虑
</ProtoField>

#### Action [#action]

`Fallback.action` 的字段：

<ProtoField name="ipToDomain" type="bool">
  回退时将 IP 改写回域名
</ProtoField>

## Condition [#condition]

用于 `RuleConfig.conditions`、`RuleConfig.condition`（旧版）或 `Fallback.conditions` / `Fallback.condition`（旧版）。

每个 `Condition` 是规则或回退 `conditions` 列表中的一项。列表内**任一**条件成立即匹配（OR）；单个 `Condition` 内**所有**已启用的子条件须同时成立（AND）。若无任何子条件，该 `Condition` 不成立。

<ProtoField name="usernames" type="string[]">
  匹配已认证用户 id
</ProtoField>

<ProtoField name="srcCidrs" type="string[]">
  源 IP 匹配
</ProtoField>

<ProtoField name="srcIpTags" type="string[]">
  源 IP 匹配, 使用Geo里的集合名称
</ProtoField>

<ProtoField name="dstCidrs" type="string[]">
  目标 IP 匹配
</ProtoField>

<ProtoField name="dstIpTags" type="string[]">
  目标 IP 匹配， 使用Geo里的集合名称
</ProtoField>

<ProtoField name="resolveDomain" type="bool">
  解析域名；所有 IP 须在 `dstIpTags` 或 `dstCidrs` 中
</ProtoField>

<ProtoField name="resolveSoftRewrite" type="bool">
  解析域名，任意 IP 在 `dstIpTags` 或 `dstCidrs` 中即可，并将目标改写为此 IP
</ProtoField>

<ProtoField name="resolveSoftNoRewrite" type="bool">
  解析域名，任意 IP 在 `dstIpTags` 或 `dstCidrs` 中即可，但不改写目标
</ProtoField>

<ProtoField name="geoDomains" type="Domain[]">
  内联 [Domain](/zh/docs/vx-core/configuration/geo#domain) 条目进行域名匹配
</ProtoField>

<ProtoField name="domainTags" type="string[]">
  域名匹配（引用 [geo](/zh/docs/vx-core/configuration/geo) 集合）
</ProtoField>

<ProtoField name="networks" type="Network[]">
  `TCP`、`UDP` 等
</ProtoField>

<ProtoField name="srcPortRanges" type="PortRange[]">
  源端口范围
</ProtoField>

<ProtoField name="dstPortRanges" type="PortRange[]">
  目标端口范围
</ProtoField>

<ProtoField name="appIds" type="AppId[]">
  应用 id 匹配
</ProtoField>

<ProtoField name="appTags" type="string[]">
  应用集合匹配（引用 [geo](/zh/docs/vx-core/configuration/geo) 集合）
</ProtoField>

<ProtoField name="protocols" type="string[]">
  协议嗅探结果
</ProtoField>

<ProtoField name="ipv6" type="bool">
  仅匹配 IPv6
</ProtoField>

<ProtoField name="fakeIp" type="bool">
  匹配 Fake IP 目标
</ProtoField>

<ProtoField name="hasNoDomain" type="bool">
  连接使用 IP 目标且无嗅探到的域名
</ProtoField>

<ProtoField name="allTags" type="string[]">
  域名、IP 或应用集合联合匹配（任一集合命中即可）
</ProtoField>

<ProtoField name="skipSniff" type="bool">
  对 IP 目标连接禁用嗅探
</ProtoField>

<ProtoField name="inboundTags" type="string[]">
  匹配入站 `tag`
</ProtoField>

## SelectorConfig [#selectorconfig]

选择器从一组出站中筛选候选节点，再按策略选出实际用于连接的节点。定义在 `ClientConfig.selectors`（`SelectorsConfig`），主要用于 **VX 客户端**；[路由](/zh/docs/vx-core/configuration/router)规则通过 `selectorTag` 引用其 `tag`。

客户端 UI 行为说明见[选择器](/zh/docs/vx/manual/customize/selectors)。

<ProtoField name="tag" type="string">
  选择器名称。`RuleConfig.selectorTag` 与 `Fallback.selectorTag` 引用此值。
</ProtoField>

<ProtoField name="filter" type="Filter">
  候选出站池的筛选条件，见 [Filter](#filter)。
</ProtoField>

<ProtoField name="strategy" type="SelectingStrategy">
  从筛选池中**实际选用**哪些节点：

  * `ALL`：池中全部节点
  * `ALL_OK`：全部可用节点（无可用时回退到未测试节点）
  * `LEAST_PING`：ping 最低的单节点
  * `MOST_THROUGHPUT`：测速吞吐量最高的单节点
  * `TOP_PING`：ping 在最低值 &#x2A;*30%** 以内的所有节点（如最低 100 ms → 包含 ≤ 130 ms）
  * `TOP_THROUGHPUT`：吞吐量 ≥ 最高值 &#x2A;*70%** 的所有节点（如最高 100 → 包含 ≥ 70）

  单节点策略（`LEAST_PING`、`MOST_THROUGHPUT`）不使用 `balanceStrategy`；多节点策略才需要负载均衡。
</ProtoField>

<ProtoField name="balanceStrategy" type="BalanceStrategy">
  多节点策略下，每条连接由哪个节点处理：

  * `RANDOM`（默认）：从活跃集合中随机选择；IPv6 连接优先选支持 IPv6 的节点
  * `MEMORY`：按应用或根域名粘性复用同一节点；尚无映射时随机分配并记住
</ProtoField>

<ProtoField name="selectFromOm" type="bool">
  服务端此项应为 `true`
</ProtoField>

<ProtoField name="speedTestSize" type="uint32">
  每次测速的下载字节数。未设置 `speedTestSizeRange` 且为 `0` 时，核心默认 **1 MiB**。
</ProtoField>

<ProtoField name="speedTestInterval" type="uint32">
  对筛选节点测速的间隔（**分钟**）。仅 `MOST_THROUGHPUT` 与 `TOP_THROUGHPUT` 会定期测速。
</ProtoField>

<ProtoField name="pingTestInterval" type="uint32">
  对筛选节点 ping 的间隔（**分钟**）。仅 `LEAST_PING` 与 `TOP_PING` 会定期 ping。
</ProtoField>

<ProtoField name="unusableTestInterval" type="uint32">
  重新检查已标记不可用节点的间隔（**分钟**）。除 `ALL` 外各策略都会检测可用性。
</ProtoField>

<ProtoField name="speedTestSizeRange" type="SpeedTestSizeRange">
  测速下载大小的随机范围（字节）。满足 `0 < min ≤ max` 时，每次测速在 `[min, max]` 内随机取值；否则使用 `speedTestSize`。
</ProtoField>

### Filter [#filter]

<ProtoField name="prefixes" type="string[]">
  出站 `tag` 以任一前缀开头即匹配
</ProtoField>

<ProtoField name="tags" type="string[]">
  出站 `tag` 等于列表中任一值即匹配
</ProtoField>

<ProtoField name="subStrings" type="string[]">
  出站 `tag` 包含任一子串即匹配（仅数据库模式）
</ProtoField>

<ProtoField name="inverse" type="bool">
  `true` 时取反：未命中 `prefixes` / `tags` 的出站才入选（出站管理器模式）
</ProtoField>

### SpeedTestSizeRange [#speedtestsizerange]

<ProtoField name="min" type="uint32">
  随机测速大小的下限（字节）
</ProtoField>

<ProtoField name="max" type="uint32">
  随机测速大小的上限（字节）
</ProtoField>

## 相关 [#相关]

* [Geo](/zh/docs/vx-core/configuration/geo) — `domainTags`、`dstIpTags`、`geoDomains`
* [DNS](/zh/docs/vx-core/configuration/dns) — `resolveDomain` 规则的解析
* [调度器](/zh/docs/vx-core/configuration/dispatcher) — 嗅探影响协议/域名匹配


# 用户 (/zh/docs/vx-core/configuration/users)



此message在 `ServerConfig.users`（`UserConfig[]`）中用到。也在[入站](/zh/docs/vx-core/configuration/inbounds)的 `users` 中用到。

模式定义：[`protos/proto/vx/user/user.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/user/user.proto)。

## UserConfig [#userconfig]

<ProtoField name="id" type="string">
  用户标识（用于路由 `usernames`）
</ProtoField>

<ProtoField name="userLevel" type="uint32">
  [PolicyConfig](/zh/docs/vx-core/configuration/policy) `userPolicyMap` 的策略级别
</ProtoField>

<ProtoField name="secret" type="string">
  任意长度的密码
</ProtoField>

## 示例 [#示例]

```json
{
  "users": [
    {
      "id": "alice",
      "userLevel": 0,
      "secret": "00000000-0000-0000-0000-000000000001"
    }
  ],
  "inbounds": [
    {
      "tag": "vless",
      "ports": [443],
      "users": [
        {
          "id": "alice",
          "userLevel": 0,
          "secret": "00000000-0000-0000-0000-000000000001"
        }
      ],
      "protocol": {
        "@type": "type.googleapis.com/vx.proxy.vless.VlessServerConfig"
      }
    }
  ]
}
```

入站级 `users` 会加入该入站上所有代理处理器。全局 `users` 在加入到所有入站里的所有代理处理器。

## 相关 [#相关]

* [路由](/zh/docs/vx-core/configuration/router) — 匹配 `usernames`
* [策略](/zh/docs/vx-core/configuration/policy) — `userLevel` → 缓冲区与限制


# DNS (/zh/docs/vx/manual/customize/dns)



DNS 服务器由[路由模式](/zh/docs/vx/manual/customize/modes)内的 **DNS 规则**/内部DNS服务器 引用。

## DNS 查询如何处理 [#dns-查询如何处理]

有两类查询：

**劫持 DNS** — 来自其他应用的查询（TUN 模式或系统 DNS 指向 vx-core 时）

**内部 DNS** — 当 vx-core 自身需要解析域名时（例如域名为地址的节点）。按模式有序的 **内部 DNS 服务器** 列表从左到右依次尝试，直到成功。

对 **两类** 查询，都会先检查 **本地 DNS 记录**。若记录匹配查询，vx-core 立即返回该答案，不再转发到 DNS 服务器。

## DNS 服务器类型 [#dns-服务器类型]

添加 **DNS 服务器** 时，从下拉菜单选择类型。每种类型为单一解析器实现。

* **Fake**: 从配置的 CIDR 池（通常为 `198.18.0.0/15`）返回假 IP。
* **UDP/TCP**: 经典 DNS over UDP/TCP，指向一个或多个 `host:port`。多个地址可用逗号分隔；每次查询同时发往所有地址，使用 **首个回复**。
* **HTTPS**: DNS over HTTPS (DoH)，指向解析器 URL（例如 `https://1.1.1.1/dns-query`）。
* **TLS**: DNS over TLS (DoT)，指向一个或多个 `host:port`。
* **QUIC**: DNS over QUIC。
* **Go**: 使用 Go 运行时 / 系统 DNS 解析器（操作系统解析行为）。其流量不经过路由，通常用于服务器与非 TUN 模式。
* **Empty**: 始终返回空 DNS 应答（无记录）。

### 通用字段（多数类型） [#通用字段多数类型]

* **名称**: 在 DNS 规则与内部 DNS 服务器列表中使用的唯一标签。不可与其他服务器或组合名称重复。名称 `hijack` 保留。
* **客户端 IP**: 可选 ECS (EDNS Client Subnet) 源地址，随查询发送，使上游解析器返回您所在位置的答案。
* **缓存市场**: 缓存响应的秒数。若为空或 `0`，则缓存至记录 TTL 过期。
* **结果IP集合**: 丢弃 **不在** 所选 IP 集合内的 A/AAAA 答案中 。可用于防止 DNS 污染

### Fake DNS 字段 [#fake-dns-字段]

* **地址池**: 假 IP 分配的逗号分隔 CIDR（例如 `198.18.0.0/15`）。
* **LRU 大小**: 每个池保留的假 DNS 映射数量（表单默认 6666）。

## 组合 DNS 服务器 [#组合-dns-服务器]

除单一解析器外，还可创建 **组**，按名称组合其他 DNS 服务器：

### 并发DNS服务器 [#并发dns服务器]

**并行** 运行 **所有** 成员服务器，返回首个 **明确** 答案（NOERROR 且至少一条记录）。
若无服务器返回明确答案，则返回其中第一个收到的结果。

当您希望从多个上游中选用最快解析器时使用（例如同时查询 `8.8.8.8` 与 `1.1.1.1`）。

### 串行DNS服务器 [#串行dns服务器]

**按顺序** 查询成员服务器，但若在 **间隔**（秒）内尚无明确答案，则启动下一个服务器。较早的查询仍在后台运行，因此较慢但正确的上游仍可能胜出。

当您希望主解析器配合定时回退时使用（例如先尝试国内 DNS，再尝试国外 DNS）。

两种组合类型至少需要一名成员 DNS 服务器。串行组的成员顺序很重要（可在表单中重排）。

## 本地 DNS 记录 [#本地-dns-记录]

每条记录包含：

* **域名**: 要匹配的主机名（必填）。
* **IP addresses**: 逗号分隔的 IPv4 和/或 IPv6 地址。生成 **A** 与 **AAAA** 答案。
* **Proxied domain**: 可选 **CNAME** 目标 — 域名解析到该名称而非直接 IP。

