Inbounds

Generated by website/scripts/build-config.mjs; do not edit. It reads sail’s configuration types (its Rust source), sing-box’s field registry (sail/src/config/singbox/fields.json, sing-box v1.14.2) and the tiers the registry test measured (fields.tiers.json). Change the source comments or those files, then run npm run docs:config in website/.

• Status: each sing-box field as the registry test measured it: Supported (read and acted on; a value sail cannot take is still an error), Warned (dropped with a warning) or Error (the configuration is refused), with the reason; sail extension marks fields and types sing-box does not have.
• Type: sing-box’s JSON type for its fields; from sail’s Rust definitions for extensions.
• Default: from sail’s serde declarations; unset means the field may be left out, and the description says what applies then. Only fields sail reads have one.
• Description: sail’s source comments, in their source language; for an extension without one, the registry test’s note.
• Build: the cfg conditions in the Rust source (Cargo features and platforms).

Validate a configuration with sail -c config.json -T. Editors check and complete it by the JSON schema: put "$schema": "https://peakpassvpn.github.io/sail/schema.json" at its top (made by the same generator; a field sail refuses is marked not allowed, one it warns of deprecated). The Clash and Surge support tables are under Compatibility.

inbounds[]

Rust: Inbound

Field	Type	Default	Status	Description
type	string, one of anytls, cloudflared, direct, http, hysteria, hysteria2, mixed, naive, redirect, shadowsocks, shadowtls, snell, socks, tproxy, trojan, tuic, tun, vless, vmess	required	Supported	—

inbounds[anytls]

Rust: AnyTlsInboundOptions · Build: feature = "inbound-anytls"

Field	Type	Default	Status	Description
tag	string	""	Supported	Defaults to the type.
listen	string	unset	Supported	The address to listen on; defaults to 127.0.0.1.
listen_port	number	unset	Supported	The port to listen on. An inbound without one does not listen, and is only useful as a part of another inbound.
bind_interface	string	—	Error: Where and how an inbound listens: it would take connections otherwise	—
routing_mark	number|string	—	Error: Where and how an inbound listens: it would take connections otherwise	—
reuse_addr	bool	—	Warned: Socket tuning: connections go the same way without it	—
netns	string	—	Error: Where and how an inbound listens: it would take connections otherwise	—
disable_tcp_keep_alive	bool	false	Supported	—
tcp_keep_alive	duration	unset	Supported	How long an accepted TCP connection is idle before keepalive probes it; 5m when unset.
tcp_keep_alive_interval	duration	unset	Supported	Between keepalive probes; 75s when unset.
tcp_fast_open	bool	false	Supported	TCP Fast Open on the TCP port it listens on: what a client that has the server’s cookie sends with its SYN is taken at once. On Linux, only with the server bit of net.ipv4.tcp_fastopen (2; 3 for client and server), which the default (1) leaves off.
tcp_multi_path	bool	—	Warned: Socket tuning: connections go the same way without it	—
udp_fragment	bool	unset	Supported	Whether the datagrams it sends from its UDP sockets may be fragmented on the way: where not, they carry don’t-fragment, and one larger than the path takes is refused rather than sent in pieces. Unset, as sing-box: they may for direct and hysteria2, and may not for the others.
udp_timeout	number|duration	unset	Supported	How long a UDP session through this inbound lives without traffic; 5m when unset, as in sing-box. A number is of seconds.
detour	string	—	Error: Handing an inbound’s connections to another inbound	—
tls	object → object	—	Supported	—
users	array → []	required	Supported	—
padding_scheme	listable-string	unset	Supported	The padding scheme, as lines. Unset, the default. A scheme that pads past write 1024, gives a write more than 64 sizes or asks for more than 1 MiB of padding in all is refused.
fallback	object → object	unset	sail extension	Where a connection that fails to authenticate is relayed.
fallback_for_alpn	object of object → object	{}	sail extension	The same, by the ALPN the connection’s TLS negotiated; the ones it does not name go to fallback.

inbounds[anytls].tls

Field	Type	Default	Status	Description
enabled	bool	—	Supported	—
server_name	string	—	Supported	—
insecure	bool	—	Warned: Only relaxes checks a server’s TLS does not make	—
alpn	listable-string	—	Supported	—
min_version	string, one of 1.0, 1.1, 1.2, 1.3	—	Supported	—
max_version	string, one of 1.0, 1.1, 1.2, 1.3	—	Supported	—
cipher_suites	listable-string	—	Error: TLS cipher suites and key exchanges: sail’s TLS would negotiate others than asked	—
curve_preferences	listable-string, one of P256, P384, P521, X25519, X25519MLKEM768	—	Error: TLS cipher suites and key exchanges: sail’s TLS would negotiate others than asked	—
certificate	listable-string	—	Supported	—
certificate_path	string	—	Supported	—
client_authentication	string, one of no, request, require-any, verify-if-given, require-and-verify	—	Supported	—
client_certificate	listable-string	—	Supported	—
client_certificate_path	listable-string	—	Supported	—
client_certificate_public_key_sha256	listable-string|array	—	Supported	—
key	listable-string	—	Supported	—
key_path	string	—	Supported	—
kernel_tx	bool	—	Warned: The TLS stack, kernel TLS and the handshake’s timeout: the same TLS without them	—
kernel_rx	bool	—	Warned: The TLS stack, kernel TLS and the handshake’s timeout: the same TLS without them	—
handshake_timeout	duration	—	Warned: The TLS stack, kernel TLS and the handshake’s timeout: the same TLS without them	—
certificate_provider	string|object	—	Error: A certificate from a provider or ACME: the inbound would have none	—
ech	object → object	—	Error: Encrypted Client Hello on an inbound	—
reality	object → object	—	Supported	—
acme	object	—	Error: A certificate from a provider or ACME: the inbound would have none (deprecated in sing-box)	—
client_certificate_sha256	—	—	sail extension	sing-box 1.15’s, read ahead: clients’ certificates taken by the SHA-256 of the whole leaf (its DER), standard base64 or hex, with a verifying client_authentication; looked at before client_certificate_public_key_sha256, either list passing
self_signed	—	—	sail extension	With no certificate or key, a self-signed one made at start for tls.server_name (or sail.invalid), kept across reloads that leave the inbound in place, as Mihomo’s Hysteria2 and TUIC listeners make one; clients need insecure or a pin, which changes with each new certificate; an error with a certificate, a key or REALITY

inbounds[anytls].tls.reality

Field	Type	Default	Status	Description
enabled	bool	—	Supported	—
handshake	object → object	—	Supported	—
private_key	string	—	Supported	—
short_id	listable-string	—	Supported	—
max_time_difference	duration	—	Supported	—

inbounds[anytls].tls.reality.handshake

Field	Type	Default	Status	Description
server	string	—	Supported	—
server_port	number	—	Supported	—
detour	string	—	Error: A detour to the REALITY handshake server: it would be reached otherwise	—
bind_interface	string	—	Supported	—
inet4_bind_address	string	—	Supported	—
inet6_bind_address	string	—	Supported	—
bind_address_no_port	bool	—	Supported	—
protect_path	string	—	Supported	—
routing_mark	number|string	—	Supported	—
reuse_addr	bool	—	Supported	—
netns	string	—	Error: Linux network namespaces: sockets would leave another way	—
connect_timeout	duration	—	Supported	—
tcp_fast_open	bool	—	Supported	—
tcp_multi_path	bool	—	Warned: Socket tuning: connections go the same way without it	—
disable_tcp_keep_alive	bool	—	Supported	—
tcp_keep_alive	duration	—	Supported	—
tcp_keep_alive_interval	duration	—	Supported	—
udp_fragment	bool	—	Supported	—
domain_resolver	string|object → object	—	Supported	—
network_strategy	string, one of default, fallback, hybrid	—	Supported	—
network_type	listable-string, one of cellular, ethernet, other, wifi	—	Supported	—
fallback_network_type	listable-string, one of cellular, ethernet, other, wifi	—	Supported	—
fallback_delay	duration	—	Supported	—
domain_strategy	string	—	Supported (deprecated in sing-box)	—

inbounds[anytls].users[]

Rust: AnyTlsUser · Build: feature = "inbound-anytls"

Field	Type	Default	Status	Description
name	string	unset	Supported	Who the user is to routing (auth_user), statistics and logs.
password	string	required	Supported	—

inbounds[direct]

Rust: DirectInboundOptions · Build: feature = "inbound-direct"

