Outbounds and groups

Generated by website/scripts/build-config.mjs; do not edit. It reads sail’s configuration types (its Rust source), sing-box’s field registry (sail/src/config/singbox/fields.json, sing-box v1.14.2) and the tiers the registry test measured (fields.tiers.json). Change the source comments or those files, then run npm run docs:config in website/.

• Status: each sing-box field as the registry test measured it: Supported (read and acted on; a value sail cannot take is still an error), Warned (dropped with a warning) or Error (the configuration is refused), with the reason; sail extension marks fields and types sing-box does not have.
• Type: sing-box’s JSON type for its fields; from sail’s Rust definitions for extensions.
• Default: from sail’s serde declarations; unset means the field may be left out, and the description says what applies then. Only fields sail reads have one.
• Description: sail’s source comments, in their source language; for an extension without one, the registry test’s note.
• Build: the cfg conditions in the Rust source (Cargo features and platforms).

Validate a configuration with sail -c config.json -T. Editors check and complete it by the JSON schema: put "$schema": "https://peakpassvpn.github.io/sail/schema.json" at its top (made by the same generator; a field sail refuses is marked not allowed, one it warns of deprecated). The Clash and Surge support tables are under Compatibility.

outbounds[]

Rust: Outbound

Field	Type	Default	Status	Description
type	string, one of anytls, block, bridge, direct, http, hysteria, hysteria2, naive, selector, shadowsocks, shadowtls, snell, socks, ssh, tor, trojan, tuic, urltest, vless, vmess	required	Supported	—

outbounds[anytls]

Rust: AnyTlsOutboundOptions · Build: feature = "outbound-anytls"

Field	Type	Default	Status	Description
tag	string	""	Supported	Defaults to the type.
detour	string	unset	Supported	The outbound to dial through, in place of a socket of its own.
bind_interface	string	unset	Supported	The interface to send through, by name. Loopback destinations still go over loopback, where sing-box applies the bind to them as well.
inet4_bind_address	string	unset	Supported	The local address for IPv4 destinations, loopback ones aside: as bind_interface.
inet6_bind_address	string	unset	Supported	The local address for IPv6 destinations, loopback ones aside: as bind_interface.
bind_address_no_port	bool	false	Supported	IP_BIND_ADDRESS_NO_PORT on TCP sockets bound to an address, so that the port is picked at connect: Linux only.
protect_path	string	unset	Supported	A Unix socket each socket’s descriptor is handed to, with SCM_RIGHTS, before it binds or connects, for the process there to protect it (from its VPN, say); it answers one byte. Besides what the host protects. Unix only.
routing_mark	number|string	unset	Supported	SO_MARK, Linux only.
reuse_addr	bool	false	Supported	SO_REUSEADDR, and SO_REUSEPORT on Unix, on UDP sockets.
netns	string	—	Error: Linux network namespaces: sockets would leave another way	Not implemented yet.
connect_timeout	duration	unset	Supported	How long a TCP connect to one address may take; 5s when unset.
tcp_fast_open	bool	false	Supported	TCP Fast Open: the first data written goes with the SYN. Its addresses are then tried one by one, not raced.
tcp_multi_path	bool	—	Warned: Socket tuning: connections go the same way without it	Not implemented yet.
disable_tcp_keep_alive	bool	false	Supported	No TCP keepalive at all.
tcp_keep_alive	duration	unset	Supported	How long a TCP connection is idle before keepalive probes it; 5m when unset.
tcp_keep_alive_interval	duration	unset	Supported	Between keepalive probes; 75s when unset.
udp_fragment	bool	unset	Supported	Whether UDP datagrams may be fragmented on the way; unset, as the place says, see udp_fragment_default.
domain_resolver	string|object → object	unset	Supported	The DNS server that resolves the names dialled.
network_strategy	string, one of default, fallback, hybrid	unset	Supported	Which of the host’s interfaces a connection goes out of, and how they race; default where only types are given. Only where the host lists its interfaces (NetworkState::interfaces).
network_type	listable-string, one of cellular, ethernet, other, wifi	[]	Supported	The types of interface the strategy goes out of first.
fallback_network_type	listable-string, one of cellular, ethernet, other, wifi	[]	Supported	The types it falls back to, with fallback.
fallback_delay	duration	unset	Supported	How long the addresses of one family are tried before those of the other are raced against them (Happy Eyeballs), and the first interfaces before the fallback ones; 300ms when unset.
server	string	unset	Supported	May be left out, with server_port, by an outbound with a detour: one over ShadowTLS, which dials its own server.
server_port	number	unset	Supported	—
tls	object → object	unset	Supported	—
password	string	required	Supported	—
idle_session_check_interval	duration	unset	Supported	—
idle_session_timeout	duration	unset	Supported	—
min_idle_session	number	0	Supported	—
client_metadata	string	—	Warned: Metadata the client tells the server: the connection goes the same way without it	—
domain_strategy	string	unset	Supported (deprecated in sing-box)	sing-box’s deprecated field for the families names resolve to, which a resolver’s own strategy goes before.
skip_default_domain_resolver	bool	false	sail extension	A sail extension: without a domain_resolver of its own, the names dialled resolve as the DNS rules say, not as route.default_domain_resolver does; as Mihomo’s DIRECT resolves apart from the proxies’ servers.
tcp_concurrent	bool	false	sail extension	A sail extension, Mihomo’s tcp-concurrent: a name’s addresses are all connected to at once and the first to connect is taken, rather than one family’s one by one, the other’s raced against them after fallback_delay (Happy Eyeballs). With network_strategy, each address is still raced over the interfaces, so as many sockets open at once as there are addresses times interfaces.