适用于：

* 在不改路由规则的情况下阻断或重定向特定域名
* 将域名固定到指定 IP 用于测试
* 本地开发主机名

## 相关 [#相关]

* [路由模式](/zh/docs/vx/manual/customize/modes) — 各模式下的 DNS 规则与内部 DNS 服务器


# 路由页 (/zh/docs/vx/manual/customize)



**路由** 标签页让您可以根据需求控制网络流量如何路由以及DNS解析。

## 两种视图：简化与高级 [#两种视图简化与高级]

打开 **路由** 标签页。使用右上角 **高级** / **简化** 按钮切换视图。

* `简化`: 配置应走代理或直连的域名、IP 与应用
* `高级`: 完整控制：路由模式、集合、选择器与 DNS

## 文档章节 [#文档章节]

<Cards>
  <Card title="简化视图" href="/zh/docs/vx/manual/customize/simplified" description="自定义走代理/直连的域名/IP/应用" />

  <Card title="路由模式" href="/zh/docs/vx/manual/customize/modes" description="GFW、CN、全局代理、自定义模式" />

  <Card title="集合" href="/zh/docs/vx/manual/customize/sets" description="大小域名/IP集合，应用集合" />

  <Card title="选择器" href="/zh/docs/vx/manual/customize/selectors" description="如何选择节点" />

  <Card title="DNS" href="/zh/docs/vx/manual/customize/dns" description="DNS相关设置" />
</Cards>

## 相关 [#相关]

* [主页 → 路由组件](/zh/docs/vx/manual/home#routing) — 从主屏幕切换模式


# 模式 (/zh/docs/vx/manual/customize/modes)





**高级 → 模式** 列出所有 **模式**。一个模式由以下部分组成：

* **路由规则** — 决定每条连接走 **代理**、**直连** 还是 **阻断**
* **DNS 规则** — 决定如何应答来自其他应用的 **DNS 查询**
* **内部 DNS 服务器** — vx-core 自身需要解析域名时使用（例如拨号出站时）

## 内置模式 [#内置模式]

* **GFW**（黑名单） (`GFW`): GFW 列表中的域名与 IP — **代理**；其余 — **直连**
* **CN**（白名单） (`CN`): 中国大陆域名与 IP — **直连**；其他 — **代理**
* **Proxy All** (`Proxy All`): 所有非私有流量 — **代理**；私有 — **直连**
* **RU Blocked** (`Russia Blocked`): 俄罗斯屏蔽列表 — **代理**；其余 — **直连**
* **RU Blocked (All)** (`Russia Blocked(All)`): 更广的俄罗斯屏蔽列表 — **代理**；其余 — **直连**

## 路由决策如何做出 [#路由决策如何做出]

vx-core 处理连接时，**路由规则自上而下匹配** 。
**第一条所有条件均匹配的规则** 生效，匹配后不再考虑后续规则。
规则的决策为 直连、节点、选择器或 阻止，这决定流量去向。

* **直连**: 流量直连，不经代理
* **节点**: 流量发往该节点
* **[选择器](/zh/docs/vx/manual/customize/selectors)**: 流量发往选择器选中的节点
* **阻止**: 连接被拒绝

若无规则匹配，连接失败

### 示例：GFW 模式下访问 google [#示例gfw-模式下访问-google]

对于来自浏览器、域名为 "[www.google.com](http://www.google.com)" 的连接，将从起始规则 "默认代理DNS服务器" 起依次匹配路由规则，直至规则 "GFW模式代理域名" 匹配，因为 [www.google.com](http://www.google.com) 属于域名集合 "GFW模式代理域名"。

## 路由规则及其条件 [#路由规则及其条件]

每条路由规则包含：

* **名称**（用于显示与调试）
* **出站**：直连、节点、选择器或 屏蔽
* **条件** — 该规则命中需满足的条件
* 可选 **回退**

### 匹配全部 [#匹配全部]

启用 **匹配所有** 使规则适用于每条连接（通常用于列表底部的兜底「默认代理」或「默认直连」规则）。启用时忽略 `conditions` 列表。

### 条件类型 [#条件类型]

关闭 **匹配所有** 时，规则在 `conditions` 列表中**任一**条件成立时命中（逻辑 OR）。若列表为空，规则永不命中。

单个 `Condition` 内，**每个启用的子条件都必须成立**（逻辑 AND）。若某 `Condition` 未启用任何子条件，则永不成立。

#### 入站 [#入站]

*当连接的入站标签属于指定标签之一时匹配。*

通常用于匹配由特定入站处理的流量 — 例如，
来自 DNS 服务器的连接会以 DNS 服务器名称作为入站标签，可用此条件匹配来自 DNS 服务器的流量。

#### 域名 [#域名]

*当目标域名属于所选 [域名集合](/zh/docs/vx/manual/customize/sets) 之一，或添加的域名条目时匹配。*

#### IP [#ip]

*当目标 IP 属于所选 IP 集合或 CIDR 之一时匹配。*

IP 条件可先解析域名。

#### App [#app]

*当连接的发起应用属于所选应用集合或应用 之一时匹配。*

#### 域名 / IP / 应用 [#域名--ip--应用]

*若连接的域名属于指定域名集合之一，或若连接的 IP 属于指定 IP 集合之一，或若连接的应用属于指定应用集合之一匹配*

用于减少规则数量。若有名为 "Netflix" 的 IP 集合、域名集合与应用集合，
且希望它们都走同一节点，可添加一条带此条件的规则，而非三条规则。

#### Fake IP [#fake-ip]

*当目标是 Fake DNS 颁发的假 IP 地址（来自 `198.18.0.0/15` 池）时匹配*

#### Network [#network]

*当连接具有指定网络类型时匹配*

> **警告：** 除非理解原因，否则避免在同一 `Condition` 中同时启用 **域名** 与 **IP** 子条件：
> 该 `Condition` 仅在 **两者** 均为真时成立，即连接需同时有域名与 IP 信息，
> 而许多连接只有其中之一。若希望域名 **或** IP 命中，应使用 `conditions` 中的多个条目。

### 回退 [#回退]

路由规则可定义 **回退**。若规则选定的出站失败（例如所选节点不可达），
vx-core 按顺序尝试各回退中指定的节点/选择器。每个回退有自己的 `conditions` 列表与节点/选择器 —
当回退的 **任一** 条件成立（或启用 **匹配所有**）时使用该回退。若不匹配，则考虑下一个回退。

例如，GFW 的最后一条规则 "默认直连" 使用两个回退，使直连失败的流量可重试代理。每个
回退有条件，确保仅非 CN 域名或 IP 的连接重试代理，防止国内连接误走代理。

<Accordions type="single">
  <Accordion title="回退功能试图解决什么问题" id="why-fallbacks">
    <div>
      理想情况下，GFW 模式下所有被 GFW 屏蔽的域名/IP 都应走代理。但常用的 gfw geo 文件并不完整，许多
      被屏蔽域名未包含在内。在回退功能之前，这些域名的连接会失败，影响用户体验。
      该功能用于解决此问题：这些连接会回退到代理节点处理，尝试代理通常能成功。该功能
      显著改善使用 GFW 模式时的体验。
    </div>
  </Accordion>
</Accordions>

## DNS 规则 [#dns-规则]

DNS 规则指定应由哪个 DNS 服务器处理劫持的 DNS 查询。劫持的 DNS 查询是设备上 **其他进程** 发送、
由 vx-core 拦截到的查询（通过TUN 模式或系统 DNS 指向 vx-core 时）。

### 劫持 DNS 如何工作 [#劫持-dns-如何工作]

1. 某进程（例如系统 DNS）发送 DNS 查询（UDP/TCP 端口 53）。
2. vx-core 拦截并交给 DNS 劫持组件处理。
3. DNS 规则 **自上而下** 评估，与路由规则相同。
4. **第一条匹配的规则** 选择 **DNS 服务器** 处理查询。若无规则匹配，返回空 DNS 响应消息。
5. vx-core 将 DNS 服务器返回的响应消息返回给源进程。

> **说明：** 若控制抽屉中禁用 Fake DNS，指定 Fake DNS 服务器的规则会被跳过。

### DNS 规则条件 [#dns-规则条件]

DNS 规则在 **所有启用的条件均匹配** 时匹配，或 **无启用条件** 时匹配（兜底）。

> **警告：** 这与路由规则不同。路由规则若无条件则永不匹配，但
> DNS 规则若无条件则表示「始终匹配」。

* **域名**: 查询名称属于域名集合或域名条目之一
* **DNS 类型**: 记录类型为 A、AAAA 等

## 内部 DNS 服务器 [#内部-dns-服务器]

**内部 DNS 服务器** 为有序的 DNS 服务器列表。主要在 vx-core **拨号**
域名目标时使用。当节点地址为域名时，其 IP 由内部 DNS 服务器解析。
它们 **不** 用于应答来自其他应用的劫持 DNS 查询。将依次使用，直到
某一服务器返回 IP 答案。

> **提示：** 可双击内部 DNS 服务器将其删除。

## 如何添加模式 [#如何添加模式]

点击右上角添加按钮。可复制现有内置模式或从零创建模式。

## 相关 [#相关]

* [集合](/zh/docs/vx/manual/customize/sets) — 规则条件引用的域名、IP 与应用列表
* [选择器](/zh/docs/vx/manual/customize/selectors) — 处理「代理」规则的节点
* [路由 DNS](/zh/docs/vx/manual/customize/dns) — DNS 规则与全局 DNS 策略的区别
* [简化路由](/zh/docs/vx/manual/customize/simplified) — 无需调整规则顺序的快速编辑


# 选择器 (/zh/docs/vx/manual/customize/selectors)



**选择器** 从一群节点里选择要使用的节点。

## 选择器筛选 [#选择器筛选]

**范围** 定义选择器可从哪些节点中选择。

* **全部节点**: 所有节点。
* **部分节点**: 仅您指定的节点。

选择 **部分** 时，使用筛选芯片缩小池范围。

* **节点**: 单个节点。
* **节点组**: 节点组或订阅。
* **前缀**: 名称以给定前缀开头的节点。
* **子字符**: 名称包含给定子串的节点。
* **地区**: 该区域内的节点。

筛选更改立即生效，无需重启。

## 选择策略 [#选择策略]

筛选后，**选择策略** 决定从该池中 **实际使用** 哪些节点。

* **全部**: 筛选池中的每个节点
* **可用**: 所有可用节点
* **最低延迟**: ping 最低的单节点
* **最高速度**: 测速吞吐量最高的单节点
* **低延迟**: ping 在最佳 ping &#x2A;*30%** 以内的所有节点（例如最佳 100 ms → 包含 ≤ 130 ms 的节点）
* **高速度**: 吞吐量 ≥ 最佳的 &#x2A;*70%** 的所有节点（例如最佳 100 → 包含 ≥ 70 的节点）

**单** 节点的策略（**最低延迟**、**最高速度**）不显示负载策略 — 因为只有一个节点。

**多** 节点的策略（**全部**、**可用**、**低延迟**、**高速度**）下方显示 **负载均衡**。

### 测试间隔 [#测试间隔]

每个选择器会定期测试节点。可配置测试方式：

* **测速数据量** (`1,000,000 字节 (1 MB)`): 每次测速的下载大小。
* **测速间隔** (`60 分钟`): 对筛选节点测速的频率。
* **延迟测试间隔** (`10 分钟`): 对筛选节点 ping 的频率。
* **不可用节点复测间隔** (`10 分钟`): 重新检查标记为不可用节点的频率。

仅 **最高速度** 与 **高速度** 定期测速。仅 **最低延迟** 与 **低延迟** 定期 ping。
除 **全部** 外所有策略都会定期测试可用性与不可用节点。

## 负载策略 [#负载策略]

当选择策略保持 **多个** 节点活跃时，**负载均衡** 决定哪条连接由哪个节点处理：

* **随机**: 从活跃集合中为连接随机选节点。IPv6 流量优先选择支持 IPv6 的节点。
* **记忆**: 粘性：尽可能为同一 **应用** 或 **根域名** 复用同一节点。尚无映射时随机分配并记住。IPv6 流量优先选择支持 IPv6 的节点。