Field	Type	Default	Status	Description
tag	string	""	Supported	Defaults to the type.
listen	string	unset	Supported	The address to listen on; defaults to 127.0.0.1.
listen_port	number	unset	Supported	The port to listen on. An inbound without one does not listen, and is only useful as a part of another inbound.
bind_interface	string	—	Error: Where and how an inbound listens: it would take connections otherwise	—
routing_mark	number|string	—	Error: Where and how an inbound listens: it would take connections otherwise	—
reuse_addr	bool	—	Warned: Socket tuning: connections go the same way without it	—
netns	string	—	Error: Where and how an inbound listens: it would take connections otherwise	—
disable_tcp_keep_alive	bool	false	Supported	—
tcp_keep_alive	duration	unset	Supported	How long an accepted TCP connection is idle before keepalive probes it; 5m when unset.
tcp_keep_alive_interval	duration	unset	Supported	Between keepalive probes; 75s when unset.
tcp_fast_open	bool	false	Supported	TCP Fast Open on the TCP port it listens on: what a client that has the server’s cookie sends with its SYN is taken at once. On Linux, only with the server bit of net.ipv4.tcp_fastopen (2; 3 for client and server), which the default (1) leaves off.
tcp_multi_path	bool	—	Warned: Socket tuning: connections go the same way without it	—
udp_fragment	bool	unset	Supported	Whether the datagrams it sends from its UDP sockets may be fragmented on the way: where not, they carry don’t-fragment, and one larger than the path takes is refused rather than sent in pieces. Unset, as sing-box: they may for direct and hysteria2, and may not for the others.
udp_timeout	number|duration	unset	Supported	How long a UDP session through this inbound lives without traffic; 5m when unset, as in sing-box. A number is of seconds.
detour	string	—	Error: Handing an inbound’s connections to another inbound	—
network	listable-string, one of tcp, udp	unset	Supported	Only tcp, or only udp; both when unset.
override_address	string	unset	Supported	Where what comes in goes, instead of the listener’s address.
override_port	number	unset	Supported	The port it goes to, instead of the listener’s.

inbounds[hc]

Rust: HcInboundOptions · Build: feature = "inbound-hc" · sail extension

Field	Type	Default	Status	Description
tag	string	""	sail extension	Defaults to the type.
listen	string	unset	sail extension	The address to listen on; defaults to 127.0.0.1.
listen_port	number	unset	sail extension	The port to listen on. An inbound without one does not listen, and is only useful as a part of another inbound.
udp_timeout	duration, or a number of seconds	unset	sail extension	How long a UDP session through this inbound lives without traffic; 5m when unset, as in sing-box. A number is of seconds.
tcp_keep_alive	duration	unset	sail extension	How long an accepted TCP connection is idle before keepalive probes it; 5m when unset.
tcp_keep_alive_interval	duration	unset	sail extension	Between keepalive probes; 75s when unset.
disable_tcp_keep_alive	bool	false	sail extension	—
tcp_fast_open	bool	false	sail extension	TCP Fast Open on the TCP port it listens on: what a client that has the server’s cookie sends with its SYN is taken at once. On Linux, only with the server bit of net.ipv4.tcp_fastopen (2; 3 for client and server), which the default (1) leaves off.
udp_fragment	bool	unset	sail extension	Whether the datagrams it sends from its UDP sockets may be fragmented on the way: where not, they carry don’t-fragment, and one larger than the path takes is refused rather than sent in pieces. Unset, as sing-box: they may for direct and hysteria2, and may not for the others.
path	string	required	sail extension	—
request	string	""	sail extension	—
response	string	required	sail extension	—

inbounds[http]

Rust: HttpInboundOptions · Build: feature = "inbound-http"

Field	Type	Default	Status	Description
tag	string	""	Supported	Defaults to the type.
listen	string	unset	Supported	The address to listen on; defaults to 127.0.0.1.
listen_port	number	unset	Supported	The port to listen on. An inbound without one does not listen, and is only useful as a part of another inbound.
bind_interface	string	—	Error: Where and how an inbound listens: it would take connections otherwise	—
routing_mark	number|string	—	Error: Where and how an inbound listens: it would take connections otherwise	—
reuse_addr	bool	—	Warned: Socket tuning: connections go the same way without it	—
netns	string	—	Error: Where and how an inbound listens: it would take connections otherwise	—
disable_tcp_keep_alive	bool	false	Supported	—
tcp_keep_alive	duration	unset	Supported	How long an accepted TCP connection is idle before keepalive probes it; 5m when unset.
tcp_keep_alive_interval	duration	unset	Supported	Between keepalive probes; 75s when unset.
tcp_fast_open	bool	false	Supported	TCP Fast Open on the TCP port it listens on: what a client that has the server’s cookie sends with its SYN is taken at once. On Linux, only with the server bit of net.ipv4.tcp_fastopen (2; 3 for client and server), which the default (1) leaves off.
tcp_multi_path	bool	—	Warned: Socket tuning: connections go the same way without it	—
udp_fragment	bool	unset	Supported	Whether the datagrams it sends from its UDP sockets may be fragmented on the way: where not, they carry don’t-fragment, and one larger than the path takes is refused rather than sent in pieces. Unset, as sing-box: they may for direct and hysteria2, and may not for the others.
udp_timeout	number|duration	unset	Supported	How long a UDP session through this inbound lives without traffic; 5m when unset, as in sing-box. A number is of seconds.
detour	string	—	Error: Handing an inbound’s connections to another inbound	—
users	array → []	[]	Supported	Clients must authenticate as one of these with Proxy-Authorization: Basic; anyone may connect when there are none.
domain_resolver	string|object → object	—	Error: Resolving requested names with a resolver of its own: another server would answer	—
set_system_proxy	bool	—	Warned: The platform proxy is the host’s to set	—
tls	object → object	unset	Supported	—
realm	string	unset	sail extension	The realm a 407 names, which clients show when asking for credentials: a sail extension; sail when unset.
skip_auth_prefixes	array of string	[]	sail extension	The clients that go in without credentials, by the IP prefixes they connect from: Mihomo’s skip-auth-prefixes, a sail extension.
version	number or array of number	unset	sail extension	The HTTP versions served, sing-box 1.15’s: 1 and 2 when unset. HTTP/2 is told by its preface, over TLS or not. 3 is warned of and not served: sail speaks no HTTP/3.
idle_timeout	duration	unset	sail extension	HTTP/2’s, sing-box 1.15’s: how long a ping may go unanswered, and how long a connection with no tunnel is kept.
keep_alive_period	duration	unset	sail extension	HTTP/2’s: a ping after this long with nothing received.
stream_receive_window	number	unset	sail extension	HTTP/2’s: a tunnel’s receive window.
connection_receive_window	number	unset	sail extension	HTTP/2’s: a connection’s receive window.
max_concurrent_streams	number	unset	sail extension	HTTP/2’s: the most tunnels a client may have open on one connection.

inbounds[http].users[]

Rust: HttpUser · Build: feature = "inbound-http"

Field	Type	Default	Status	Description
username	string	required	Supported	—
password	string	required	Supported	—

inbounds[hysteria2]

Rust: Hysteria2InboundOptions · Build: feature = "inbound-hysteria2"