outbounds[block]

Rust: BlockOptions · Build: feature = "outbound-drop"

Field	Type	Default	Status	Description
tag	string	""	Supported	Defaults to the type.

outbounds[direct]

Rust: DirectOptions · Build: feature = "outbound-direct"

Field	Type	Default	Status	Description
tag	string	""	Supported	Defaults to the type.
detour	string	—	Error: A detour for a direct outbound, which sing-box refuses too	The outbound to dial through, in place of a socket of its own.
bind_interface	string	unset	Supported	The interface to send through, by name. Loopback destinations still go over loopback, where sing-box applies the bind to them as well.
inet4_bind_address	string	unset	Supported	The local address for IPv4 destinations, loopback ones aside: as bind_interface.
inet6_bind_address	string	unset	Supported	The local address for IPv6 destinations, loopback ones aside: as bind_interface.
bind_address_no_port	bool	false	Supported	IP_BIND_ADDRESS_NO_PORT on TCP sockets bound to an address, so that the port is picked at connect: Linux only.
protect_path	string	unset	Supported	A Unix socket each socket’s descriptor is handed to, with SCM_RIGHTS, before it binds or connects, for the process there to protect it (from its VPN, say); it answers one byte. Besides what the host protects. Unix only.
routing_mark	number|string	unset	Supported	SO_MARK, Linux only.
reuse_addr	bool	false	Supported	SO_REUSEADDR, and SO_REUSEPORT on Unix, on UDP sockets.
netns	string	—	Error: Linux network namespaces: sockets would leave another way	Not implemented yet.
connect_timeout	duration	unset	Supported	How long a TCP connect to one address may take; 5s when unset.
tcp_fast_open	bool	false	Supported	TCP Fast Open: the first data written goes with the SYN. Its addresses are then tried one by one, not raced.
tcp_multi_path	bool	—	Warned: Socket tuning: connections go the same way without it	Not implemented yet.
disable_tcp_keep_alive	bool	false	Supported	No TCP keepalive at all.
tcp_keep_alive	duration	unset	Supported	How long a TCP connection is idle before keepalive probes it; 5m when unset.
tcp_keep_alive_interval	duration	unset	Supported	Between keepalive probes; 75s when unset.
udp_fragment	bool	unset	Supported	Whether UDP datagrams may be fragmented on the way; unset, as the place says, see udp_fragment_default.
domain_resolver	string|object → object	unset	Supported	The DNS server that resolves the names dialled.
network_strategy	string, one of default, fallback, hybrid	unset	Supported	Which of the host’s interfaces a connection goes out of, and how they race; default where only types are given. Only where the host lists its interfaces (NetworkState::interfaces).
network_type	listable-string, one of cellular, ethernet, other, wifi	[]	Supported	The types of interface the strategy goes out of first.
fallback_network_type	listable-string, one of cellular, ethernet, other, wifi	[]	Supported	The types it falls back to, with fallback.
fallback_delay	duration	unset	Supported	How long the addresses of one family are tried before those of the other are raced against them (Happy Eyeballs), and the first interfaces before the fallback ones; 300ms when unset.
domain_strategy	string	unset	Supported (deprecated in sing-box)	sing-box’s deprecated field for the families names resolve to, which a resolver’s own strategy goes before.
skip_default_domain_resolver	bool	false	sail extension	A sail extension: without a domain_resolver of its own, the names dialled resolve as the DNS rules say, not as route.default_domain_resolver does; as Mihomo’s DIRECT resolves apart from the proxies’ servers.
tcp_concurrent	bool	false	sail extension	A sail extension, Mihomo’s tcp-concurrent: a name’s addresses are all connected to at once and the first to connect is taken, rather than one family’s one by one, the other’s raced against them after fallback_delay (Happy Eyeballs). With network_strategy, each address is still raced over the interfaces, so as many sockets open at once as there are addresses times interfaces.