希望每个站点或应用出口稳定（会话中 IP 变化更少）时使用 **记忆**。希望在多节点间均匀分配负载时使用 **随机**。

> **说明：** 每个选择器会测试节点是否支持 IPv6，确保 IPv6 连接不会发往不支持 IPv6 的节点。

## 代理链 [#代理链]

在选择器选中的节点 **之后** 将流量经代理链发送。

流量路径：

```
[您的流量] → [选中的节点] → [代理链首节点] → … → [代理链末节点] → [目标]
```

**代理链** 列表中的 **最后一个** 节点为 **落地节点**（到达目标前的最终出口）。

## 代理选择器 [#代理选择器]

该选择器较特殊，支持手动节点选择，即您在节点页手动选择要使用的节点。
使用手动节点选择时，节点页会显示开关。

## 相关 [#相关]

* [自动节点选择](/zh/docs/vx/manual/automatic-node-selection) — 主页上 Proxy 选择器的手动与自动模式


# 集合 (/zh/docs/vx/manual/customize/sets)



**集合** — 路由与 DNS 规则使用的命名集合。

## 集合类型 [#集合类型]

* **域名小集合** : 比如自定义代理、自定义直连、GFW、CN、私有
* **IP小集合**: 比如自定义代理、自定义直连、CN
* **域名大集合** (其他域名集合的组合): 比如GFW模式代理域名
* **IP大集合** (其他 IP 集合的组合): GFW模式代理IP
* **应用集合** (应用 ID): 代理、直连

**小** 集合是基础块。**大** 集合由小集合（及其他大集合）构建。

## 大域名集合与大 IP 集合 [#大域名集合与大-ip-集合]

**大集合** 不直接持有域名或 IP，而是通过 **包含** 与 **排除** 列表组合其他集合。

当 vx-core 检查域名或 IP 是否属于组合集合时：

1. **先排除** — 若目标匹配 **排除** 中任一集合，**不匹配**。
2. **包含** — 若目标匹配 **包含** 中任一集合，匹配。
3. 否则不匹配。

### 示例：GFW模式代理域名 集合 [#示例gfw模式代理域名-集合]

在 GFW 模式下，大域名集合 **GFW模式代理域名** 定义为：

* **包含** `GFW`、`自定义代理`、`Fallback`
* **排除** `自定义直连`

在 GFW 列表中且不在 自定义直连 中的域名匹配此集合。

### 互斥集合名称 [#互斥集合名称]

创建或编辑 **大域名集合** 或 **大IP集合** 时，可选设置 **互斥集合**。

用于命名 **配对的相反集合**。例如：

* **CN模式直连域名** ↔ **CN模式代理域名**

它们表示两个集合：一个包含中国大陆所有域名，另一个包含其余所有域名。

在 UI 中为路由规则选择域名或 IP 集合时，集合及其互斥名称都会出现在选择器中。查找也可通过任一名称进行。

## 小集合 [#小集合]

### 小域名集合 [#小域名集合]

* **名称**: 路由规则引用的唯一标识符。
* **使用 Bloom Filter**: 降低集合的内存占用。有约 1% 的误报概率 — 不在集合中的域名可能被当作在集合中。
* **反向**: 翻转成员关系：集合匹配 **不在** 其中的目标。
* **GeoSite URL**: 自定义 `geosite.dat` 文件的 HTTPS URL。若为空，VX 使用 LoyalSoldier 提供的 `geosite.dat`。
* **GeoSite Codes**: geosite 数据中的类别（如 `cn`、`gfw`、`private`）。
* **GeoSite Attributes**: 代码内的子筛选（如 `category-games` 下的 `cn`）。
* **URLs**: 可通过 URL 下载的远程文件 — 见下方 [URL 文件类型](#url-file-types)。
* **域名**: 手动添加的域名条目（完整域名、后缀、关键词等）。

### 小IP集合 [#小ip集合]

* **名称**: 路由规则引用的唯一标识符。
* **反向**: 与域名集合相同 — 匹配 **不在** 集合源中的 IP。
* **GeoIP URL**: 自定义 `geoip.dat` 文件的 HTTPS URL。若为空，VX 使用 LoyalSoldier 提供的 `geosite.dat`。
* **GeoIP Codes**: geoip 数据中的类别（如 `cn`、`private`）。
* **URLs**: 可通过 URL 下载的远程文件
* **CIDRs**: 手动添加的 IP 范围。

### 支持的 URL 文件类型 [#支持的-url-文件类型]

* V2ray GeoSite / GeoIP 文件

* Clash Rules

### Geo 文件更新 [#geo-文件更新]

VX 会定期从小集合中指定的 URL 下载 geo 文件。

在 **设置 → 常规 → 自动更新 Geo 文件** 中配置自动更新：

* **自动更新地理位置文件**: 启用定期重新下载 geo 文件。
* **更新间隔**: 刷新频率，单位 **天**（最少 1）。默认 **7 天**。
* **立即更新**: 立即触发下载与处理。

## 集合名称不可重复 [#集合名称不可重复]

每个类别（域名/IP/应用）内集合名称必须唯一：

* **小域名集合** 名称不可与其他小或大域名集合相同。
* **大域名集合** 名称不可与任何现有小或大域名集合相同。
* 新名称也不可与其他集合的 **互斥集合名称** 相同。

IP 集合（原子与组合）适用相同规则。

## 内置 geo 集合 [#内置-geo-集合]

VX 始终包含以下内置集合：

### 小域名集合 [#小域名集合-1]

* **自定义代理**: 在简化视图的代理段添加/删除域名时编辑的集合
* **自定义直连**: 在简化视图的直连段添加/删除域名时编辑的集合

### 小 IP 集合 [#小-ip-集合]

* **自定义代理**: 在简化视图的代理段添加/删除 IP 时编辑的集合
* **自定义直连**: 在简化视图的直连段添加/删除 IP 时编辑的集合

### 应用集合 [#应用集合]

* **代理**: 在简化视图的代理段添加/删除应用时编辑的集合
* **直连**: 在简化视图的直连段添加/删除应用时编辑的集合

## 相关 [#相关]

* [简化路由](/zh/docs/vx/manual/customize/simplified) — 快速编辑 自定义代理 / 自定义直连
* [路由模式](/zh/docs/vx/manual/customize/modes) — 集合如何与规则关联


# 简化视图 (/zh/docs/vx/manual/customize/simplified)



**简化** 页面为默认视图。它隐藏复杂的模式、规则顺序与集合组合 — 您只需选择 **什么** 应走代理或直连。

您的选择将优先于默认路由。例如，**google.com** 是 GFW 屏蔽的域名，使用 GFW 模式时默认走代理；但若您将 google.com 加入直连，则按您指定走直连。

## 添加与删除条目 [#添加与删除条目]

* 点击 &#x2A;*+** 输入域名、IP 或应用
* **长按** 或 **右键**  → 删除
* **双击** 删除

> **说明：** 添加/删除元素无需重启 VX，立即生效。

在 安卓平台 上，直连应用中带 精确 类型的应用不会经过 VX，这可提升性能并降低耗电。因此建议将所有应直连的应用加入直连。

## 与集合的关系 [#与集合的关系]

添加/删除元素时，实际是在向集合增删元素。
例如，在添加一个域名到代理里，实际是将该域名加入「自定义代理」集合。

#### 对应的域名与IP结合 [#对应的域名与ip结合]

* `代理` (`域名`): **自定义代理**
* `代理` (`IP`): **自定义代理**
* `直连` (`域名`): **自定义直连**
* `直连` (`IP`): **自定义直连**

#### 应用 [#应用]

* `代理` (`应用`): **代理**
* `直连` (`应用`): **直连**

## 相关 [#相关]

* [集合](/zh/docs/vx/manual/customize/sets) — 域名集合、IP 集合与应用集合


# AnyTLS (/zh/docs/vx-core/configuration/protocols/anytls)



AnyTLS 多路复用 TLS 隧道协议。Proto：[`protos/proto/vx/proxy/anytls/anytls.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/proxy/anytls/anytls.proto)

通常配合 [TLS](/zh/docs/vx-core/configuration/security/tls) 或 [WebSocket](/zh/docs/vx-core/configuration/transport/websocket) 传输使用。

## AnytlsServerConfig [#anytlsserverconfig]

<ProtoField name="users" type="UserConfig[]">
  允许的用户；认证密码在 `secret` 中
</ProtoField>

```json
{
  "@type": "type.googleapis.com/vx.proxy.anytls.AnytlsServerConfig",
  "users": [{ "secret": "your-password" }]
}
```

## AnytlsClientConfig [#anytlsclientconfig]

<ProtoField name="password" type="string">
  认证密码，与服务器 `users[].secret` 对应
</ProtoField>

<ProtoField name="idleSessionCheckInterval" type="uint32">
  空闲会话检查间隔（**秒**，默认 30）
</ProtoField>

<ProtoField name="idleSessionTimeout" type="uint32">
  会话空闲超过此时长后关闭（**秒**，默认 30）
</ProtoField>

<ProtoField name="minIdleSession" type="uint32">
  连接池保持的最小空闲会话数（默认 5）
</ProtoField>

```json
{
  "@type": "type.googleapis.com/vx.proxy.anytls.AnytlsClientConfig",
  "password": "your-password",
  "idleSessionCheckInterval": 30,
  "idleSessionTimeout": 60,
  "minIdleSession": 4
}
```

## 相关 [#相关]

* [TLS](/zh/docs/vx-core/configuration/security/tls)
* [WebSocket](/zh/docs/vx-core/configuration/transport/websocket)


# Freedom、Blackhole、Dokodemo (/zh/docs/vx-core/configuration/protocols/builtin)



## Freedom [#freedom]

直连出站 — 流量不经上游代理发出。

Proto：[`freedom.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/proxy/freedom/freedom.proto)

`FreedomConfig` 无字段。

```json
{
  "@type": "type.googleapis.com/vx.proxy.freedom.FreedomConfig"
}
```

用作服务器默认 `direct` 出站。

***

## Blackhole [#blackhole]

丢弃流量（阻断）。

Proto：[`blackhole.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/proxy/blackhole/blackhole.proto)

`BlackholeConfig` 无字段。

```json
{
  "@type": "type.googleapis.com/vx.proxy.blackhole.BlackholeConfig"
}
```

***

## Dokodemo-door [#dokodemo-door]

透明重定向 / 端口转发入站。

Proto：[`dokodemo.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/proxy/dokodemo/dokodemo.proto)

<ProtoField name="address">
  转发目标地址
</ProtoField>

<ProtoField name="port">
  目标端口
</ProtoField>

<ProtoField name="networks">
  `TCP`、`UDP` 等
</ProtoField>

```json
{
  "@type": "type.googleapis.com/vx.proxy.dokodemo.DokodemoConfig",
  "address": "127.0.0.1",
  "port": 8080,
  "networks": ["TCP"]
}
```


# HTTP proxy (/zh/docs/vx-core/configuration/protocols/http-proxy)



标准 HTTP 代理协议（`CONNECT` 隧道与普通 HTTP 转发）。Proto：[`protos/proto/vx/proxy/http/http.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/proxy/http/http.proto)

这不是 HTTP **传输**伪装（`TransportConfig.http`）— 见[传输 HTTP](/zh/docs/vx-core/configuration/transport/http)。

* **入站**（`HttpServerConfig`）：接受客户端 HTTP 代理请求，支持 `CONNECT` 与普通 HTTP（绝对 URL）
* **出站**（`HttpClientConfig`）：向上游 HTTP 代理发起 `CONNECT`，建立 TCP 隧道。不支持 UDP

## HttpServerConfig [#httpserverconfig]

空消息，无配置字段。

入站处理器支持：

* **`CONNECT`** — 返回 `200 Connection established` 后中继 TCP 流
* **普通 HTTP** — 转发带绝对 URL 的 HTTP/1.1 请求（非 `CONNECT`）

仅支持 TCP（及 UNIX 套接字）入站。`HttpServerConfig` 本身不包含认证字段。

```json
{
  "@type": "type.googleapis.com/vx.proxy.http.HttpServerConfig"
}
```

## HttpClientConfig [#httpclientconfig]

<ProtoField name="account" type="Account">
  可选 HTTP 代理认证。非空时在 `CONNECT` 请求中发送 `Proxy-Authorization: Basic ...` 头。
</ProtoField>

<ProtoField name="h1SkipWaitForReply" type="bool">
  HTTP/1 `CONNECT` 优化，默认 `false`。