Field	Type	Default	Status	Description
tag	string	""	Supported	Defaults to the type.
listen	string	unset	Supported	The address to listen on; defaults to 127.0.0.1.
listen_port	number	unset	Supported	The port to listen on. An inbound without one does not listen, and is only useful as a part of another inbound.
bind_interface	string	—	Error: Where and how an inbound listens: it would take connections otherwise	—
routing_mark	number|string	—	Error: Where and how an inbound listens: it would take connections otherwise	—
reuse_addr	bool	—	Warned: Socket tuning: connections go the same way without it	—
netns	string	—	Error: Where and how an inbound listens: it would take connections otherwise	—
disable_tcp_keep_alive	bool	false	Supported	—
tcp_keep_alive	duration	unset	Supported	How long an accepted TCP connection is idle before keepalive probes it; 5m when unset.
tcp_keep_alive_interval	duration	unset	Supported	Between keepalive probes; 75s when unset.
tcp_fast_open	bool	false	Supported	TCP Fast Open on the TCP port it listens on: what a client that has the server’s cookie sends with its SYN is taken at once. On Linux, only with the server bit of net.ipv4.tcp_fastopen (2; 3 for client and server), which the default (1) leaves off.
tcp_multi_path	bool	—	Warned: Socket tuning: connections go the same way without it	—
udp_fragment	bool	unset	Supported	Whether the datagrams it sends from its UDP sockets may be fragmented on the way: where not, they carry don’t-fragment, and one larger than the path takes is refused rather than sent in pieces. Unset, as sing-box: they may for direct and hysteria2, and may not for the others.
udp_timeout	number|duration	unset	Supported	How long a UDP session through this inbound lives without traffic; 5m when unset, as in sing-box. A number is of seconds.
detour	string	—	Error: Handing an inbound’s connections to another inbound	—
up_mbps	number	unset	Supported	What the server may send at, at most, to each client.
down_mbps	number	unset	Supported	What the server can receive at, told to clients.
obfs	object → object, [gecko], [salamander]	unset	Supported	—
users	array → []	required	Supported	—
ignore_client_bandwidth	bool	false	Supported	Ignores the rate clients say they receive at, and has them find their own: BBR both ways.
tls	object → object	required	Supported	—
idle_timeout	duration	—	Warned: QUIC tuning: the same connection without it	—
keep_alive_period	duration	—	Warned: QUIC tuning: the same connection without it	—
stream_receive_window	number|string	—	Warned: QUIC tuning: the same connection without it	—
connection_receive_window	number|string	—	Warned: QUIC tuning: the same connection without it	—
max_concurrent_streams	number	—	Warned: QUIC tuning: the same connection without it	—
initial_packet_size	number	—	Warned: QUIC tuning: the same connection without it	—
disable_path_mtu_discovery	bool	—	Warned: QUIC tuning: the same connection without it	—
masquerade	string|object	unset	Supported	What anyone without a password is served: an http:// or https:// site behind, or a fixed response; 404 when unset.
bbr_profile	string, one of standard, conservative, aggressive	—	Warned: Hysteria’s congestion tuning and debugging, the longest hop interval, and its QUIC fingerprint: the same traffic	—
brutal_debug	bool	—	Warned: Hysteria’s congestion tuning and debugging, the longest hop interval, and its QUIC fingerprint: the same traffic	—
realm	object → object	—	Error: Meeting peers through a Hysteria realm: connections would be made otherwise	—

inbounds[hysteria2].users[]

Rust: User · Build: feature = "inbound-hysteria2"

Field	Type	Default	Status	Description
name	string	unset	Supported	Who the user is to routing (auth_user), statistics and logs.
password	string	required	Supported	—

inbounds[hysteria2].realm

Field	Type	Default	Status	Description
server_url	string	—	Error: Meeting peers through a Hysteria realm: connections would be made otherwise	—
token	string	—	Error: Meeting peers through a Hysteria realm: connections would be made otherwise	—
realm_id	string	—	Error: Meeting peers through a Hysteria realm: connections would be made otherwise	—
stun_servers	listable-string	—	Error: Meeting peers through a Hysteria realm: connections would be made otherwise	—
ip_version	number, one of 0, 4, 6	—	Error: Meeting peers through a Hysteria realm: connections would be made otherwise	—
port_mapping	object → object	—	Error: Meeting peers through a Hysteria realm: connections would be made otherwise	—
http_client	string|object → object	—	Error: Meeting peers through a Hysteria realm: connections would be made otherwise	—
stun_domain_resolver	string|object → object	—	Error: Meeting peers through a Hysteria realm: connections would be made otherwise	—

inbounds[mixed]

Rust: MixedInboundOptions · Build: feature = "inbound-mixed"

Field	Type	Default	Status	Description
tag	string	""	Supported	Defaults to the type.
listen	string	unset	Supported	The address to listen on; defaults to 127.0.0.1.
listen_port	number	unset	Supported	The port to listen on. An inbound without one does not listen, and is only useful as a part of another inbound.
bind_interface	string	—	Error: Where and how an inbound listens: it would take connections otherwise	—
routing_mark	number|string	—	Error: Where and how an inbound listens: it would take connections otherwise	—
reuse_addr	bool	—	Warned: Socket tuning: connections go the same way without it	—
netns	string	—	Error: Where and how an inbound listens: it would take connections otherwise	—
disable_tcp_keep_alive	bool	false	Supported	—
tcp_keep_alive	duration	unset	Supported	How long an accepted TCP connection is idle before keepalive probes it; 5m when unset.
tcp_keep_alive_interval	duration	unset	Supported	Between keepalive probes; 75s when unset.
tcp_fast_open	bool	false	Supported	TCP Fast Open on the TCP port it listens on: what a client that has the server’s cookie sends with its SYN is taken at once. On Linux, only with the server bit of net.ipv4.tcp_fastopen (2; 3 for client and server), which the default (1) leaves off.
tcp_multi_path	bool	—	Warned: Socket tuning: connections go the same way without it	—
udp_fragment	bool	unset	Supported	Whether the datagrams it sends from its UDP sockets may be fragmented on the way: where not, they carry don’t-fragment, and one larger than the path takes is refused rather than sent in pieces. Unset, as sing-box: they may for direct and hysteria2, and may not for the others.
udp_timeout	number|duration	unset	Supported	How long a UDP session through this inbound lives without traffic; 5m when unset, as in sing-box. A number is of seconds.
detour	string	—	Error: Handing an inbound’s connections to another inbound	—
users	array → []	[]	Supported	Clients must authenticate as one of these, by SOCKS5 username/password or HTTP Basic; anyone may connect when there are none.
domain_resolver	string|object → object	—	Error: Resolving requested names with a resolver of its own: another server would answer	—
set_system_proxy	bool	—	Warned: The platform proxy is the host’s to set	—
tls	object → object	—	Error: TLS on a mixed inbound: it would take plain connections	—
realm	string	unset	sail extension	The realm an HTTP 407 names: a sail extension; sail when unset.
skip_auth_prefixes	array of string	[]	sail extension	The clients that go in without credentials, by the IP prefixes they connect from: Mihomo’s skip-auth-prefixes, a sail extension.

inbounds[mixed].users[]

Rust: MixedUser · Build: feature = "inbound-mixed"

Field	Type	Default	Status	Description
username	string	required	Supported	—
password	string	required	Supported	—

inbounds[mixed].tls

Field	Type	Default	Status	Description
enabled	bool	—	Error: TLS on a mixed inbound: it would take plain connections	—
server_name	string	—	Error: TLS on a mixed inbound: it would take plain connections	—
insecure	bool	—	Error: TLS on a mixed inbound: it would take plain connections	—
alpn	listable-string	—	Error: TLS on a mixed inbound: it would take plain connections	—
min_version	string, one of 1.0, 1.1, 1.2, 1.3	—	Error: TLS on a mixed inbound: it would take plain connections	—
max_version	string, one of 1.0, 1.1, 1.2, 1.3	—	Error: TLS on a mixed inbound: it would take plain connections	—
cipher_suites	listable-string	—	Error: TLS on a mixed inbound: it would take plain connections	—
curve_preferences	listable-string, one of P256, P384, P521, X25519, X25519MLKEM768	—	Error: TLS on a mixed inbound: it would take plain connections	—
certificate	listable-string	—	Error: TLS on a mixed inbound: it would take plain connections	—
certificate_path	string	—	Error: TLS on a mixed inbound: it would take plain connections	—
client_authentication	string, one of no, request, require-any, verify-if-given, require-and-verify	—	Error: TLS on a mixed inbound: it would take plain connections	—
client_certificate	listable-string	—	Error: TLS on a mixed inbound: it would take plain connections	—
client_certificate_path	listable-string	—	Error: TLS on a mixed inbound: it would take plain connections	—
client_certificate_public_key_sha256	listable-string|array	—	Error: TLS on a mixed inbound: it would take plain connections	—
key	listable-string	—	Error: TLS on a mixed inbound: it would take plain connections	—
key_path	string	—	Error: TLS on a mixed inbound: it would take plain connections	—
kernel_tx	bool	—	Error: TLS on a mixed inbound: it would take plain connections	—
kernel_rx	bool	—	Error: TLS on a mixed inbound: it would take plain connections	—
handshake_timeout	duration	—	Error: TLS on a mixed inbound: it would take plain connections	—
certificate_provider	string|object	—	Error: TLS on a mixed inbound: it would take plain connections	—
ech	object → object	—	Error: TLS on a mixed inbound: it would take plain connections	—
reality	object → object	—	Error: TLS on a mixed inbound: it would take plain connections	—
acme	object	—	Error: TLS on a mixed inbound: it would take plain connections (deprecated in sing-box)	—

