Skip to content

VLESS

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
listeners:
- name: vless-in-1
  type: vless
  port: 10817 # supports ports format, e.g., 200,302 or 200,204,401-429,501-503
  listen: 0.0.0.0
  # routing-mark: 0 # set routing-mark for listening socket (Linux only)
  # rule: sub-rule-name1 # uses rules by default; if sub-rule is not found, uses rules directly
  # proxy: proxy # if not empty, directly hands over inbound traffic to the specified proxy (if proxy is not empty, the proxy name here must be valid, otherwise an error will occur)
  users:
    - username: 1
      uuid: 9d0cb9d0-964f-4ef6-897d-6c6b3ccf9e68
      flow: xtls-rprx-vision
  # ws-path: "/" # if not empty, enables websocket transport layer
  # grpc-service-name: "GunService" # if not empty, enables grpc transport layer
  # xhttp-config: # If the field is not empty, enable the xhttp transport layer.
  #   path: "/"
  #   host: ""
  #   mode: auto # Available: "stream-one", "stream-up" or "packet-up"
  #   no-sse-header: false
  #   x-padding-bytes: "100-1000"
  #   x-padding-obfs-mode: false
  #   x-padding-key: x_padding
  #   x-padding-header: Referer
  #   x-padding-placement: queryInHeader # Available: queryInHeader, cookie, header, query
  #   x-padding-method: repeat-x # Available: repeat-x, tokenish
  #   uplink-http-method: POST # Available: POST, PUT, PATCH, DELETE
  #   session-placement: path # Available: path, query, cookie, header
  #   session-key: ""
  #   session-table: "" # Available: "", "uuid", "ALPHABET", "Alphabet", "BASE36", "Base62", "HEX", "alphabet", "base36", "hex", "number"
  #   session-length: "16-32" # the initial value cannot be 0, and the total ID space must be greater than 2.1 billion; takes effect only if session-table is not empty or uuid
  #   seq-placement: path # Available: path, query, cookie, header
  #   seq-key: ""
  #   uplink-data-placement: body # Available: body, cookie, header
  #   uplink-data-key: ""
  #   uplink-chunk-size: 0 # only applicable when uplink-data-placement is not body
  #   sc-max-buffered-posts: 30
  #   sc-stream-up-server-secs: "20-80"
  #   sc-max-each-post-bytes: 1000000
  # -------------------------
  # Configuration of server-side vless encryption:
  # (native mode / public key XOR only / fully random. 1-RTT generates a random ticket valid for 300-600 seconds each time for 0-RTT reuse / only 1-RTT is allowed)
  # Filling in "600s" will randomly take between 50% and 100%, which is equivalent to filling in "300-600s"
  # / means selecting only one option, followed by base64 - at least one, infinite chain, use `mihomo generate vless-x25519` and `mihomo generate vless-mlkem768` to generate, remove parentheses when replacing values
  #
  # Padding is an optional parameter, taking effect only on 1-RTT to eliminate handshake length characteristics, default value on both sides is "100-111-1111.75-0-111.50-0-3333":
  # After 1-RTT client/server hello, a random padding of 111 to 1111 bytes is added with 100% probability
  # With 75% probability, a random delay of 0 to 111 milliseconds is applied ("probability-from-to")
  # Again with 50% probability, a random padding of 0 to 3333 bytes is sent (if 0, Write() is not called)
  # Server and client can set different padding parameters, infinite chain in the order of len, gap, the first padding requires 100% probability, minimum 35 bytes
  # -------------------------
  # decryption: "mlkem768x25519plus.native/xorpub/random.600s(300-600s)/0s.(padding len).(padding gap).(X25519 PrivateKey).(ML-KEM-768 Seed)..."
  # if the following two options are filled, enables tls (must be filled together)
  # certificate: ./server.crt # certificate in PEM format, or the path to the certificate
  # private-key: ./server.key # corresponding private key in PEM format, or the path to the private key
  # the following two options are for mTLS configuration. If client-auth-type is set to "verify-if-given" or "require-and-verify", client-auth-cert must not be empty
  # client-auth-type: "" # available values: "", "request", "require-any", "verify-if-given", "require-and-verify"
  # client-auth-cert: string # certificate in PEM format, or the path to the certificate
  # if filled, enables ECH (can be generated by `mihomo generate ech-keypair <plaintext-domain>`)
  # ech-key: |
  #   -----BEGIN ECH KEYS-----
  #   ACATwY30o/RKgD6hgeQxwrSiApLaCgU+HKh7B6SUrAHaDwBD/g0APwAAIAAgHjzK
  #   madSJjYQIf9o1N5GXjkW4DEEeb17qMxHdwMdNnwADAABAAEAAQACAAEAAwAIdGVz
  #   dC5jb20AAA==
  #   -----END ECH KEYS-----
  # if reality-config is filled, enables reality (note: cannot be filled simultaneously with certificate and private-key)
  reality-config:
    dest: test.com:443
    private-key: jNXHt1yRo0vDuchQlIP6Z0ZvjT3KtzVI-T4E7RoLJS0 # can be generated by `mihomo generate reality-keypair` command
    short-id:
      - 0123456789abcdef
    server-names:
      - test.com
    # the following two limits are optional, used to rate-limit fallback connections that fail verification, bytesPerSec defaults to 0 which means disabled
    # fallback rate limiting is a fingerprint feature and is not recommended; if you are a panel/one-click script developer, make sure to randomize these parameters
    limit-fallback-upload:
      after-bytes: 0 # starts rate limiting after transmitting specified bytes
      bytes-per-sec: 0 # baseline speed (bytes/second)
      burst-bytes-per-sec: 0 # burst speed (bytes/second), takes effect when greater than bytesPerSec
    limit-fallback-download:
      after-bytes: 0 # starts rate limiting after transmitting specified bytes
      bytes-per-sec: 0 # baseline speed (bytes/second)
      burst-bytes-per-sec: 0 # burst speed (bytes/second), takes effect when greater than bytesPerSec
  # shadow-tls:
  #   enable: true
  #   version: 3 # supports v1/v2/v3
  #   # password: shadow-tls-password # v2 configuration item
  #   users: # v3 configuration item
  #     - name: shadow-tls-user
  #       password: shadow-tls-password
  #   handshake:
  #     dest: www.example.com:443
  #     # proxy: ""
  # res-tls:
  #   enable: true
  #   dest: www.example.com:443
  #   password: restls-password
  #   # restls-script: ""
  #   # min-record-len: 0
  #   # proxy: ""
  # jls-config: # JLS replaces standard TLS; unauthenticated connections fall back to dest
  #   enable: true
  #   users:
  #     - username: jls-user
  #       password: jls-password
  #   dest: www.example.com:443
  #   # sni: www.example.com # inferred from dest when empty
  #   # alpn: [h2, http/1.1]
  #   # proxy: ""
  #   # rate-limit: 0 # fallback forwarding rate limit in bit/s; 0 means unlimited
  ### NOTE: For vless listener, if "allow-insecure" is not true, at least one of "certificate and private-key" or "shadow-tls" or "res-tls" or "jls-config" or "reality-config" or "decryption" must be filled in ###
  # allow-insecure: false # whether to allow disabling TLS encryption (NOTE: only used when upstreamed by nginx, caddy, etc.)
  # mux-option:
  #   padding: true
  #   brutal:
  #     enabled: true
  #     up: 1000 # default Mbps
  #     down: 1000