  * `false`：先发送 `CONNECT` 请求，等待代理返回 `200` 后再发送首批载荷
  * `true`：将首批载荷与 `CONNECT` 请求写在同一次写入中（适用于要求首包随握手发出的上游）；同时把等待首批载荷的超时延长至 1 秒

  对 HTTP/2 `CONNECT` 无影响（HTTP/2 本就可在请求体中携带首批数据）。
</ProtoField>

```json
{
  "@type": "type.googleapis.com/vx.proxy.http.HttpClientConfig",
  "account": {
    "username": "user",
    "password": "pass"
  }
}
```

## Account [#account]

<ProtoField name="username" type="string">
  代理认证用户名
</ProtoField>

<ProtoField name="password" type="string">
  代理认证密码
</ProtoField>

## 相关 [#相关]

* [传输 HTTP](/zh/docs/vx-core/configuration/transport/http) — HTTP/2 传输伪装（不同用途）
* [出站](/zh/docs/vx-core/configuration/outbounds) — `protocol` 中嵌入 `HttpClientConfig`
* [入站](/zh/docs/vx-core/configuration/inbounds) — `protocol` 中嵌入 `HttpServerConfig`


# Hysteria2 (/zh/docs/vx-core/configuration/protocols/hysteria)



Proto：[`protos/proto/vx/proxy/hysteria/hysteria.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/proxy/hysteria/hysteria.proto)

Hysteria2 基于 QUIC。TLS 在协议内通过 `tlsConfig` 配置（[TlsConfig](/zh/docs/vx-core/configuration/security/tls)），而非 `TransportConfig.tls`。

## Hysteria2ServerConfig [#hysteria2serverconfig]

<ProtoField name="users" type="UserConfig[]">
  允许的用户；认证密码在 `secret` 中
</ProtoField>

<ProtoField name="obfs" type="ObfsConfig">
  流量混淆，见 [ObfsConfig](#obfsconfig)
</ProtoField>

<ProtoField name="bandwidth" type="BandwidthConfig">
  服务端带宽上限，见 [BandwidthConfig](#bandwidthconfig)
</ProtoField>

<ProtoField name="quic" type="QuicConfig">
  QUIC 调优，见 [QuicConfig](#quicconfig)
</ProtoField>

<ProtoField name="ignoreClientBandwidth" type="bool">
  忽略客户端上报的带宽提示
</ProtoField>

<ProtoField name="tlsConfig" type="TlsConfig">
  服务端 TLS 证书与设置
</ProtoField>

<ProtoField name="addresses" type="string[]">
  监听 / 对外宣告的地址
</ProtoField>

```json
{
  "@type": "type.googleapis.com/vx.proxy.hysteria.Hysteria2ServerConfig",
  "users": [{ "secret": "auth-password" }],
  "tlsConfig": {
    "certificates": [{ "certificateFilepath": "/path/cert.pem", "keyFilepath": "/path/key.pem" }]
  }
}
```

## Hysteria2ClientConfig [#hysteria2clientconfig]

<ProtoField name="auth" type="string">
  认证密码，与服务器 `users[].secret` 对应
</ProtoField>

<ProtoField name="tlsConfig" type="TlsConfig">
  客户端 TLS（SNI、`allowInsecure`、ECH、证书固定等）
</ProtoField>

<ProtoField name="quic" type="QuicConfig">
  QUIC 调优
</ProtoField>

<ProtoField name="fastOpen" type="bool">
  启用 QUIC 0-RTT 快速打开
</ProtoField>

<ProtoField name="bandwidth" type="BandwidthConfig">
  客户端带宽声明（上传 `maxTx`、下载 `maxRx`）
</ProtoField>

<ProtoField name="obfs" type="ObfsConfig">
  Salamander 混淆
</ProtoField>

```json
{
  "@type": "type.googleapis.com/vx.proxy.hysteria.Hysteria2ClientConfig",
  "auth": "auth-password",
  "tlsConfig": { "serverName": "example.com" }
}
```

## QuicConfig [#quicconfig]

窗口字段有两组：**MB** 字段（`initialStreamReceiveWindow` 等，`uint32`，内部 × 1 MiB）与 **bytes** 字段（`initialStreamReceiveWindowBytes` 等，`uint64`）。MB 字段非零时优先；均为零时使用 bytes 字段或平台默认值。

<ProtoField name="initialStreamReceiveWindow" type="uint32">
  初始流接收窗口（MiB）
</ProtoField>

<ProtoField name="maxStreamReceiveWindow" type="uint32">
  最大流接收窗口（MiB）
</ProtoField>

<ProtoField name="initialConnectionReceiveWindow" type="uint32">
  初始连接接收窗口（MiB）
</ProtoField>

<ProtoField name="maxConnectionReceiveWindow" type="uint32">
  最大连接接收窗口（MiB）
</ProtoField>

<ProtoField name="initialStreamReceiveWindowBytes" type="uint64">
  初始流接收窗口（字节）
</ProtoField>

<ProtoField name="maxStreamReceiveWindowBytes" type="uint64">
  最大流接收窗口（字节）
</ProtoField>

<ProtoField name="initialConnectionReceiveWindowBytes" type="uint64">
  初始连接接收窗口（字节）
</ProtoField>

<ProtoField name="maxConnectionReceiveWindowBytes" type="uint64">
  最大连接接收窗口（字节）
</ProtoField>

<ProtoField name="maxIdleTimeout" type="uint32">
  空闲超时（**秒**，默认 30）
</ProtoField>

<ProtoField name="keepAlivePeriod" type="uint32">
  Keep-alive 周期（**秒**，默认 10）
</ProtoField>

<ProtoField name="disablePathMtuDiscovery" type="bool">
  禁用 QUIC 路径 MTU 发现
</ProtoField>

<ProtoField name="maxIncomingStreams" type="uint32">
  最大入站流数（**仅服务端**）
</ProtoField>

## ObfsConfig [#obfsconfig]

`salamander` 为当前唯一混淆类型（oneof）。

<ProtoField name="salamander" type="SalamanderConfig">
  Salamander 混淆配置
</ProtoField>

### SalamanderConfig [#salamanderconfig]

<ProtoField name="password" type="string">
  混淆密码
</ProtoField>

## BandwidthConfig [#bandwidthconfig]

`maxTx` / `maxRx` 单位为 **Mbps**（内部转换为字节/秒）。

<ProtoField name="maxTx" type="uint32">
  上传带宽上限。客户端为上传；服务端为允许的最大上传
</ProtoField>

<ProtoField name="maxRx" type="uint32">
  下载带宽上限。客户端为下载；服务端为允许的最大下载
</ProtoField>

## 相关 [#相关]

* [TLS](/zh/docs/vx-core/configuration/security/tls) — `tlsConfig` 字段
* [出站](/zh/docs/vx-core/configuration/outbounds) — UDP 出站


# 代理协议 (/zh/docs/vx-core/configuration/protocols)



代理协议设置嵌入 [入站](/zh/docs/vx-core/configuration/inbounds) 的 `protocol` / `protocols` 与 [出站](/zh/docs/vx-core/configuration/outbounds) 的 `protocol`，类型为 `google.protobuf.Any`。

在 ProtoJSON 中，将 `@type` 设为：

```
type.googleapis.com/<protobuf full name>
```

Protobuf 包名使用点号（例如 `vx.proxy.vmess.VmessServerConfig`）。

## 服务端与客户端消息 [#服务端与客户端消息]

* **VMess** — Server: `vx.proxy.vmess.VmessServerConfig`, Client: `vx.proxy.vmess.VmessClientConfig`
* **VLESS** — Server: `vx.proxy.vless.VlessServerConfig`, Client: `vx.proxy.vless.VlessClientConfig`
* **Trojan** — Server: `vx.proxy.trojan.TrojanServerConfig`, Client: `vx.proxy.trojan.TrojanClientConfig`
* **Shadowsocks** — Server: `vx.proxy.shadowsocks.ShadowsocksServerConfig`, Client: `vx.proxy.shadowsocks.ShadowsocksClientConfig`
* **Shadowsocks 2022** — Server: `vx.proxy.shadowsocks2022.Shadowsocks2022ServerConfig`, Client: `vx.proxy.shadowsocks2022.Shadowsocks2022ClientConfig`
* **SOCKS** — Server: `vx.proxy.socks.SocksServerConfig`, Client: `vx.proxy.socks.SocksClientConfig`
* **HTTP proxy** — Server: `vx.proxy.http.HttpServerConfig`, Client: `vx.proxy.http.HttpClientConfig`
* **Hysteria2** — Server: `vx.proxy.hysteria.Hysteria2ServerConfig`, Client: `vx.proxy.hysteria.Hysteria2ClientConfig`
* **AnyTLS** — Server: `vx.proxy.anytls.AnytlsServerConfig`, Client: `vx.proxy.anytls.AnytlsClientConfig`
* **WireGuard** — Client: `vx.proxy.wireguard.DeviceConfig`
* **Freedom** — Server: `vx.proxy.freedom.FreedomConfig`, Client: 同上
* **Blackhole** — Server: `vx.proxy.blackhole.BlackholeConfig`, Client: 同上
* **Dokodemo** — Server: `vx.proxy.dokodemo.DokodemoConfig`, Client: 同上

## 传输与 TLS [#传输与-tls]

多数代理协议运行在原始 TCP 或 UDP 上。需要 TLS、WebSocket、gRPC、REALITY 等时，在入站/出站设置 `transport` 为 [TransportConfig](/zh/docs/vx-core/configuration/transport)（或对多入站使用 [MultiProxyInboundConfig](/zh/docs/vx-core/configuration/inbounds) 按 SNI 矩阵配置）。

Hysteria2 在协议消息内嵌 `tlsConfig`。

## 章节 [#章节]

<Cards>
  <Card title="VMess" href="/zh/docs/vx-core/configuration/protocols/vmess" />

  <Card title="VLESS" href="/zh/docs/vx-core/configuration/protocols/vless" />

  <Card title="Trojan" href="/zh/docs/vx-core/configuration/protocols/trojan" />

  <Card title="Shadowsocks" href="/zh/docs/vx-core/configuration/protocols/shadowsocks" />

  <Card title="SOCKS" href="/zh/docs/vx-core/configuration/protocols/socks" />

  <Card title="HTTP proxy" href="/zh/docs/vx-core/configuration/protocols/http-proxy" />

  <Card title="Hysteria2" href="/zh/docs/vx-core/configuration/protocols/hysteria" />

  <Card title="AnyTLS" href="/zh/docs/vx-core/configuration/protocols/anytls" />

  <Card title="WireGuard" href="/zh/docs/vx-core/configuration/protocols/wireguard" />

  <Card title="Freedom / Blackhole / Dokodemo" href="/zh/docs/vx-core/configuration/protocols/builtin" />
</Cards>

Proto 树：[`protos/proto/vx/proxy/`](https://github.com/5vnetwork/vx-core/tree/main/protos/proto/vx/proxy)。


# Shadowsocks (/zh/docs/vx-core/configuration/protocols/shadowsocks)



经典 Shadowsocks 与 Shadowsocks 2022 分别使用不同的 protobuf 消息，通过 [入站](/zh/docs/vx-core/configuration/inbounds) `protocol` / [出站](/zh/docs/vx-core/configuration/outbounds) `protocol` 的 `Any` 字段配置。

## Shadowsocks（经典） [#shadowsocks经典]

Proto：[`protos/proto/vx/proxy/shadowsocks/shadowsocks.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/proxy/shadowsocks/shadowsocks.proto)

支持 TCP 与 UDP。

### ShadowsocksCipherType [#shadowsocksciphertype]

<ProtoField name="AES_128_GCM" type="0" />

<ProtoField name="AES_256_GCM" type="1" />

<ProtoField name="CHACHA20_POLY1305" type="2" />

<ProtoField name="NONE" type="3" />

JSON 中使用枚举名（如 `"cipherType": "CHACHA20_POLY1305"`）。`NONE` 表示不加密载荷，通常仅在与外层 TLS 等组合时使用。

### ShadowsocksServerConfig [#shadowsocksserverconfig]

<ProtoField name="cipherType" type="ShadowsocksCipherType">
  加密算法
</ProtoField>

<ProtoField name="ivCheck" type="bool">
  `true` 时启用 IV 重放检测（Bloom 过滤器），拒绝重复 IV
</ProtoField>

<ProtoField name="user" type="UserConfig">
  单个用户；`secret` 为 Shadowsocks 密码
</ProtoField>