inbounds[mixed].tls.ech

Field	Type	Default	Status	Description
enabled	bool	—	Error: TLS on a mixed inbound: it would take plain connections	—
key	listable-string	—	Error: TLS on a mixed inbound: it would take plain connections	—
key_path	string	—	Error: TLS on a mixed inbound: it would take plain connections	—

inbounds[mixed].tls.reality

Field	Type	Default	Status	Description
enabled	bool	—	Error: TLS on a mixed inbound: it would take plain connections	—
handshake	object → object	—	Error: TLS on a mixed inbound: it would take plain connections	—
private_key	string	—	Error: TLS on a mixed inbound: it would take plain connections	—
short_id	listable-string	—	Error: TLS on a mixed inbound: it would take plain connections	—
max_time_difference	duration	—	Error: TLS on a mixed inbound: it would take plain connections	—

inbounds[mixed].tls.reality.handshake

Field	Type	Default	Status	Description
server	string	—	Error: TLS on a mixed inbound: it would take plain connections	—
server_port	number	—	Error: TLS on a mixed inbound: it would take plain connections	—
detour	string	—	Error: TLS on a mixed inbound: it would take plain connections	—
bind_interface	string	—	Error: TLS on a mixed inbound: it would take plain connections	—
inet4_bind_address	string	—	Error: TLS on a mixed inbound: it would take plain connections	—
inet6_bind_address	string	—	Error: TLS on a mixed inbound: it would take plain connections	—
bind_address_no_port	bool	—	Error: TLS on a mixed inbound: it would take plain connections	—
protect_path	string	—	Error: TLS on a mixed inbound: it would take plain connections	—
routing_mark	number|string	—	Error: TLS on a mixed inbound: it would take plain connections	—
reuse_addr	bool	—	Error: TLS on a mixed inbound: it would take plain connections	—
netns	string	—	Error: TLS on a mixed inbound: it would take plain connections	—
connect_timeout	duration	—	Error: TLS on a mixed inbound: it would take plain connections	—
tcp_fast_open	bool	—	Error: TLS on a mixed inbound: it would take plain connections	—
tcp_multi_path	bool	—	Error: TLS on a mixed inbound: it would take plain connections	—
disable_tcp_keep_alive	bool	—	Error: TLS on a mixed inbound: it would take plain connections	—
tcp_keep_alive	duration	—	Error: TLS on a mixed inbound: it would take plain connections	—
tcp_keep_alive_interval	duration	—	Error: TLS on a mixed inbound: it would take plain connections	—
udp_fragment	bool	—	Error: TLS on a mixed inbound: it would take plain connections	—
domain_resolver	string|object → object	—	Error: TLS on a mixed inbound: it would take plain connections	—
network_strategy	string, one of default, fallback, hybrid	—	Error: TLS on a mixed inbound: it would take plain connections	—
network_type	listable-string, one of cellular, ethernet, other, wifi	—	Error: TLS on a mixed inbound: it would take plain connections	—
fallback_network_type	listable-string, one of cellular, ethernet, other, wifi	—	Error: TLS on a mixed inbound: it would take plain connections	—
fallback_delay	duration	—	Error: TLS on a mixed inbound: it would take plain connections	—
domain_strategy	string	—	Error: TLS on a mixed inbound: it would take plain connections (deprecated in sing-box)	—

inbounds[mixed].tls.reality.handshake.domain_resolver

Field	Type	Default	Status	Description
server	string	required	Error: TLS on a mixed inbound: it would take plain connections	—
timeout	duration	—	Error: TLS on a mixed inbound: it would take plain connections	—
strategy	string, one of as_is, prefer_ipv4, prefer_ipv6, ipv4_only, ipv6_only	—	Error: TLS on a mixed inbound: it would take plain connections	—
disable_cache	bool	—	Error: TLS on a mixed inbound: it would take plain connections	—
disable_optimistic_cache	bool	—	Error: TLS on a mixed inbound: it would take plain connections	—
rewrite_ttl	number	—	Error: TLS on a mixed inbound: it would take plain connections	—
client_subnet	string	—	Error: TLS on a mixed inbound: it would take plain connections	—

inbounds[mptp]

Rust: MptpInboundOptions · Build: feature = "inbound-mptp" · sail extension

Field	Type	Default	Status	Description
tag	string	""	sail extension	Defaults to the type.
listen	string	unset	sail extension	The address to listen on; defaults to 127.0.0.1.
listen_port	number	unset	sail extension	The port to listen on. An inbound without one does not listen, and is only useful as a part of another inbound.
udp_timeout	duration, or a number of seconds	unset	sail extension	How long a UDP session through this inbound lives without traffic; 5m when unset, as in sing-box. A number is of seconds.
tcp_keep_alive	duration	unset	sail extension	How long an accepted TCP connection is idle before keepalive probes it; 5m when unset.
tcp_keep_alive_interval	duration	unset	sail extension	Between keepalive probes; 75s when unset.
disable_tcp_keep_alive	bool	false	sail extension	—
tcp_fast_open	bool	false	sail extension	TCP Fast Open on the TCP port it listens on: what a client that has the server’s cookie sends with its SYN is taken at once. On Linux, only with the server bit of net.ipv4.tcp_fastopen (2; 3 for client and server), which the default (1) leaves off.
udp_fragment	bool	unset	sail extension	Whether the datagrams it sends from its UDP sockets may be fragmented on the way: where not, they carry don’t-fragment, and one larger than the path takes is refused rather than sent in pieces. Unset, as sing-box: they may for direct and hysteria2, and may not for the others.

inbounds[nf]

Rust: NfInboundOptions · Build: all (feature = "inbound-nf" , windows) · sail extension

Field	Type	Default	Status	Description
tag	string	""	sail extension	Defaults to the type.
listen	string	unset	sail extension	The address to listen on; defaults to 127.0.0.1.
listen_port	number	unset	sail extension	The port to listen on. An inbound without one does not listen, and is only useful as a part of another inbound.
udp_timeout	duration, or a number of seconds	unset	sail extension	How long a UDP session through this inbound lives without traffic; 5m when unset, as in sing-box. A number is of seconds.
tcp_keep_alive	duration	unset	sail extension	How long an accepted TCP connection is idle before keepalive probes it; 5m when unset.
tcp_keep_alive_interval	duration	unset	sail extension	Between keepalive probes; 75s when unset.
disable_tcp_keep_alive	bool	false	sail extension	—
tcp_fast_open	bool	false	sail extension	TCP Fast Open on the TCP port it listens on: what a client that has the server’s cookie sends with its SYN is taken at once. On Linux, only with the server bit of net.ipv4.tcp_fastopen (2; 3 for client and server), which the default (1) leaves off.
udp_fragment	bool	unset	sail extension	Whether the datagrams it sends from its UDP sockets may be fragmented on the way: where not, they carry don’t-fragment, and one larger than the path takes is refused rather than sent in pieces. Unset, as sing-box: they may for direct and hysteria2, and may not for the others.
driver_name	string	required	sail extension	—
nfapi	string	"nfapi.dll"	sail extension	—
fake_dns_exclude	array of string	[]	sail extension	—
fake_dns_include	array of string	[]	sail extension	—

inbounds[redirect]

Rust: RedirectInboundOptions · Build: feature = "inbound-redirect"

Field	Type	Default	Status	Description
tag	string	""	Supported	Defaults to the type.
listen	string	unset	Supported	The address to listen on; defaults to 127.0.0.1.
listen_port	number	unset	Supported	The port to listen on. An inbound without one does not listen, and is only useful as a part of another inbound.
bind_interface	string	—	Error: Where and how an inbound listens: it would take connections otherwise	—
routing_mark	number|string	—	Error: Where and how an inbound listens: it would take connections otherwise	—
reuse_addr	bool	—	Warned: Socket tuning: connections go the same way without it	—
netns	string	—	Error: Where and how an inbound listens: it would take connections otherwise	—
disable_tcp_keep_alive	bool	false	Supported	—
tcp_keep_alive	duration	unset	Supported	How long an accepted TCP connection is idle before keepalive probes it; 5m when unset.
tcp_keep_alive_interval	duration	unset	Supported	Between keepalive probes; 75s when unset.
tcp_fast_open	bool	false	Supported	TCP Fast Open on the TCP port it listens on: what a client that has the server’s cookie sends with its SYN is taken at once. On Linux, only with the server bit of net.ipv4.tcp_fastopen (2; 3 for client and server), which the default (1) leaves off.
tcp_multi_path	bool	—	Warned: Socket tuning: connections go the same way without it	—
udp_fragment	bool	unset	Supported	Whether the datagrams it sends from its UDP sockets may be fragmented on the way: where not, they carry don’t-fragment, and one larger than the path takes is refused rather than sent in pieces. Unset, as sing-box: they may for direct and hysteria2, and may not for the others.
udp_timeout	number|duration	unset	Supported	How long a UDP session through this inbound lives without traffic; 5m when unset, as in sing-box. A number is of seconds.
detour	string	—	Error: Handing an inbound’s connections to another inbound	—

inbounds[shadowsocks]

