Skip to content

VMESS

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
listeners:
- name: vmess-in-1
  type: vmess
  port: 10814 # supports ports format, e.g., 200,302 or 200,204,401-429,501-503
  listen: 0.0.0.0
  # routing-mark: 0 # set routing-mark for listening socket (Linux only)
  # rule: sub-rule-name1 # uses rules by default; if sub-rule is not found, uses rules directly
  # proxy: proxy # if not empty, directly hands over inbound traffic to the specified proxy (if proxy is not empty, the proxy name here must be valid, otherwise an error will occur)
  users:
    - username: 1
      uuid: 9d0cb9d0-964f-4ef6-897d-6c6b3ccf9e68
      alterId: 1
  # ws-path: "/" # if not empty, enables websocket transport layer
  # grpc-service-name: "GunService" # if not empty, enables grpc transport layer
  # if mekya-config is filled and enable: true is set, enables v2ray-compatible Mekya inbound listening (cannot be used simultaneously with mkcp/ws/grpc)
  # mekya-config:
  #   enable: true
  #   max-write-size: 10485760 # maximum payload size for a single response write-back, in bytes
  #   max-write-duration-ms: 5000 # maximum duration for a single response write-back, in milliseconds
  #   max-simultaneous-write-connection: 128 # number of requests allowed to wait for write-back simultaneously in the same session
  #   packet-writing-buffer: 65536 # packet writing buffer size
  #   kcp:
  #     mtu: 1350 # maximum transmission unit
  #     tti: 15 # transmission time interval, in milliseconds
  #     uplink-capacity: 40 # uplink capacity, in MB/s
  #     downlink-capacity: 2000 # downlink capacity, in MB/s
  #     congestion: false # whether to enable congestion control
  #     write-buffer: 67108864 # write buffer size, in bytes
  #     read-buffer: 67108864 # read buffer size, in bytes
  #     seed: "" # seed used when enabling AES-GCM authentication, leave empty for default authentication
  #     header: "" # camouflage packet header, optional: none/srtp/utp/wechat-video/dtls/wireguard
  # if mkcp-config is filled and enable: true is set, enables v2ray-compatible mKCP inbound listening
  # mkcp-config:
  #   enable: true
  #   mtu: 1350 # maximum transmission unit
  #   tti: 50 # transmission time interval, in milliseconds
  #   uplink-capacity: 5 # uplink capacity, in MB/s
  #   downlink-capacity: 20 # downlink capacity, in MB/s
  #   congestion: false # whether to enable congestion control
  #   write-buffer: 2097152 # write buffer size, in bytes
  #   read-buffer: 2097152 # read buffer size, in bytes
  #   seed: "" # seed used when enabling AES-GCM authentication, leave empty for default authentication
  #   header: "" # camouflage packet header, optional: none/srtp/utp/wechat-video/dtls/wireguard
  # if the following two options are filled, enables tls (must be filled together)
  # certificate: ./server.crt # certificate in PEM format, or the path to the certificate
  # private-key: ./server.key # corresponding private key in PEM format, or the path to the private key
  # the following two options are for mTLS configuration. If client-auth-type is set to "verify-if-given" or "require-and-verify", client-auth-cert must not be empty
  # client-auth-type: "" # available values: "", "request", "require-any", "verify-if-given", "require-and-verify"
  # client-auth-cert: string # certificate in PEM format, or the path to the certificate
  # if filled, enables ech (can be generated by `mihomo generate ech-keypair <plaintext-domain>`)
  # ech-key: |
  #   -----BEGIN ECH KEYS-----
  #   ACATwY30o/RKgD6hgeQxwrSiApLaCgU+HKh7B6SUrAHaDwBD/g0APwAAIAAgHjzK
  #   madSJjYQIf9o1N5GXjkW4DEEeb17qMxHdwMdNnwADAABAAEAAQACAAEAAwAIdGVz
  #   dC5jb20AAA==
  #   -----END ECH KEYS-----
  # jls-config: # JLS replaces standard TLS; unauthenticated connections fall back to dest
  #   enable: true
  #   users:
  #     - username: jls-user
  #       password: jls-password
  #   dest: www.example.com:443
  #   # sni: www.example.com # inferred from dest when empty
  #   # alpn: [h2, http/1.1]
  #   # proxy: ""
  #   # rate-limit: 0 # fallback forwarding rate limit in bit/s; 0 means unlimited
  # shadow-tls:
  #   enable: true
  #   version: 3 # supports v1/v2/v3
  #   # password: shadow-tls-password # v2 configuration item
  #   users: # v3 configuration item
  #     - name: shadow-tls-user
  #       password: shadow-tls-password
  #   handshake:
  #     dest: www.example.com:443
  #     # proxy: ""
  # res-tls:
  #   enable: true
  #   dest: www.example.com:443
  #   password: restls-password
  #   # restls-script: ""
  #   # min-record-len: 0
  #   # proxy: ""
  # if reality-config is filled, enables reality (note: cannot be filled simultaneously with certificate and private-key)
  # reality-config:
  #   dest: test.com:443
  #   private-key: jNXHt1yRo0vDuchQlIP6Z0ZvjT3KtzVI-T4E7RoLJS0 # can be generated by `mihomo generate reality-keypair` command
  #   short-id:
  #     - 0123456789abcdef
  #   server-names:
  #     - test.com
  #   # the following two limits are optional, used to rate-limit fallback connections that fail verification, bytesPerSec defaults to 0 which means disabled
  #   # fallback rate limiting is a fingerprint feature and is not recommended; if you are a panel/one-click script developer, make sure to randomize these parameters
  #   limit-fallback-upload:
  #     after-bytes: 0 # starts rate limiting after transmitting specified bytes
  #     bytes-per-sec: 0 # baseline speed (bytes/second)
  #     burst-bytes-per-sec: 0 # burst speed (bytes/second), takes effect when greater than bytesPerSec
  #   limit-fallback-download:
  #     after-bytes: 0 # starts rate limiting after transmitting specified bytes
  #     bytes-per-sec: 0 # baseline speed (bytes/second)
  #     burst-bytes-per-sec: 0 # burst speed (bytes/second), takes effect when greater than bytesPerSec
  # if tlsmirror-config is filled, enables tlsmirror (note: cannot be filled simultaneously with certificate and private-key)
  # tlsmirror-config:
  #   dest: test.com:443
  #   primary-key: MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY= # required, base64 encoding of 32-byte primary key
  #   proxy: ""
  #   explicit-nonce-ciphersuites: [156, 157, 158, 159, 160, 161, 162, 163, 164, 165, 166, 167, 168, 169, 170, 171, 172, 173, 49195, 49196, 49197, 49198, 49199, 49200, 49201, 49202, 49290, 49291, 49293, 49316, 49317, 49318, 49319, 49320, 49321, 49322, 49323, 49324, 49325, 49326, 49327, 52392, 52393, 52394, 52395, 52396, 52397, 52398] # cipher suites using explicit nonce for TLS 1.2 bearer
  #   defer-instance-derived-write-time: # delay before the first write
  #     base-nanoseconds: 0 # fixed delay, in nanoseconds
  #     uniform-random-multiplier-nanoseconds: 0 # upper bound for extra random delay, in nanoseconds
  #   transport-layer-padding: # enables transport layer padding
  #     enabled: false
  #   connection-enrolment: # enables v2ray-compatible connection enrollment confirmation
  #     primary-ingress-outbound: "" # v2ray-compatible field, recommended to match the controlling outbound tag in opposite routing
  #   sequence-watermarking-enabled: false # enables sequence watermarking
  # mux-option:
  #   padding: true
  #   brutal:
  #     enabled: true
  #     up: 1000 # default Mbps
  #     down: 1000