<ProtoField name="experimentReducedIvHeadEntropy" type="bool">
  实验选项：将 IV 前 6 字节映射为可打印字符，降低 IV 熵以便某些流量伪装场景
</ProtoField>

```json
{
  "@type": "type.googleapis.com/vx.proxy.shadowsocks.ShadowsocksServerConfig",
  "cipherType": "CHACHA20_POLY1305",
  "ivCheck": true,
  "user": { "secret": "your-password" }
}
```

### ShadowsocksClientConfig [#shadowsocksclientconfig]

<ProtoField name="cipherType" type="ShadowsocksCipherType">
  须与服务器 `cipherType` 一致
</ProtoField>

<ProtoField name="password" type="string">
  预共享密钥（PSK），与服务器 `user.secret` 相同
</ProtoField>

```json
{
  "@type": "type.googleapis.com/vx.proxy.shadowsocks.ShadowsocksClientConfig",
  "cipherType": "CHACHA20_POLY1305",
  "password": "your-password"
}
```

***

## Shadowsocks 2022 [#shadowsocks-2022]

Proto：[`protos/proto/vx/proxy/shadowsocks2022/shadowsocks2022.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/proxy/shadowsocks2022/shadowsocks2022.proto)

基于 sing-shadowsocks 的 AEAD 2022 实现。支持的 `method`：

* `2022-blake3-aes-128-gcm` — PSK 16 字节
* `2022-blake3-aes-256-gcm` — PSK 32 字节
* `2022-blake3-chacha20-poly1305` — PSK 32 字节

PSK 可为合法 base64（长度满足要求），否则核心会用 BLAKE3 从明文密码派生所需长度。

### Shadowsocks2022ServerConfig [#shadowsocks2022serverconfig]

<ProtoField name="method" type="string">
  加密套件字符串（见上方支持列表）
</ProtoField>

<ProtoField name="user" type="UserConfig">
  单个用户；`secret` 为 PSK（base64 或明文，客户端侧处理逻辑相同）
</ProtoField>

<ProtoField name="networks" type="Network[]">
  允许的网络（`TCP`、`UDP` 等）。为空时默认 `TCP` 与 `UDP`。
</ProtoField>

```json
{
  "@type": "type.googleapis.com/vx.proxy.shadowsocks2022.Shadowsocks2022ServerConfig",
  "method": "2022-blake3-aes-128-gcm",
  "user": { "secret": "base64-or-raw-key" }
}
```

### Shadowsocks2022ClientConfig [#shadowsocks2022clientconfig]

<ProtoField name="method" type="string">
  须与服务器 `method` 一致
</ProtoField>

<ProtoField name="key" type="string">
  PSK / 密钥材料，与服务器 `user.secret` 相同
</ProtoField>

```json
{
  "@type": "type.googleapis.com/vx.proxy.shadowsocks2022.Shadowsocks2022ClientConfig",
  "method": "2022-blake3-aes-128-gcm",
  "key": "base64-or-raw-key"
}
```

## 相关 [#相关]

* [传输](/zh/docs/vx-core/configuration/transport) — WebSocket、TLS 等
* [用户](/zh/docs/vx-core/configuration/users) — `UserConfig`


# SOCKS (/zh/docs/vx-core/configuration/protocols/socks)



SOCKS 代理配置。Proto：[`protos/proto/vx/proxy/socks/socks.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/proxy/socks/socks.proto)

服务端入站支持 **SOCKS5**（TCP 连接与 UDP associate），并在 `authType` 为 `NO_AUTH` 时兼容 **SOCKS4/4a** TCP。客户端出站使用 **SOCKS5** 握手。

## AuthType [#authtype]

<ProtoField name="NO_AUTH" type="0" />

<ProtoField name="PASSWORD" type="1" />

JSON 中使用枚举名（如 `"authType": "PASSWORD"`）。

* `NO_AUTH`：无需用户名/密码；允许 SOCKS4/4a 客户端
* `PASSWORD`：须 SOCKS5 用户名/密码认证；SOCKS4 请求会被拒绝

## SocksServerConfig [#socksserverconfig]

<ProtoField name="authType" type="AuthType">
  认证模式
</ProtoField>

<ProtoField name="accounts" type="UserConfig[]">
  `PASSWORD` 时允许的用户列表。`id` 为用户名，`secret` 为密码。
</ProtoField>

<ProtoField name="address" type="string">
  用于 SOCKS 应答中的 **BND.ADDR**。主要影响 **UDP ASSOCIATE** 回复中的绑定地址：若设置则使用该 IP；否则对本地客户端回环地址，对外部客户端使用入站监听地址。
</ProtoField>

<ProtoField name="udpEnabled" type="bool">
  `true` 时允许 SOCKS5 `UDP ASSOCIATE` 命令并启用入站 UDP 中继。`false` 时 UDP 命令返回不支持。
</ProtoField>

```json
{
  "@type": "type.googleapis.com/vx.proxy.socks.SocksServerConfig",
  "authType": "PASSWORD",
  "udpEnabled": true,
  "address": "203.0.113.1",
  "accounts": [{ "id": "u1", "secret": "pass" }]
}
```

## SocksClientConfig [#socksclientconfig]

<ProtoField name="name" type="string">
  SOCKS5 用户名。与 `password` 均为空时不发送密码认证（对应服务器 `NO_AUTH`）。
</ProtoField>

<ProtoField name="password" type="string">
  SOCKS5 密码，与服务器 `accounts[].secret` 对应。
</ProtoField>

<ProtoField name="delayAuthWrite" type="bool">
  `false`（默认）：在初始握手报文中一并发送认证信息。

  `true`：先发送支持的认证方法，待服务器选定 `PASSWORD` 后再写入用户名/密码。用于需要分步握手的上游 SOCKS 服务器。
</ProtoField>

```json
{
  "@type": "type.googleapis.com/vx.proxy.socks.SocksClientConfig",
  "name": "u1",
  "password": "pass"
}
```

## 相关 [#相关]

* [用户](/zh/docs/vx-core/configuration/users) — `UserConfig`
* [传输](/zh/docs/vx-core/configuration/transport) — 常与 TCP 入站/出站配合


# Trojan (/zh/docs/vx-core/configuration/protocols/trojan)



Proto：[`protos/proto/vx/proxy/trojan/trojan.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/proxy/trojan/trojan.proto)

## TrojanServerConfig [#trojanserverconfig]

<ProtoField name="users" type="UserConfig[]">
  密码在 `secret` 中
</ProtoField>

<ProtoField name="vision" type="bool">
  启用 **Trojan Vision**（与 VLESS 的 `xtls-rprx-vision` 类似）。客户端与服务器须**同时**开启。
</ProtoField>

```json
{
  "@type": "type.googleapis.com/vx.proxy.trojan.TrojanServerConfig",
  "vision": true,
  "users": [{ "id": "user1", "secret": "your-password" }]
}
```

## TrojanClientConfig [#trojanclientconfig]

<ProtoField name="password" type="string">
  Trojan 密码
</ProtoField>

<ProtoField name="vision" type="bool">
  启用 Trojan Vision
</ProtoField>


# VLESS (/zh/docs/vx-core/configuration/protocols/vless)



Proto：[`protos/proto/vx/proxy/vless/vless.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/proxy/vless/vless.proto)

## VlessServerConfig [#vlessserverconfig]

<ProtoField name="users" type="UserConfig[]" />

## VlessClientConfig [#vlessclientconfig]

<ProtoField name="id" type="string">
  账户 UUID
</ProtoField>

<ProtoField name="flow" type="string">
  流控，例如 `xtls-rprx-vision`
</ProtoField>

<ProtoField name="encryption" type="string">
  仅客户端；当前为 `none`
</ProtoField>

```json
{
  "@type": "type.googleapis.com/vx.proxy.vless.VlessClientConfig",
  "id": "66ad4540-b58c-4ad2-9926-ea63445a9b57",
  "flow": "xtls-rprx-vision",
  "encryption": "none"
}
```

Vision 流控通常与传输上的 [REALITY](/zh/docs/vx-core/configuration/security/reality) 或 [TLS](/zh/docs/vx-core/configuration/security/tls) 配合使用。


# VMess (/zh/docs/vx-core/configuration/protocols/vmess)



Proto：[`protos/proto/vx/proxy/vmess/vmess.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/proxy/vmess/vmess.proto)

## VmessServerConfig [#vmessserverconfig]

<ProtoField name="accounts" type="UserConfig[]">
  允许的用户（`id`、`userLevel`、`secret`）
</ProtoField>

<ProtoField name="secureEncryptionOnly" type="bool">
  拒绝旧版加密
</ProtoField>

```json
{
  "@type": "type.googleapis.com/vx.proxy.vmess.VmessServerConfig",
  "secureEncryptionOnly": true,
  "accounts": [{ "id": "uuid-here", "userLevel": 0 }]
}
```

## VmessClientConfig [#vmessclientconfig]

<ProtoField name="id" type="string">
  类似于密码，可以是任意string
</ProtoField>

<ProtoField name="security" type="SecurityType">
  见下方
</ProtoField>

<ProtoField name="alterId" type="uint32">
  旧版 alterId（通常为 0）
</ProtoField>

### SecurityType [#securitytype]

<ProtoField name="UNKNOWN" type="0" />

<ProtoField name="LEGACY" type="1" />

<ProtoField name="AUTO" type="2" />

<ProtoField name="AES128_GCM" type="3" />

<ProtoField name="CHACHA20_POLY1305" type="4" />

<ProtoField name="NONE" type="5" />

<ProtoField name="ZERO" type="6" />

JSON 中使用枚举名（例如 `"security": "CHACHA20_POLY1305"`）。

## 相关 [#相关]

* [传输](/zh/docs/vx-core/configuration/transport) — WebSocket、TLS 等
* [用户](/zh/docs/vx-core/configuration/users)


# WireGuard (/zh/docs/vx-core/configuration/protocols/wireguard)



Proto：[`protos/proto/vx/proxy/wireguard/config.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/proxy/wireguard/config.proto)

WireGuard 仅作为**出站** `DeviceConfig` 使用（此 proto 无 `*ServerConfig`）。

## DeviceConfig [#deviceconfig]

<ProtoField name="secretKey" type="string">
  本地接口私钥（WireGuard 密钥格式）
</ProtoField>

<ProtoField name="endpoint" type="string[]">
  设备级端点主机列表（可选）
</ProtoField>

<ProtoField name="peers" type="PeerConfig[]">
  远端对等体，见 [PeerConfig](#peerconfig)
</ProtoField>

<ProtoField name="mtu" type="int32">
  TUN 接口 MTU
</ProtoField>

<ProtoField name="numWorkers" type="int32">
  加密工作线程数
</ProtoField>

<ProtoField name="reserved" type="bytes">
  WireGuard 协议保留字节（3 字节，用于绕过封锁）
</ProtoField>

<ProtoField name="noKernelTun" type="bool">
  `true` 时仅使用用户空间 TUN，不使用内核 WireGuard
</ProtoField>

```json
{
  "@type": "type.googleapis.com/vx.proxy.wireguard.DeviceConfig",
  "secretKey": "...",
  "isClient": true,
  "peers": [
    {
      "publicKey": "...",
      "endpoint": "vpn.example.com:51820",
      "allowedIps": ["0.0.0.0/0", "::/0"]
    }
  ]
}
```

## PeerConfig [#peerconfig]

<ProtoField name="publicKey" type="string">
  对等体公钥
</ProtoField>

<ProtoField name="preSharedKey" type="string">
  可选预共享密钥（PSK）
</ProtoField>

<ProtoField name="endpoint" type="string">
  对等体端点 `host:port`
</ProtoField>

<ProtoField name="keepAlive" type="uint32">
  持久 keepalive 间隔（**秒**）
</ProtoField>

<ProtoField name="allowedIps" type="string[]">
  经本对等体路由的 IP CIDR 列表
</ProtoField>

## 相关 [#相关]

* [出站](/zh/docs/vx-core/configuration/outbounds)
* [TCP 头伪装](/zh/docs/vx-core/configuration/transport/tcp) — `wireguard` 头类型


# 安全 (/zh/docs/vx-core/configuration/security)



安全层在线路协议之下加密或伪装连接。设置在 [`TransportConfig`](/zh/docs/vx-core/configuration/transport) 的 `tls` 或 `reality`（与传输协议 oneof）。

```json
{
  "transport": {
    "tcp": {},
    "reality": {
      "dest": "www.microsoft.com:443",
      "serverNames": ["www.example.com"],
      "privateKey": "...",
      "shortIds": ["abcd1234"]
    }
  }
}
```

Hysteria2 在[协议消息](/zh/docs/vx-core/configuration/protocols/hysteria)内使用内联 `tlsConfig`，而非 `TransportConfig`。