Rust: ShadowsocksInboundOptions · Build: feature = "inbound-shadowsocks"

Field	Type	Default	Status	Description
tag	string	""	Supported	Defaults to the type.
listen	string	unset	Supported	The address to listen on; defaults to 127.0.0.1.
listen_port	number	unset	Supported	The port to listen on. An inbound without one does not listen, and is only useful as a part of another inbound.
bind_interface	string	—	Error: Where and how an inbound listens: it would take connections otherwise	—
routing_mark	number|string	—	Error: Where and how an inbound listens: it would take connections otherwise	—
reuse_addr	bool	—	Warned: Socket tuning: connections go the same way without it	—
netns	string	—	Error: Where and how an inbound listens: it would take connections otherwise	—
disable_tcp_keep_alive	bool	false	Supported	—
tcp_keep_alive	duration	unset	Supported	How long an accepted TCP connection is idle before keepalive probes it; 5m when unset.
tcp_keep_alive_interval	duration	unset	Supported	Between keepalive probes; 75s when unset.
tcp_fast_open	bool	false	Supported	TCP Fast Open on the TCP port it listens on: what a client that has the server’s cookie sends with its SYN is taken at once. On Linux, only with the server bit of net.ipv4.tcp_fastopen (2; 3 for client and server), which the default (1) leaves off.
tcp_multi_path	bool	—	Warned: Socket tuning: connections go the same way without it	—
udp_fragment	bool	unset	Supported	Whether the datagrams it sends from its UDP sockets may be fragmented on the way: where not, they carry don’t-fragment, and one larger than the path takes is refused rather than sent in pieces. Unset, as sing-box: they may for direct and hysteria2, and may not for the others.
udp_timeout	number|duration	unset	Supported	How long a UDP session through this inbound lives without traffic; 5m when unset, as in sing-box. A number is of seconds.
detour	string	—	Error: Handing an inbound’s connections to another inbound	—
network	listable-string, one of tcp, udp	—	Error: Which networks a Shadowsocks inbound serves: it would serve others	—
method	string, one of none, aes-128-gcm, aes-192-gcm, aes-256-gcm, chacha20-ietf-poly1305, xchacha20-ietf-poly1305, 2022-blake3-aes-128-gcm, 2022-blake3-aes-256-gcm, 2022-blake3-chacha20-poly1305	required	Supported	—
password	string	required	Supported	The PSK with a 2022 method; with users, the server’s identity PSK.
users	array → []	unset	Supported	Shadowsocks 2022 users, told apart by identity headers.
destinations	array → []	—	Error: Relaying to other Shadowsocks servers	—
multiplex	object → object	unset	Supported	—
managed	bool	—	Warned: Users managed through the SSM API, a service sail does not run	—

inbounds[shadowsocks].users[]

Rust: ShadowsocksUser · Build: feature = "inbound-shadowsocks"

Field	Type	Default	Status	Description
name	string	unset	Supported	Who the user is to routing (auth_user), statistics and logs.
password	string	required	Supported	The user’s base64 PSK.

inbounds[shadowsocks].destinations[]

Field	Type	Default	Status	Description
name	string	—	Error: Relaying to other Shadowsocks servers	—
password	string	—	Error: Relaying to other Shadowsocks servers	—
server	string	—	Error: Relaying to other Shadowsocks servers	—
server_port	number	—	Error: Relaying to other Shadowsocks servers	—

inbounds[shadowtls]

Rust: ShadowTlsInboundOptions · Build: feature = "inbound-shadowtls"

Field	Type	Default	Status	Description
tag	string	""	Supported	Defaults to the type.
listen	string	unset	Supported	The address to listen on; defaults to 127.0.0.1.
listen_port	number	unset	Supported	The port to listen on. An inbound without one does not listen, and is only useful as a part of another inbound.
bind_interface	string	—	Error: Where and how an inbound listens: it would take connections otherwise	—
routing_mark	number|string	—	Error: Where and how an inbound listens: it would take connections otherwise	—
reuse_addr	bool	—	Warned: Socket tuning: connections go the same way without it	—
netns	string	—	Error: Where and how an inbound listens: it would take connections otherwise	—
disable_tcp_keep_alive	bool	false	Supported	—
tcp_keep_alive	duration	unset	Supported	How long an accepted TCP connection is idle before keepalive probes it; 5m when unset.
tcp_keep_alive_interval	duration	unset	Supported	Between keepalive probes; 75s when unset.
tcp_fast_open	bool	false	Supported	TCP Fast Open on the TCP port it listens on: what a client that has the server’s cookie sends with its SYN is taken at once. On Linux, only with the server bit of net.ipv4.tcp_fastopen (2; 3 for client and server), which the default (1) leaves off.
tcp_multi_path	bool	—	Warned: Socket tuning: connections go the same way without it	—
udp_fragment	bool	unset	Supported	Whether the datagrams it sends from its UDP sockets may be fragmented on the way: where not, they carry don’t-fragment, and one larger than the path takes is refused rather than sent in pieces. Unset, as sing-box: they may for direct and hysteria2, and may not for the others.
udp_timeout	number|duration	unset	Supported	How long a UDP session through this inbound lives without traffic; 5m when unset, as in sing-box. A number is of seconds.
detour	string	unset	Supported	The inbound connections go to after the handshake, by tag: needed.
version	number, one of 1, 2, 3	1	Supported	Must be 3: versions 1 and 2 are not supported. sing-box’s default is 1.
password	string	unset	Supported	Version 2’s, and an error: version 3 takes users.
users	array → []	[]	Supported	At least one.
handshake	object → object	unset	Supported	The site whose handshake is relayed, for everyone the other fields do not send elsewhere. Needed unless wildcard_sni is on.
handshake_for_server_name	map	{}	Supported	Handshake servers by the server name the ClientHello asks for.
strict_mode	bool	false	Supported	Relays a ServerHello that does not pick TLS 1.3 as it would an unauthenticated client.
wildcard_sni	string, one of off, authed, all	off	Supported	—

inbounds[shadowtls].users[]

Rust: ShadowTlsUser · Build: feature = "inbound-shadowtls"

Field	Type	Default	Status	Description
name	string	""	Supported	Who the user is to routing (auth_user), statistics and logs.
password	string	required	Supported	—

inbounds[shadowtls].handshake

Rust: ShadowTlsHandshake · Build: feature = "inbound-shadowtls"