## 章节 [#章节]

<Cards>
  <Card title="TLS" href="/zh/docs/vx-core/configuration/security/tls" description="证书、SNI、uTLS、ECH" />

  <Card title="REALITY" href="/zh/docs/vx-core/configuration/security/reality" description="REALITY 服务端与客户端设置" />
</Cards>

Proto 路径：

* [`protos/proto/vx/transport/security/tls/`](https://github.com/5vnetwork/vx-core/tree/main/protos/proto/vx/transport/security/tls)
* [`protos/proto/vx/transport/security/reality/config.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/transport/security/reality/config.proto)


# REALITY (/zh/docs/vx-core/configuration/security/reality)



Proto：[`protos/proto/vx/transport/security/reality/config.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/transport/security/reality/config.proto)

设置在 `TransportConfig.reality` 或 `MultiProxyInboundConfig.securityConfigs[].reality`。

与 `tls` **互斥**（同一传输块只能二选一）。

## RealityConfig [#realityconfig]

### 仅服务端 [#仅服务端]

<ProtoField name="dest" type="string">
  回退目标（例如 `www.microsoft.com:443`）
</ProtoField>

<ProtoField name="xver" type="uint64">
  发往 `dest` 的 PROXY protocol 版本（0 = 不发送）
</ProtoField>

<ProtoField name="serverNames" type="string[]">
  允许的 SNI 服务器名
</ProtoField>

<ProtoField name="privateKey" type="bytes">
  X25519 私钥
</ProtoField>

<ProtoField name="minClientVer" type="bytes">
  允许的客户端最低版本字节
</ProtoField>

<ProtoField name="maxClientVer" type="bytes">
  允许的客户端最高版本字节
</ProtoField>

<ProtoField name="maxTimeDiff" type="uint64">
  最大客户端时钟偏差（**毫秒**）
</ProtoField>

<ProtoField name="shortIds" type="bytes[]">
  允许的 short ID 列表（每项最多 8 字节）
</ProtoField>

### 客户端 [#客户端]

<ProtoField name="show" type="bool">
  调试输出
</ProtoField>

<ProtoField name="Fingerprint" type="string">
  uTLS 指纹（如 `chrome`、`firefox`）
</ProtoField>

<ProtoField name="serverName" type="string">
  呈现的 SNI
</ProtoField>

<ProtoField name="publicKey" type="bytes">
  服务端公钥（字节）
</ProtoField>

<ProtoField name="pbk" type="string">
  公钥（Base64 字符串，与 `publicKey` 等价表示）
</ProtoField>

<ProtoField name="shortId" type="bytes">
  客户端 short ID（字节，须 8 字节）
</ProtoField>

<ProtoField name="sid" type="string">
  Short ID 十六进制字符串（8 字节）
</ProtoField>

<ProtoField name="spiderX" type="string">
  Spider X 路径
</ProtoField>

<ProtoField name="spiderY" type="int64[]">
  Spider Y 值列表
</ProtoField>

<ProtoField name="masterKeyLog" type="string">
  密钥日志路径（调试）
</ProtoField>

```json
{
  "transport": {
    "tcp": {},
    "reality": {
      "dest": "www.microsoft.com:443",
      "serverNames": ["www.example.com"],
      "privateKey": "base64-or-raw",
      "shortIds": ["", "0123456789abcdef"]
    }
  },
  "protocol": {
    "@type": "type.googleapis.com/vx.proxy.vless.VlessServerConfig",
    "users": [{ "id": "uuid", "flow": "" }]
  }
}
```

## 相关 [#相关]

* [TLS](/zh/docs/vx-core/configuration/security/tls) — 与 REALITY 互斥
* [VLESS](/zh/docs/vx-core/configuration/protocols/vless) — Vision 流控
* [入站](/zh/docs/vx-core/configuration/inbounds) — 多入站上的 `securityConfigs`


# TLS (/zh/docs/vx-core/configuration/security/tls)



Protos：

* [`tls.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/transport/security/tls/tls.proto) — `TlsConfig`
* [`certificate.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/transport/security/tls/certificate.proto) — `Certificate`

设置在 `TransportConfig.tls`、`MultiProxyInboundConfig.securityConfigs[].tls`、Hysteria2 `tlsConfig` 以及 SplitHTTP `downloadSettings.tls`。

与 `reality` **互斥**（同一传输块只能二选一）。

## TlsConfig [#tlsconfig]

<ProtoField name="certificates" type="Certificate[]">
  服务端/客户端证书链
</ProtoField>

<ProtoField name="rootCas" type="bytes[]">
  自定义根 CA PEM（每项为一段 PEM 字节）
</ProtoField>

<ProtoField name="issueCas" type="Certificate[]">
  用于向对等体签发证书的 CA
</ProtoField>

<ProtoField name="serverName" type="string">
  SNI；拨号时默认等于目标域名
</ProtoField>

<ProtoField name="disableSystemRoot" type="bool">
  不使用系统根 CA
</ProtoField>

<ProtoField name="allowInsecure" type="bool">
  跳过证书校验（**客户端**）
</ProtoField>

<ProtoField name="nextProtocol" type="string[]">
  ALPN 列表（如 `h2`、`http/1.1`）
</ProtoField>

<ProtoField name="enableSessionResumption" type="bool">
  启用 TLS 会话票证 / 恢复
</ProtoField>

<ProtoField name="pinnedPeerCertificateChainSha256" type="bytes[]">
  固定对等体证书链 SHA-256 哈希（每项为 32 字节）
</ProtoField>

<ProtoField name="verifyClientCertificate" type="bool">
  要求有效客户端证书（**服务端**）
</ProtoField>

<ProtoField name="imitate" type="string">
  uTLS 客户端指纹名称（如 `chrome`）
</ProtoField>

<ProtoField name="noSNI" type="bool">
  不发送 SNI（uTLS）
</ProtoField>

<ProtoField name="forceAlpn" type="ForceALPN">
  ALPN 行为，见 [ForceALPN](#forcealpn)
</ProtoField>

<ProtoField name="masterKeyLog" type="string">
  NSS 密钥日志路径（调试）
</ProtoField>

<ProtoField name="echKey" type="bytes">
  服务端 ECH 密钥
</ProtoField>

<ProtoField name="echConfig" type="bytes">
  客户端 ECH 配置 blob
</ProtoField>

<ProtoField name="enableEch" type="bool">
  客户端：启用 ECH
</ProtoField>

### ForceALPN [#forcealpn]

<ProtoField name="TRANSPORT_PREFERENCE_TAKE_PRIORITY" type="0">
  用户设置 ALPN 则用之，否则传输默认
</ProtoField>

<ProtoField name="NO_ALPN" type="1">
  不发送 ALPN 扩展
</ProtoField>

<ProtoField name="UTLS_PRESET" type="2">
  使用 uTLS 预设 ALPN
</ProtoField>

## Certificate [#certificate]

证书与私钥可内联 PEM 字节，或通过文件路径加载（路径优先于内联）。

<ProtoField name="certificate" type="bytes">
  PEM 证书字节
</ProtoField>

<ProtoField name="key" type="bytes">
  PEM 私钥字节
</ProtoField>

<ProtoField name="certificateFilepath" type="string">
  证书文件路径
</ProtoField>

<ProtoField name="keyFilepath" type="string">
  私钥文件路径
</ProtoField>

```json
{
  "transport": {
    "tcp": {},
    "tls": {
      "serverName": "example.com",
      "certificates": [
        {
          "certificateFilepath": "/etc/vx/fullchain.pem",
          "keyFilepath": "/etc/vx/privkey.pem"
        }
      ],
      "nextProtocol": ["h2", "http/1.1"]
    }
  }
}
```

## 相关 [#相关]

* [REALITY](/zh/docs/vx-core/configuration/security/reality) — 与 TLS 互斥的替代安全层
* [WebSocket](/zh/docs/vx-core/configuration/transport/websocket) / [gRPC](/zh/docs/vx-core/configuration/transport/grpc) — 常与 443 端口 TLS 配合
* [VLESS Vision](/zh/docs/vx-core/configuration/protocols/vless) — 与 TLS 或 REALITY 的 `flow`


# gRPC (/zh/docs/vx-core/configuration/transport/grpc)



Proto：[`protos/proto/vx/transport/protocols/grpc/config.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/transport/protocols/grpc/config.proto)

设置在 `TransportConfig.grpc`。

## GrpcConfig [#grpcconfig]

<ProtoField name="authority" type="string">
  `:authority` 伪头
</ProtoField>

<ProtoField name="serviceName" type="string">
  gRPC 服务名
</ProtoField>

<ProtoField name="multiMode" type="bool">
  多流模式
</ProtoField>

<ProtoField name="idleTimeout" type="int32">
  空闲超时（秒）
</ProtoField>

<ProtoField name="healthCheckTimeout" type="int32">
  健康检查超时
</ProtoField>

<ProtoField name="permitWithoutStream" type="bool">
  无活跃流时允许 ping
</ProtoField>

<ProtoField name="initialWindowsSize" type="int32">
  初始窗口大小
</ProtoField>

<ProtoField name="userAgent" type="string">
  User-Agent 覆盖
</ProtoField>

```json
{
  "transport": {
    "grpc": {
      "serviceName": "GunService",
      "multiMode": true
    },
    "tls": { "serverName": "example.com" }
  }
}
```


# HTTP transport (/zh/docs/vx-core/configuration/transport/http)



Proto：[`protos/proto/vx/transport/protocols/http/config.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/transport/protocols/http/config.proto)

HTTP/2 传输伪装（不是 [HTTP proxy](/zh/docs/vx-core/configuration/protocols/http-proxy) 协议）。设置在 `TransportConfig.http`。

## HttpConfig [#httpconfig]

<ProtoField name="host" type="string[]">
  Host 头值（随机选取）
</ProtoField>

<ProtoField name="path" type="string">
  请求路径
</ProtoField>

<ProtoField name="method" type="string">
  HTTP 方法
</ProtoField>

<ProtoField name="header" type="HttpHeader[]">
  自定义头，见 [HttpHeader](#httpheader)
</ProtoField>

### HttpHeader [#httpheader]

<ProtoField name="name" type="string">
  头名称（如 `Accept`、`Cookie`）
</ProtoField>

<ProtoField name="value" type="string[]">
  头值；多项时随机选取一项
</ProtoField>

```json
{
  "transport": {
    "http": {
      "host": ["example.com"],
      "path": "/download",
      "method": "GET"
    },
    "tls": { "serverName": "example.com" }
  }
}
```


# HTTPUpgrade (/zh/docs/vx-core/configuration/transport/httpupgrade)



Proto：[`protos/proto/vx/transport/protocols/httpupgrade/config.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/transport/protocols/httpupgrade/config.proto)

HTTP Upgrade 传输（经 HTTP upgrade 的类 WebSocket）。设置在 `TransportConfig.httpupgrade`。

## HttpUpgradeConfig [#httpupgradeconfig]

<ProtoField name="config" type="WebsocketConfig">
  与 [WebSocket](/zh/docs/vx-core/configuration/transport/websocket) 相同字段
</ProtoField>

```json
{
  "transport": {
    "httpupgrade": {
      "config": {
        "path": "/upgrade",
        "host": "example.com"
      }
    },
    "tls": { "serverName": "example.com" }
  }
}
```


# 传输 (/zh/docs/vx-core/configuration/transport)



传输设置通过 [入站](/zh/docs/vx-core/configuration/inbounds) 与 [出站](/zh/docs/vx-core/configuration/outbounds) 的 `transport: { ... }` 包装代理协议。

根消息：[`TransportConfig`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/transport/transport.proto)，位于 `protos/proto/vx/transport/transport.proto`。

## TransportConfig [#transportconfig]

<ProtoField name="socket" type="SocketConfig">
  套接字选项（mark、TFO、绑定、缓冲区等）。见 [Socket](/zh/docs/vx-core/configuration/transport/socket)。
</ProtoField>

### 线路协议（oneof） [#线路协议oneof]

`tcp`、`kcp`、`websocket`、`http`、`grpc`、`httpupgrade`、`splithttp` 互斥，每个 `TransportConfig` 只能设置其中一项。

<ProtoField name="tcp" type="TcpConfig">
  纯 TCP 传输。见 [TCP](/zh/docs/vx-core/configuration/transport/tcp)。
</ProtoField>

<ProtoField name="kcp" type="KcpConfig">
  基于 UDP 的 KCP 传输。见 [KCP](/zh/docs/vx-core/configuration/transport/kcp)。
</ProtoField>

<ProtoField name="websocket" type="WebsocketConfig">
  WebSocket 传输。见 [WebSocket](/zh/docs/vx-core/configuration/transport/websocket)。
</ProtoField>