Field	Type	Default	Status	Description
server	string	""	Supported	—
server_port	number	0	Supported	—
detour	string	—	Error: The protocol’s own check: not implemented yet	The outbound to dial through, in place of a socket of its own.
bind_interface	string	unset	Supported	The interface to send through, by name. Loopback destinations still go over loopback, where sing-box applies the bind to them as well.
inet4_bind_address	string	unset	Supported	The local address for IPv4 destinations, loopback ones aside: as bind_interface.
inet6_bind_address	string	unset	Supported	The local address for IPv6 destinations, loopback ones aside: as bind_interface.
bind_address_no_port	bool	false	Supported	IP_BIND_ADDRESS_NO_PORT on TCP sockets bound to an address, so that the port is picked at connect: Linux only.
protect_path	string	unset	Supported	A Unix socket each socket’s descriptor is handed to, with SCM_RIGHTS, before it binds or connects, for the process there to protect it (from its VPN, say); it answers one byte. Besides what the host protects. Unix only.
routing_mark	number|string	unset	Supported	SO_MARK, Linux only.
reuse_addr	bool	false	Supported	SO_REUSEADDR, and SO_REUSEPORT on Unix, on UDP sockets.
netns	string	—	Error: The protocol’s own check: not implemented yet	Not implemented yet.
connect_timeout	duration	unset	Supported	How long a TCP connect to one address may take; 5s when unset.
tcp_fast_open	bool	false	Supported	TCP Fast Open: the first data written goes with the SYN. Its addresses are then tried one by one, not raced.
tcp_multi_path	bool	—	Error: The protocol’s own check: not implemented yet	Not implemented yet.
disable_tcp_keep_alive	bool	false	Supported	No TCP keepalive at all.
tcp_keep_alive	duration	unset	Supported	How long a TCP connection is idle before keepalive probes it; 5m when unset.
tcp_keep_alive_interval	duration	unset	Supported	Between keepalive probes; 75s when unset.
udp_fragment	bool	unset	Supported	Whether UDP datagrams may be fragmented on the way; unset, as the place says, see udp_fragment_default.
domain_resolver	string|object → object	unset	Supported	The DNS server that resolves the names dialled.
network_strategy	string, one of default, fallback, hybrid	unset	Supported	Which of the host’s interfaces a connection goes out of, and how they race; default where only types are given. Only where the host lists its interfaces (NetworkState::interfaces).
network_type	listable-string, one of cellular, ethernet, other, wifi	[]	Supported	The types of interface the strategy goes out of first.
fallback_network_type	listable-string, one of cellular, ethernet, other, wifi	[]	Supported	The types it falls back to, with fallback.
fallback_delay	duration	unset	Supported	How long the addresses of one family are tried before those of the other are raced against them (Happy Eyeballs), and the first interfaces before the fallback ones; 300ms when unset.
domain_strategy	string	unset	Supported (deprecated in sing-box)	sing-box’s deprecated field for the families names resolve to, which a resolver’s own strategy goes before.
skip_default_domain_resolver	bool	false	sail extension	A sail extension: without a domain_resolver of its own, the names dialled resolve as the DNS rules say, not as route.default_domain_resolver does; as Mihomo’s DIRECT resolves apart from the proxies’ servers.

inbounds[socks]

Rust: SocksInboundOptions · Build: feature = "inbound-socks"

Field	Type	Default	Status	Description
tag	string	""	Supported	Defaults to the type.
listen	string	unset	Supported	The address to listen on; defaults to 127.0.0.1.
listen_port	number	unset	Supported	The port to listen on. An inbound without one does not listen, and is only useful as a part of another inbound.
bind_interface	string	—	Error: Where and how an inbound listens: it would take connections otherwise	—
routing_mark	number|string	—	Error: Where and how an inbound listens: it would take connections otherwise	—
reuse_addr	bool	—	Warned: Socket tuning: connections go the same way without it	—
netns	string	—	Error: Where and how an inbound listens: it would take connections otherwise	—
disable_tcp_keep_alive	bool	false	Supported	—
tcp_keep_alive	duration	unset	Supported	How long an accepted TCP connection is idle before keepalive probes it; 5m when unset.
tcp_keep_alive_interval	duration	unset	Supported	Between keepalive probes; 75s when unset.
tcp_fast_open	bool	false	Supported	TCP Fast Open on the TCP port it listens on: what a client that has the server’s cookie sends with its SYN is taken at once. On Linux, only with the server bit of net.ipv4.tcp_fastopen (2; 3 for client and server), which the default (1) leaves off.
tcp_multi_path	bool	—	Warned: Socket tuning: connections go the same way without it	—
udp_fragment	bool	unset	Supported	Whether the datagrams it sends from its UDP sockets may be fragmented on the way: where not, they carry don’t-fragment, and one larger than the path takes is refused rather than sent in pieces. Unset, as sing-box: they may for direct and hysteria2, and may not for the others.
udp_timeout	number|duration	unset	Supported	How long a UDP session through this inbound lives without traffic; 5m when unset, as in sing-box. A number is of seconds.
detour	string	—	Error: Handing an inbound’s connections to another inbound	—
users	array → []	[]	Supported	Clients must authenticate as one of these; anyone may connect when there are none.
domain_resolver	string|object → object	—	Error: Resolving requested names with a resolver of its own: another server would answer	—
skip_auth_prefixes	array of string	[]	sail extension	The clients that go in without credentials, by the IP prefixes they connect from: Mihomo’s skip-auth-prefixes, a sail extension.

inbounds[socks].users[]

Rust: SocksUser · Build: feature = "inbound-socks"

Field	Type	Default	Status	Description
username	string	required	Supported	—
password	string	required	Supported	—

inbounds[tproxy]

Rust: TproxyInboundOptions · Build: feature = "inbound-tproxy"

Field	Type	Default	Status	Description
tag	string	""	Supported	Defaults to the type.
listen	string	unset	Supported	The address to listen on; defaults to 127.0.0.1.
listen_port	number	unset	Supported	The port to listen on. An inbound without one does not listen, and is only useful as a part of another inbound.
bind_interface	string	—	Error: Where and how an inbound listens: it would take connections otherwise	—
routing_mark	number|string	—	Error: Where and how an inbound listens: it would take connections otherwise	—
reuse_addr	bool	—	Warned: Socket tuning: connections go the same way without it	—
netns	string	—	Error: Where and how an inbound listens: it would take connections otherwise	—
disable_tcp_keep_alive	bool	false	Supported	—
tcp_keep_alive	duration	unset	Supported	How long an accepted TCP connection is idle before keepalive probes it; 5m when unset.
tcp_keep_alive_interval	duration	unset	Supported	Between keepalive probes; 75s when unset.
tcp_fast_open	bool	false	Supported	TCP Fast Open on the TCP port it listens on: what a client that has the server’s cookie sends with its SYN is taken at once. On Linux, only with the server bit of net.ipv4.tcp_fastopen (2; 3 for client and server), which the default (1) leaves off.
tcp_multi_path	bool	—	Warned: Socket tuning: connections go the same way without it	—
udp_fragment	bool	unset	Supported	Whether the datagrams it sends from its UDP sockets may be fragmented on the way: where not, they carry don’t-fragment, and one larger than the path takes is refused rather than sent in pieces. Unset, as sing-box: they may for direct and hysteria2, and may not for the others.
udp_timeout	number|duration	unset	Supported	How long a UDP session through this inbound lives without traffic; 5m when unset, as in sing-box. A number is of seconds.
detour	string	—	Error: Handing an inbound’s connections to another inbound	—
network	listable-string, one of tcp, udp	unset	Supported	Only tcp, or only udp; both when unset.
udp_mapping	string, one of endpoint_independent, address_dependent, address_and_port_dependent	—	Warned: How UDP mappings are made and how many are kept: the same traffic	—
udp_filtering	string, one of endpoint_independent, address_dependent, address_and_port_dependent	—	Error: Which remote addresses may answer through a UDP mapping: others would	—
udp_nat_max	number	—	Warned: How UDP mappings are made and how many are kept: the same traffic	—

inbounds[trojan]

Rust: TrojanInboundOptions · Build: feature = "inbound-trojan"

Field	Type	Default	Status	Description
tag	string	""	Supported	Defaults to the type.
listen	string	unset	Supported	The address to listen on; defaults to 127.0.0.1.
listen_port	number	unset	Supported	The port to listen on. An inbound without one does not listen, and is only useful as a part of another inbound.
bind_interface	string	—	Error: Where and how an inbound listens: it would take connections otherwise	—
routing_mark	number|string	—	Error: Where and how an inbound listens: it would take connections otherwise	—
reuse_addr	bool	—	Warned: Socket tuning: connections go the same way without it	—
netns	string	—	Error: Where and how an inbound listens: it would take connections otherwise	—
disable_tcp_keep_alive	bool	false	Supported	—
tcp_keep_alive	duration	unset	Supported	How long an accepted TCP connection is idle before keepalive probes it; 5m when unset.
tcp_keep_alive_interval	duration	unset	Supported	Between keepalive probes; 75s when unset.
tcp_fast_open	bool	false	Supported	TCP Fast Open on the TCP port it listens on: what a client that has the server’s cookie sends with its SYN is taken at once. On Linux, only with the server bit of net.ipv4.tcp_fastopen (2; 3 for client and server), which the default (1) leaves off.
tcp_multi_path	bool	—	Warned: Socket tuning: connections go the same way without it	—
udp_fragment	bool	unset	Supported	Whether the datagrams it sends from its UDP sockets may be fragmented on the way: where not, they carry don’t-fragment, and one larger than the path takes is refused rather than sent in pieces. Unset, as sing-box: they may for direct and hysteria2, and may not for the others.
udp_timeout	number|duration	unset	Supported	How long a UDP session through this inbound lives without traffic; 5m when unset, as in sing-box. A number is of seconds.
detour	string	—	Error: Handing an inbound’s connections to another inbound	—
users	array → []	required	Supported	—
tls	object → object	unset	Supported	—
fallback	object → object	unset	Supported	Where a connection that fails to authenticate is relayed.
fallback_for_alpn	map	{}	Supported	The same, by the ALPN the connection’s TLS negotiated; the ones it does not name go to fallback.
multiplex	object → object	unset	Supported	—
transport	object → object, [grpc], [http], [httpupgrade], [ws]	unset	Supported	—

inbounds[trojan].users[]