<ProtoField name="http" type="HttpConfig">
  HTTP/2 传输伪装。见 [HTTP transport](/zh/docs/vx-core/configuration/transport/http)。
</ProtoField>

<ProtoField name="grpc" type="GrpcConfig">
  gRPC 传输。见 [gRPC](/zh/docs/vx-core/configuration/transport/grpc)。
</ProtoField>

<ProtoField name="httpupgrade" type="HttpUpgradeConfig">
  HTTP Upgrade 传输。见 [HTTPUpgrade](/zh/docs/vx-core/configuration/transport/httpupgrade)。
</ProtoField>

<ProtoField name="splithttp" type="SplitHttpConfig">
  Split HTTP (XHTTP) 传输。见 [SplitHTTP](/zh/docs/vx-core/configuration/transport/splithttp)。
</ProtoField>

### 安全层（oneof） [#安全层oneof]

`tls` 与 `reality` 互斥。见[安全](/zh/docs/vx-core/configuration/security)。

<ProtoField name="tls" type="TlsConfig">
  TLS 证书、SNI、uTLS、ECH
</ProtoField>

<ProtoField name="reality" type="RealityConfig">
  REALITY 伪装
</ProtoField>

### 扩展 [#扩展]

<ProtoField name="transportProtocol" type="Any">
  自定义传输协议的 `Any` 逃生舱
</ProtoField>

<ProtoField name="securityProtocol" type="Any">
  自定义安全协议的 `Any` 逃生舱
</ProtoField>

每个配置应只设置一个**线路协议**与一个**安全**字段（或均不设置）。

## 示例（VLESS + WebSocket + TLS） [#示例vless--websocket--tls]

```json
{
  "tag": "vless-ws",
  "ports": [443],
  "transport": {
    "websocket": { "path": "/ws", "host": "example.com" },
    "tls": {
      "serverName": "example.com",
      "certificates": [
        { "certificateFilepath": "/etc/vx/cert.pem", "keyFilepath": "/etc/vx/key.pem" }
      ]
    }
  },
  "protocol": {
    "@type": "type.googleapis.com/vx.proxy.vless.VlessServerConfig",
    "users": [{ "id": "uuid" }]
  }
}
```

## 线路协议 [#线路协议]

<Cards>
  <Card title="TCP" href="/zh/docs/vx-core/configuration/transport/tcp" />

  <Card title="WebSocket" href="/zh/docs/vx-core/configuration/transport/websocket" />

  <Card title="HTTP" href="/zh/docs/vx-core/configuration/transport/http" />

  <Card title="gRPC" href="/zh/docs/vx-core/configuration/transport/grpc" />

  <Card title="KCP" href="/zh/docs/vx-core/configuration/transport/kcp" />

  <Card title="HTTPUpgrade" href="/zh/docs/vx-core/configuration/transport/httpupgrade" />

  <Card title="SplitHTTP (xhttp)" href="/zh/docs/vx-core/configuration/transport/splithttp" />

  <Card title="Socket" href="/zh/docs/vx-core/configuration/transport/socket" />
</Cards>

## 多入站传输矩阵 [#多入站传输矩阵]

在 `MultiProxyInboundConfig` 上，传输协议在 `transportProtocols[]` 中按 ALPN/SNI/路径选择，而非单一 `TransportConfig`。`securityConfigs[]` 中的安全块同理。见[入站](/zh/docs/vx-core/configuration/inbounds)。


# KCP (/zh/docs/vx-core/configuration/transport/kcp)



Proto：[`protos/proto/vx/transport/protocols/kcp/config.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/transport/protocols/kcp/config.proto)

基于 UDP 的 KCP 传输。设置在 `TransportConfig.kcp`。

## KcpConfig [#kcpconfig]

<ProtoField name="mtu" type="uint32">
  MTU
</ProtoField>

<ProtoField name="tti" type="uint32">
  传输时间间隔
</ProtoField>

<ProtoField name="uplinkCapacity" type="uint32">
  上行容量（旧式调参）
</ProtoField>

<ProtoField name="downlinkCapacity" type="uint32">
  下行容量
</ProtoField>

<ProtoField name="congestion" type="bool">
  启用拥塞控制
</ProtoField>

<ProtoField name="writeBuffer" type="uint32">
  写缓冲区大小
</ProtoField>

<ProtoField name="readBuffer" type="uint32">
  读缓冲区大小
</ProtoField>

<ProtoField name="headerConfig" type="Any">
  包头伪装（与 [TCP 头](/zh/docs/vx-core/configuration/transport/tcp) 同族）
</ProtoField>

<ProtoField name="seed" type="string">
  混淆种子
</ProtoField>

```json
{
  "transport": {
    "kcp": {
      "mtu": 1350,
      "tti": 50,
      "uplinkCapacity": 12,
      "downlinkCapacity": 100
    }
  }
}
```


# Socket (/zh/docs/vx-core/configuration/transport/socket)



Proto：[`protos/proto/vx/transport/dlhelper.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/transport/dlhelper.proto)

`SocketConfig` 设置在 `TransportConfig.socket` 与 `MultiProxyInboundConfig.socket`。

## SocketConfig [#socketconfig]

<ProtoField name="mark" type="uint32">
  `SO_MARK`（非零时设置）
</ProtoField>

<ProtoField name="tfo" type="TCPFastOpenState">
  TCP 快速打开，见 [TCPFastOpenState](#tcpfastopenstate)
</ProtoField>

<ProtoField name="tproxy" type="TProxyMode">
  透明代理模式，见 [TProxyMode](#tproxymode)
</ProtoField>

<ProtoField name="receiveOriginalDestAddress" type="bool">
  UDP：启用 `IP_RECVORIGDSTADDR`，接收原始目标地址
</ProtoField>

<ProtoField name="bindAddress" type="bytes">
  绑定本地地址（**Linux only**）
</ProtoField>

<ProtoField name="bindPort" type="uint32">
  绑定本地端口（与 `bindAddress` 配合）
</ProtoField>

<ProtoField name="acceptProxyProtocol" type="bool">
  接受 PROXY protocol v1/v2
</ProtoField>

<ProtoField name="tcpKeepAliveInterval" type="int32">
  TCP keepalive 探测间隔（秒）
</ProtoField>

<ProtoField name="tcpKeepAliveIdle" type="int32">
  TCP keepalive 空闲时间（秒）
</ProtoField>

<ProtoField name="tfoQueueLength" type="uint32">
  TFO 队列长度
</ProtoField>

<ProtoField name="bindToDevice" type="uint32">
  绑定到网络接口索引
</ProtoField>

<ProtoField name="rxBufSize" type="int64">
  接收套接字缓冲区大小（字节）
</ProtoField>

<ProtoField name="txBufSize" type="int64">
  发送套接字缓冲区大小（字节）
</ProtoField>

<ProtoField name="forceBufSize" type="bool">
  强制应用 `rxBufSize` / `txBufSize`
</ProtoField>

<ProtoField name="localAddr4" type="string">
  出站 IPv4 本地地址（拨号 / UDP 监听）
</ProtoField>

<ProtoField name="localAddr6" type="string">
  出站 IPv6 本地地址
</ProtoField>

<ProtoField name="dialTimeout" type="uint32">
  拨号超时覆盖（秒）
</ProtoField>

### TCPFastOpenState [#tcpfastopenstate]

<ProtoField name="AsIs" type="0">
  保持系统当前 TFO 设置不变
</ProtoField>

<ProtoField name="Enable" type="1">
  显式启用 TFO
</ProtoField>

<ProtoField name="Disable" type="2">
  显式禁用 TFO
</ProtoField>

### TProxyMode [#tproxymode]

<ProtoField name="Off" type="0">
  关闭透明代理
</ProtoField>

<ProtoField name="TProxy" type="1">
  TProxy 模式
</ProtoField>

<ProtoField name="Redirect" type="2">
  Redirect 模式
</ProtoField>

```json
{
  "transport": {
    "socket": {
      "tfo": "Enable",
      "tcpKeepAliveIdle": 60
    },
    "tcp": {}
  }
}
```


# SplitHTTP (xhttp) (/zh/docs/vx-core/configuration/transport/splithttp)



Proto：[`protos/proto/vx/transport/protocols/splithttp/config.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/transport/protocols/splithttp/config.proto)

Split HTTP / XHTTP 传输。设置在 `TransportConfig.splithttp`。

## 相关 [#相关]

* [TLS](/zh/docs/vx-core/configuration/security/tls) — 主传输与 `downloadSettings.tls`
* [REALITY](/zh/docs/vx-core/configuration/security/reality) — `downloadSettings.reality`


# TCP (/zh/docs/vx-core/configuration/transport/tcp)



Proto：[`protos/proto/vx/transport/protocols/tcp/config.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/transport/protocols/tcp/config.proto)

纯 TCP 传输。设置在 `TransportConfig.tcp`。

## TcpConfig [#tcpconfig]

<ProtoField name="headerSettings" type="Any">
  连接头伪装（HTTP、TLS、SRTP 等）
</ProtoField>

### 头类型（`headerSettings` @type） [#头类型headersettings-type]

<ProtoField name="vx.transport.headers.noop.Config">
  无头
</ProtoField>

<ProtoField name="vx.transport.headers.http.Config">
  HTTP 请求/响应伪装
</ProtoField>

<ProtoField name="vx.transport.headers.tls.Config">
  TLS 记录伪装
</ProtoField>

<ProtoField name="vx.transport.headers.srtp.Config">
  SRTP 伪装
</ProtoField>

<ProtoField name="vx.transport.headers.utp.Config">
  uTP 伪装
</ProtoField>

<ProtoField name="vx.transport.headers.wechat.Config">
  微信视频伪装
</ProtoField>

<ProtoField name="vx.transport.headers.wireguard.Config">
  WireGuard 伪装
</ProtoField>

HTTP 头配置（`vx.transport.headers.http.Config`）包含 `request` 与 `response`，其中有 `version`、`method`、`uri` 与 `header` 列表。见 [`headers/http/config.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/transport/headers/http/config.proto)。

```json
{
  "transport": {
    "tcp": {
      "headerSettings": {
        "@type": "type.googleapis.com/vx.transport.headers.http.Config",
        "request": {
          "version": { "value": "1.1" },
          "method": { "value": "GET" },
          "uri": ["/"],
          "header": [{ "name": "Host", "value": ["example.com"] }]
        }
      }
    }
  }
}
```

未设置 `tcp` 且未设置其他协议时，使用原始 TCP。


# WebSocket (/zh/docs/vx-core/configuration/transport/websocket)



Proto：[`protos/proto/vx/transport/protocols/websocket/config.proto`](https://github.com/5vnetwork/vx-core/blob/main/protos/proto/vx/transport/protocols/websocket/config.proto)

设置在 `TransportConfig.websocket`。

## WebsocketConfig [#websocketconfig]

<ProtoField name="host" type="string">
  Host 头 / authority
</ProtoField>

<ProtoField name="path" type="string">
  URL 路径；空 = `/`
</ProtoField>

<ProtoField name="header" type="Header[]">
  额外头（`key`、`value`）
</ProtoField>

<ProtoField name="maxEarlyData" type="int32">
  最大 early data 字节数
</ProtoField>

<ProtoField name="useBrowserForwarding" type="bool">
  浏览器转发模式
</ProtoField>

<ProtoField name="earlyDataHeaderName" type="string">
  携带 early data 的头
</ProtoField>

### Header [#header]

<ProtoField name="key" type="string">
  头名称
</ProtoField>

<ProtoField name="value" type="string">
  头值
</ProtoField>

```json
{
  "transport": {
    "websocket": {
      "path": "/ray",
      "host": "example.com"
    },
    "tls": { "serverName": "example.com" }
  }
}
```

亦嵌入 [HTTPUpgrade](/zh/docs/vx-core/configuration/transport/httpupgrade)。


# 节点启用 ECH (/zh/docs/tutorials/ech)





**ECH**（Encrypted Client Hello）可加密 TLS 握手中的 Client Hello，减少 SNI 等元数据被中间人观测的风险。
在 VX 中，你无需手动填写 ECH Config，只要开启 **查询 ECH**，客户端会在连接时通过 DNS 自动查找并使用 ECH 配置。

<Callout>
  此教程适用于过Cloudflare CDN的节点。
</Callout>

## 步骤 [#步骤]

### 1. 编辑节点 [#1-编辑节点]

在 **节点** 列表中，**右键** 要启用的节点，选择 **编辑**。

### 2. 启用「查询 ECH」 [#2-启用查询-ech]

找到**查询 ECH**开关并打开它。

<img alt="启用查询 ECH" src="__img0" />

### 3. 保存 [#3-保存]

点击 **保存** 使设置生效。

## 相关文档 [#相关文档]

* [TLS 配置](/zh/docs/vx-core/configuration/security/tls) — `enableEch`、`echConfig` 等字段说明
* [VX 安装](/zh/docs/vx/installation) — 请先安装客户端


# 使用 VX 作为 Hysteria Realm 服务器 (/zh/docs/tutorials/hysteria-realm)



在一台设备上使用VX轻松部署 [**Hysteria Realm**](https://v2.hysteria.network/zh/docs/advanced/Realms/) 服务器作为代理服务器，其他 VX 客户端连接此代理服务器。

**Hysteria Realm**服务器可以用于以下用途：

* 海外华人，可以用一台闲置安卓设备充当代理服务器，回国时无需再购买VPN，享受家庭带宽的顶级代理上网体验。国内家人也可用此设备科学上网
* 利用一台闲置设备在国内充当代理服务器，在国外的时候也可以听QQ音乐，看爱奇艺，无需购买回国加速器

仅需几步操作，无需公网 IP 或端口转发。

本教程分两部分：**在服务器设备上启用 Realm**，以及 **其他客户端连接此Realm服务器**。

## 前置条件 [#前置条件]

* 两台已安装 \[VX 客户端]的设备(/zh/docs/vx/installation)。一台作为代理服务器，一台作为客户端

## 一、在服务器设备上启用 Realm [#一在服务器设备上启用-realm]

服务器设备可以是闲置的安卓/苹果手机。通常情况下它会被放在家里，供你远游的时候连接。

### 1. 打开设置 [#1-打开设置]

在主页点击右上角 **设置**（齿轮图标）。

<Screenshot src="/tutorials/realm/01-open-settings.png" alt="打开设置" />

### 2. 进入高级设置 [#2-进入高级设置]

选择 **高级**（VPN 相关设置）。

<Screenshot src="/tutorials/realm/02-advanced-settings.png" alt="进入高级设置" />

### 3. 打开 Hysteria Realm [#3-打开-hysteria-realm]

选择 **Hysteria Realm**。

<Screenshot src="/tutorials/realm/03-hysteria-realm.png" alt="打开 Hysteria Realm" />

### 4. 自动配置 [#4-自动配置]

点击 **自动配置**。VX 会生成认证密码、TLS 证书、Realm URL 等参数，并写入 **服务器配置** 卡片。

<Screenshot src="/tutorials/realm/04-auto-configure.png" alt="自动配置 Realm 服务器" />

<Callout>
  **Pro 用户** 使用由我们运行的会合服务器 `realm.leeveck.site`；**非 Pro 用户** 使用由Hysteria官方运营的免费公益会合服务器 `realm.hy2.io`。也可点击 **服务器配置** 卡片手动编辑密码、Realm URL、带宽等选项。
</Callout>

### 5. 启用 Realm 服务器 [#5-启用-realm-服务器]

打开 **启用 Realm 服务器** 开关。开启后，VX 连接时会自动运行 Hysteria Realm 入站。

<Screenshot src="/tutorials/realm/05-enable-realm-server.png" alt="启用 Realm 服务器" />

### 6. 注册供其他设备使用（可选） [#6-注册供其他设备使用可选]

若希望其他 VX 客户端从云端发现此设备：

1. 填写 **设备名称**（在其他设备的选择器中显示）
2. （可选）设置 **云端加密密码**（需单独告知客户端，不会上传至服务器）
3. 点击 **上传到云端**

也可使用 **复制** 或 **二维码** 直接分享 Realm 节点链接，无需云端注册。

<Screenshot src="/tutorials/realm/06-enter-password.png" alt="填写云端加密密码" />

<Screenshot src="/tutorials/realm/07-upload-to-cloud.png" alt="上传到云端" />

上传成功后会提示 **设备已注册，可供其他客户端使用**。

### 7. 将路由模式设为直连（可选） [#7-将路由模式设为直连可选]

服务器端的VX设备，如果本身不需要科学上网，建议使用 **直连** 模式，这样所有流经它的流量，也就是客户端发来的流量，都会走直连。

返回 **高级** 页面（或从设置返回主页），打开底部 **路由** 标签页。

<Screenshot src="/tutorials/realm/08-back-from-advanced.png" alt="返回并打开路由" />

<Screenshot src="/tutorials/realm/09-routing-tab.png" alt="打开路由标签页" />

点击 **高级**，进入 **模式** 标签页。

<Screenshot src="/tutorials/realm/10-routing-advanced.png" alt="路由高级 → 模式" />

<Screenshot src="/tutorials/realm/11-routing-mode-tab.png" alt="路由模式标签页" />

点击模式下拉框，选择 **直连**（All traffic will go direct），然后 **确定**。

<Screenshot src="/tutorials/realm/12-select-direct-mode.png" alt="选择直连模式" />

（可选）如果服务端设备本身无需翻墙，你可以在【高级】/【TUN设置】里清除“TUN IPv4路由”和“TUN IPv6路由”，这样设备本身的流量将不经过VX处理，提高性能

<Screenshot src="/tutorials/realm/clear-ip-route.png" alt="清除路由" />

### 8. 启动 VX [#8-启动-vx]

返回 **主页**，确认模式为 **直连**，点击 **启动**（播放按钮）。

<Screenshot src="/tutorials/realm/13-back-to-home.png" alt="返回主页并选择直连" />

<Screenshot src="/tutorials/realm/14-home-direct-mode.png" alt="主页选择直连模式" />

<Screenshot src="/tutorials/realm/15-start-vx.png" alt="启动 VX" />

启动后，主页会出现 **Realm 服务器** 卡片。几秒后状态为 **已注册** 表示已成功注册到会合服务器；卡片还会显示公网地址与当前 **对端** 数量。

<Screenshot src="/tutorials/realm/16-realm-server-registered.png" alt="Realm 服务器已注册" />

## 二、在客户端设备上连接 [#二在客户端设备上连接]

以下步骤在另一台已安装 VX 的Windows设备上操作。

### 1. 通过云端添加 Realm 设备 [#1-通过云端添加-realm-设备]

<Callout>
  **Pro 用户** 可以通过云端添加Realm节点。非Pro用户请通过扫描二维码或者复制订阅链接的方式导入Realm节点 。
</Callout>

打开 **节点*&#x2A; 标签页，点击 **+ 添加节点**，选择 **Realm 设备**。

<Screenshot src="/tutorials/realm/17-nodes-tab.png" alt="打开节点" />

<Screenshot src="/tutorials/realm/18-add-realm-device.png" alt="添加 Realm 设备" />

### 2. 选择设备并添加 [#2-选择设备并添加]

在 **设备** 下拉框中选择已注册的服务器（例如上一步设置的 **X**），点击 **添加**。

若通过复制/二维码分享而非云端注册，可改用 **剪贴板** 导入 Realm 链接。

<Screenshot src="/tutorials/realm/19-select-device-add.png" alt="选择设备并添加" />

### 3. 输入解密密码 [#3-输入解密密码]

若设备通过云端注册，需输入服务器端设置的 **云端加密密码**。

<Screenshot src="/tutorials/realm/20-decrypt-password.png" alt="输入解密密码" />

添加成功后，节点列表会出现一条 **Hysteria2** 节点，地址指向会合服务器。

### 4. 启用节点并连接 [#4-启用节点并连接]

打开该节点的 **使用** 开关，返回主页选择 **全局**（或其他所需模式），点击 **启动** 连接。

<Screenshot src="/tutorials/realm/21-enable-node.png" alt="启用 Realm 节点" />

<Screenshot src="/tutorials/realm/22-connect-client.png" alt="客户端连接" />

连接成功后，服务器端主页 **Realm 服务器** 卡片上的 **对端** 数量会增加，表示已有客户端通过 Realm 连入。

<Screenshot src="/tutorials/realm/23-peers-connected.png" alt="对端已连接" />

## 视频演示 [#视频演示]

如视频无法播放，请在 [YouTube](https://www.youtube.com/watch?v=7r99eEMpVdg) 上打开。

<YouTube id="7r99eEMpVdg" title="VX 部署Hysteria Realm服务器" />

## 相关文档 [#相关文档]

* [VX 安装](/zh/docs/vx/installation) — 请先安装客户端
* [Hysteria 协议](/zh/docs/vx-core/configuration/protocols/hysteria) — vx-core Hysteria2 配置参考
* [备份与同步](/zh/docs/tutorials/sync-and-backup) — 跨设备同步节点与设置（Pro）


# Azure VPS 部署 (/zh/docs/vps/azure)



利用 [VX 快捷部署](/zh/docs/vx/manual/vx-core-panel#快捷部署)，在微软 Azure 上部署节点，并导入客户端。

<Callout type="info">
  Azure 提供一个月的免费试用，试用期间不会对信用卡进行扣款，可以放心试用。
</Callout>

## 前提条件 [#前提条件]

* Azure 账号
* 已安装 [VX 客户端](/zh/docs/vx/installation)

## 视频教程 [#视频教程]

请观看下方视频，或在 [YouTube](https://www.youtube.com/watch?v=1v7cwJYLsjE) 上打开。

本视频为中文讲解，涵盖创建 Azure 虚拟机、配置网络安全组，以及在 VX 中连接服务器并快捷部署。

<YouTube id="1v7cwJYLsjE" title="Azure VPS 配置与 VX 快捷部署" />

## 相关文档 [#相关文档]

* [vx-core 面板](/zh/docs/vx/manual/vx-core-panel) — 快捷部署与服务器管理
* [一次部署多种协议](/zh/docs/tutorials/deploy-multi-protocol) — All-in-One 快捷部署教程
* [部署 REALITY / XHTTP](/zh/docs/tutorials/deploy-reality-xhttp) — Reality/XHTTP 快捷部署教程
* [VPS 监控](/zh/docs/vx/manual/vps-monitor) — 运行时状态


# 谷歌云 VPS 部署 (/zh/docs/vps/gcp)



利用 [VX 快捷部署](/zh/docs/vx/manual/vx-core-panel#快捷部署)，一键在谷歌云 VPS 上部署节点，并导入客户端。

<Callout type="info">
  谷歌云提供三个月的免费试用，试用期间不会对信用卡进行扣款，可以放心试用。
</Callout>

## 前提条件 [#前提条件]

* 谷歌云账号
* 已安装 [VX 客户端](/zh/docs/vx/installation)

## 视频教程 [#视频教程]

请观看下方视频，或在 [YouTube](https://www.youtube.com/watch?v=ce7ew_p7XlU) 上打开。

本视频为中文讲解，涵盖创建谷歌云实例、配置防火墙、生成 SSH 密钥，以及在 VX 中连接服务器并快捷部署。

<YouTube id="ce7ew_p7XlU" title="谷歌云 VPS 配置与 VX 快捷部署" />

## 视频中用到的命令 [#视频中用到的命令]

<Tabs groupId="gcp-ssh-key" items="['Windows', 'macOS']" defaultIndex="0">
  <Tab value="Windows">
    ### 生成 SSH 密钥 [#生成-ssh-密钥]

    ```bash
    mkdir .ssh & ssh-keygen -t rsa -f .ssh\gcp -N "" -C cat
    ```

    ### 复制公钥 [#复制公钥]

    ```bash
    type .ssh\gcp.pub | clip
    ```

    ### 复制私钥 [#复制私钥]

    ```bash
    type .ssh\gcp | clip
    ```
  </Tab>

  <Tab value="macOS">
    ### 生成 SSH 密钥 [#生成-ssh-密钥-1]

    ```bash
    mkdir .ssh; ssh-keygen -t rsa -f ~/.ssh/gcp -C cat -N ""
    ```

    ### 复制公钥 [#复制公钥-1]

    ```bash
    cat .ssh/gcp.pub | pbcopy
    ```

    ### 复制私钥 [#复制私钥-1]

    ```bash
    cat .ssh/gcp | pbcopy
    ```
  </Tab>
</Tabs>

## 相关文档 [#相关文档]

* [vx-core 面板](/zh/docs/vx/manual/vx-core-panel) — 快捷部署与服务器管理
* [一次部署多种协议](/zh/docs/tutorials/deploy-multi-protocol) — All-in-One 快捷部署教程
* [部署 REALITY / XHTTP](/zh/docs/tutorials/deploy-reality-xhttp) — Reality/XHTTP 快捷部署教程
* [VPS 监控](/zh/docs/vx/manual/vps-monitor) — 运行时状态


# VPS部署教程 (/zh/docs/vps)



如何购买配置VPS，实现自建节点。