Rust: TrojanUser · Build: feature = "inbound-trojan"

Field	Type	Default	Status	Description
name	string	unset	Supported	Who the user is to routing (auth_user), statistics and logs.
password	string	required	Supported	—

inbounds[trojan].fallback

Rust: FallbackServer · Build: any (feature = "inbound-anytls" , feature = "inbound-trojan" , feature = "inbound-vless" , feature = "inbound-shadowtls")

Field	Type	Default	Status	Description
server	string	required	Supported	—
server_port	number	required	Supported	—

inbounds[tuic]

Rust: TuicInboundOptions · Build: feature = "inbound-tuic"

Field	Type	Default	Status	Description
tag	string	""	Supported	Defaults to the type.
listen	string	unset	Supported	The address to listen on; defaults to 127.0.0.1.
listen_port	number	unset	Supported	The port to listen on. An inbound without one does not listen, and is only useful as a part of another inbound.
bind_interface	string	—	Error: Where and how an inbound listens: it would take connections otherwise	—
routing_mark	number|string	—	Error: Where and how an inbound listens: it would take connections otherwise	—
reuse_addr	bool	—	Warned: Socket tuning: connections go the same way without it	—
netns	string	—	Error: Where and how an inbound listens: it would take connections otherwise	—
disable_tcp_keep_alive	bool	false	Supported	—
tcp_keep_alive	duration	unset	Supported	How long an accepted TCP connection is idle before keepalive probes it; 5m when unset.
tcp_keep_alive_interval	duration	unset	Supported	Between keepalive probes; 75s when unset.
tcp_fast_open	bool	false	Supported	TCP Fast Open on the TCP port it listens on: what a client that has the server’s cookie sends with its SYN is taken at once. On Linux, only with the server bit of net.ipv4.tcp_fastopen (2; 3 for client and server), which the default (1) leaves off.
tcp_multi_path	bool	—	Warned: Socket tuning: connections go the same way without it	—
udp_fragment	bool	unset	Supported	Whether the datagrams it sends from its UDP sockets may be fragmented on the way: where not, they carry don’t-fragment, and one larger than the path takes is refused rather than sent in pieces. Unset, as sing-box: they may for direct and hysteria2, and may not for the others.
udp_timeout	number|duration	unset	Supported	How long a UDP session through this inbound lives without traffic; 5m when unset, as in sing-box. A number is of seconds.
detour	string	—	Error: Handing an inbound’s connections to another inbound	—
users	array → []	required	Supported	—
congestion_control	string, one of cubic, new_reno, bbr	cubic	Supported	—
auth_timeout	duration	unset	Supported	How long a connection may go without authenticating. 3s, as in sing-box, when not set.
zero_rtt_handshake	bool	false	Supported	—
heartbeat	duration	unset	Supported	—
tls	object → object	required	Supported	—
idle_timeout	duration	—	Warned: QUIC tuning: the same connection without it	—
keep_alive_period	duration	—	Warned: QUIC tuning: the same connection without it	—
stream_receive_window	number|string	—	Warned: QUIC tuning: the same connection without it	—
connection_receive_window	number|string	—	Warned: QUIC tuning: the same connection without it	—
max_concurrent_streams	number	—	Warned: QUIC tuning: the same connection without it	—
initial_packet_size	number	—	Warned: QUIC tuning: the same connection without it	—
disable_path_mtu_discovery	bool	—	Warned: QUIC tuning: the same connection without it	—

inbounds[tuic].users[]

Rust: TuicUser · Build: feature = "inbound-tuic"

Field	Type	Default	Status	Description
name	string	unset	Supported	Who the user is to routing (auth_user), statistics and logs.
uuid	string	required	Supported	—
password	string	""	Supported	—

inbounds[tun]

Rust: TunInboundOptions · Build: feature = "inbound-tun"

Field	Type	Default	Status	Description
tag	string	""	Supported	Defaults to the type.
interface_name	string	unset	Supported	The device’s name, used as it is: a start fails if it is taken. Without it, on macOS one past the highest utunN is chosen at start, as sing-box chooses, and kept across reloads (a host reads it back); one another program takes before the device opens is given up for the next free one, three at most. Elsewhere utun233.
netns	string	—	Error: Where and how an inbound listens: it would take connections otherwise	—
mtu	number	9000	Supported	9000 when omitted, as sing-box has it on Android.
address	listable-string	[]	Supported	The device’s addresses with their prefixes: one IPv4, one IPv6, or one of each.
dns_mode	string, one of disabled, native, hijack	unset	Supported	sing-box 1.14’s: whether the TUN’s DNS is the system’s, native, and its port 53 taken too, hijack, or neither, disabled. hijack with auto_route, disabled without, when unset. Port 53 is taken with auto_redirect on Linux and strict_route on Windows; on macOS hijack is native.
dns_address	listable-string	—	Error: The TUN’s own DNS handling: queries would be answered otherwise	—
auto_route	bool	false	Supported	Routes the system’s traffic into the device.
iproute2_table_index	number	unset	Supported	Linux: the routing table of the device’s routes (2022). Elsewhere, or without auto_route, it changes nothing, and is ignored with a warning, as in sing-box; so is iproute2_rule_index.
iproute2_rule_index	number	unset	Supported	Linux: the first of auto_route’s and auto_redirect’s ip rules (9000); the rules from it to 10 after it are sail’s, and removed at start and stop.
auto_redirect	bool	false	Supported	Linux: redirects TCP to sail with nftables and marks the rest into the device, and lets rules bypass sail before a connection is set up (sing-box 1.13). Without it, the fields of the redirect (its marks, NFQUEUE and fallback rule, and exclude_mptcp) change nothing, and are ignored with a warning, as in sing-box.
auto_redirect_input_mark	number|string	unset	Supported	The mark that routes a packet into the device (0x2023). Marks are numbers, or strings of hexadecimal (“0x2023”); 0 is the default.
auto_redirect_output_mark	number|string	unset	Supported	The mark sail’s own sockets carry, and flows that bypass it (0x2024). route.default_mark and routing_mark conflict with it.
auto_redirect_reset_mark	number|string	unset	Supported	The mark of a connection pre-match rejects, which the kernel resets (0x2025).
auto_redirect_nfqueue	number	unset	Supported	The NFQUEUE pre-match reads first packets from (100). If it cannot be bound, sail runs without pre-match: bypass rules are skipped.
auto_redirect_iproute2_fallback_rule_index	number	unset	Supported	The ip rule that sends what the main table has no route for into the device (32768).
exclude_mptcp	bool	false	Supported	Lets MPTCP go past sail rather than dropping it, which makes clients fall back to TCP.
loopback_address	listable-string	[]	Supported	Addresses whose TCP goes into the device rather than to the redirect listener: a destination sail’s own listeners use, say.
strict_route	bool	false	Supported	With auto_route, keeps traffic from going past sail. Linux: with one family on the device, the other is unreachable. Windows: firewall rules, as sing-tun’s: DNS leaves only through the device, but for sail’s own, and with no IPv6 on the device, none leaves. Elsewhere it changes nothing, as in sing-box.
route_address	listable-string	[]	Supported	Only these destinations are taken…
route_address_set	listable-string	[]	Supported	Rule-sets whose destination ip_cidr alone are taken, kept up to date as they are downloaded again.
route_exclude_address	listable-string	[]	Supported	…and not these.
route_exclude_address_set	listable-string	[]	Supported	Rule-sets whose destination ip_cidr are not taken.
include_interface	listable-string	[]	Supported	Linux, with auto_route: forwarded traffic is taken only from these interfaces…
exclude_interface	listable-string	[]	Supported	…or not from these. Naming lo in either leaves the host’s own traffic out.
include_uid	listable-number	[]	Supported	Linux, with auto_route: the host’s traffic is taken only from these users…
include_uid_range	listable-string	[]	Supported	…and from these ranges, as “1000:2000”.
exclude_uid	listable-number	[]	Supported	The host’s traffic of these users is not taken…
exclude_uid_range	listable-string	[]	Supported	…nor of these ranges.
include_android_user	listable-number	—	Error: Not supported; include_uid_range takes in an Android user’s apps (user N’s are uids N100000 to N100000+99999)	Android users: not supported, as no VpnService can take them in; include_uid_range takes in a user’s apps.
include_package	listable-string	[]	Supported	Android: the apps the host’s VPN takes in or leaves out, applied by the host.
exclude_package	listable-string	[]	Supported	—
include_mac_address	listable-string	—	Error: Filtering LAN clients by MAC address	—
exclude_mac_address	listable-string	—	Error: Filtering LAN clients by MAC address	—
udp_timeout	number|duration	unset	Supported	How long a UDP session through this inbound lives without traffic; 5m when unset, as in sing-box. A number is of seconds.
udp_mapping	string, one of endpoint_independent, address_dependent, address_and_port_dependent	—	Warned: How UDP mappings are made and how many are kept: the same traffic	—
udp_filtering	string, one of endpoint_independent, address_dependent, address_and_port_dependent	unset	Supported	sing-box 1.14’s: which remote addresses reach an app through the port it sent from. endpoint_independent: any (full cone, as P2P and some games need). address_and_port_dependent, the default: only an address and port the app sent to. address_dependent is not implemented, and is an error. An app’s port is one mapping in every case.
udp_nat_max	number	—	Warned: How UDP mappings are made and how many are kept: the same traffic	—
stack	string, one of system, gvisor, mixed	—	Warned: One stack serves every stack; the platform proxy is the host’s to set	—
platform	object → object	—	Warned: One stack serves every stack; the platform proxy is the host’s to set	—
endpoint_independent_nat	bool	unset	Supported (deprecated in sing-box)	sing-box’s older name for udp_filtering: endpoint_independent, deprecated there; the two may not disagree.
multi_queue	bool	false	sail extension	sing-box 1.15’s: Linux opens the device with IFF_MULTI_QUEUE, a queue and a netstack shard to each CPU, eight at most. Off, the default, one queue: measured faster in every case tried (Trojan over TUN, 2 and 4 cores, 2026-10-15: 2 queues 3-9% slower, 4 queues 4-9%). Elsewhere, and on a device the host opens, ignored with a warning.

inbounds[tun].platform

Field	Type	Default	Status	Description
http_proxy	object → object	—	Warned: One stack serves every stack; the platform proxy is the host’s to set	—

inbounds[tun].platform.http_proxy

Field	Type	Default	Status	Description
enabled	bool	—	Warned: One stack serves every stack; the platform proxy is the host’s to set	—
server	string	—	Warned: One stack serves every stack; the platform proxy is the host’s to set	—
server_port	number	—	Warned: One stack serves every stack; the platform proxy is the host’s to set	—
bypass_domain	listable-string	—	Warned: One stack serves every stack; the platform proxy is the host’s to set	—
match_domain	listable-string	—	Warned: One stack serves every stack; the platform proxy is the host’s to set	—

inbounds[vless]

Rust: VlessInboundOptions · Build: feature = "inbound-vless"

Field	Type	Default	Status	Description
tag	string	""	Supported	Defaults to the type.
listen	string	unset	Supported	The address to listen on; defaults to 127.0.0.1.
listen_port	number	unset	Supported	The port to listen on. An inbound without one does not listen, and is only useful as a part of another inbound.
bind_interface	string	—	Error: Where and how an inbound listens: it would take connections otherwise	—
routing_mark	number|string	—	Error: Where and how an inbound listens: it would take connections otherwise	—
reuse_addr	bool	—	Warned: Socket tuning: connections go the same way without it	—
netns	string	—	Error: Where and how an inbound listens: it would take connections otherwise	—
disable_tcp_keep_alive	bool	false	Supported	—
tcp_keep_alive	duration	unset	Supported	How long an accepted TCP connection is idle before keepalive probes it; 5m when unset.
tcp_keep_alive_interval	duration	unset	Supported	Between keepalive probes; 75s when unset.
tcp_fast_open	bool	false	Supported	TCP Fast Open on the TCP port it listens on: what a client that has the server’s cookie sends with its SYN is taken at once. On Linux, only with the server bit of net.ipv4.tcp_fastopen (2; 3 for client and server), which the default (1) leaves off.
tcp_multi_path	bool	—	Warned: Socket tuning: connections go the same way without it	—
udp_fragment	bool	unset	Supported	Whether the datagrams it sends from its UDP sockets may be fragmented on the way: where not, they carry don’t-fragment, and one larger than the path takes is refused rather than sent in pieces. Unset, as sing-box: they may for direct and hysteria2, and may not for the others.
udp_timeout	number|duration	unset	Supported	How long a UDP session through this inbound lives without traffic; 5m when unset, as in sing-box. A number is of seconds.
detour	string	—	Error: Handing an inbound’s connections to another inbound	—
users	array → []	required	Supported	—
tls	object → object	unset	Supported	—
multiplex	object → object	unset	Supported	—
transport	object → object, [grpc], [http], [httpupgrade], [ws]	unset	Supported	—
fallback	object → object	unset	sail extension	Where a connection that fails to authenticate is relayed.
fallback_for_alpn	object of object → object	{}	sail extension	The same, by the ALPN the connection’s TLS negotiated; the ones it does not name go to fallback.

inbounds[vless].users[]

Rust: VlessUser · Build: feature = "inbound-vless"

Field	Type	Default	Status	Description
name	string	unset	Supported	Who the user is to routing (auth_user), statistics and logs.
uuid	string	required	Supported	—
flow	string	""	Supported	"" or xtls-rprx-vision.

inbounds[vmess]

Rust: VMessInboundOptions · Build: feature = "inbound-vmess"

Field	Type	Default	Status	Description
tag	string	""	Supported	Defaults to the type.
listen	string	unset	Supported	The address to listen on; defaults to 127.0.0.1.
listen_port	number	unset	Supported	The port to listen on. An inbound without one does not listen, and is only useful as a part of another inbound.
bind_interface	string	—	Error: Where and how an inbound listens: it would take connections otherwise	—
routing_mark	number|string	—	Error: Where and how an inbound listens: it would take connections otherwise	—
reuse_addr	bool	—	Warned: Socket tuning: connections go the same way without it	—
netns	string	—	Error: Where and how an inbound listens: it would take connections otherwise	—
disable_tcp_keep_alive	bool	false	Supported	—
tcp_keep_alive	duration	unset	Supported	How long an accepted TCP connection is idle before keepalive probes it; 5m when unset.
tcp_keep_alive_interval	duration	unset	Supported	Between keepalive probes; 75s when unset.
tcp_fast_open	bool	false	Supported	TCP Fast Open on the TCP port it listens on: what a client that has the server’s cookie sends with its SYN is taken at once. On Linux, only with the server bit of net.ipv4.tcp_fastopen (2; 3 for client and server), which the default (1) leaves off.
tcp_multi_path	bool	—	Warned: Socket tuning: connections go the same way without it	—
udp_fragment	bool	unset	Supported	Whether the datagrams it sends from its UDP sockets may be fragmented on the way: where not, they carry don’t-fragment, and one larger than the path takes is refused rather than sent in pieces. Unset, as sing-box: they may for direct and hysteria2, and may not for the others.
udp_timeout	number|duration	unset	Supported	How long a UDP session through this inbound lives without traffic; 5m when unset, as in sing-box. A number is of seconds.
detour	string	—	Error: Handing an inbound’s connections to another inbound	—
users	array → []	required	Supported	—
tls	object → object	unset	Supported	—
multiplex	object → object	unset	Supported	—
transport	object → object, [grpc], [http], [httpupgrade], [ws]	unset	Supported	—

inbounds[vmess].users[]

Rust: VMessUser · Build: feature = "inbound-vmess"

Field	Type	Default	Status	Description
name	string	unset	Supported	Who the user is to routing (auth_user), statistics and logs.
uuid	string	required	Supported	—
alterId	number	0	Supported	Only 0: AEAD headers. Legacy VMess is not served.

Types sail does not implement: inbounds

Type	Status	Fields
inbounds[cloudflared]	Error: A protocol sail does not implement	69
inbounds[hysteria]	Error: A protocol sail does not implement	98
inbounds[naive]	Error: A protocol sail does not implement	83
inbounds[snell]	Error: A protocol sail does not implement	22