outbounds[fallback]

Rust: FallbackOutboundOptions · Build: feature = "outbound-fallback" · sail extension

Field	Type	Default	Status	Description
tag	string	""	sail extension	Defaults to the type.
outbounds	array of string	[]	sail extension	Its members, in order; none may be when its providers give others.
providers	string or array of string	[]	sail extension	The outbound providers, by tag, whose outbounds join the group’s own, in this order.
filter	string or array of string	[]	sail extension	Regular expressions, as Mihomo’s filter: of the providers’ outbounds, only those whose names match one are members, those of the first first. The group’s own outbounds are not filtered.
exclude_filter	string or array of string	[]	sail extension	Regular expressions no member’s name may match, the group’s own outbounds’ too.
exclude_type	string or array of string	[]	sail extension	The types no member may be of, the group’s own outbounds too, in Mihomo’s names for them, without case: Shadowsocks, Vmess, Socks5, Direct, …
empty_fallback	string	unset	sail extension	An outbound, not a group, that is the member while there is none else. Without it such a group has none, and its connections fail.
url	string or array of string	default_url()	sail extension	What is requested through each member to test it: a URL, or a list of them, a sail extension, all tested at once in each round. The latency shown is the first URL’s, and the API shows it as the group’s testUrl.
url_policy	string, one of any, all	any	sail extension	With several URLs, which a member must answer to pass: any of them, which tells a dead member from a URL blocked, or all; a sail extension. Under any, the latency shown is that of the first URL that answered.
expected_status	string	unset	sail extension	The HTTP statuses a test must be answered with to pass, as Mihomo’s expected-status: codes and ranges, 200/204/401-429; any when unset. Each URL’s answer must be one.
unified_delay	bool	false	sail extension	The latency of a second request on the connection the first opened, without the connect and handshakes, as Mihomo’s unified-delay; a sail extension.
interval	duration	unset	sail extension	—
timeout	duration	unset	sail extension	How long a test may take before its member counts as failed; 5s, as Mihomo’s timeout. Also how close together max_failed_times failures must come, and dial_timeout when that is unset.
dial_timeout	duration	unset	sail extension	How long a connection attempt through a member, with a member left to fall back to, may take before the group moves on to the next; a sail extension, 1s at least, timeout when unset. One still dialling the member’s server then marks it down at once; one in the member’s handshake is counted toward max_failed_times.
max_failed_times	number	unset	sail extension	How many failed connections, within timeout of the first, have the members tested again; 5, as Mihomo’s max-failed-times. Only failures that may be the destination’s count: one that says the member’s server cannot be reached marks the member down at once.
lazy	bool	true	sail extension	Tests only while the group is in use: not when it was not used since the last ones.
interrupt_exist_connections	bool	false	sail extension	Ends the connections through the member left once the group switches.
debounce	object → object	the type’s default	sail extension	How many rounds of tests in a row have the group leave a member, or take an earlier one back, and how long it stays on a member at least; a sail extension. Unset, every round counts at once.
disable_udp	—	—	sail extension	The group carries TCP alone, whatever member it picks (Mihomo’s disable-udp)

outbounds[fallback].debounce

Rust: DebounceOptions · Build: feature = "outbound-fallback" · sail extension

Field	Type	Default	Status	Description
fail_after	number	1	sail extension	Failed rounds in a row before the member the group is on is left, by default one. A connection that finds its server unreachable leaves it at once all the same.
recover_after	number	1	sail extension	Passed rounds in a row before a member that was down, failed or found unreachable, is up again, and taken back if it comes first, by default one.
min_dwell	duration	unset	sail extension	The least time on a member before the group leaves it, while it is up, for an earlier member up again; 0s. The first round past it switches. A member down is left at once.

outbounds[http]

Rust: HttpOutboundOptions · Build: feature = "outbound-http"

Field	Type	Default	Status	Description
tag	string	""	Supported	Defaults to the type.
detour	string	unset	Supported	The outbound to dial through, in place of a socket of its own.
bind_interface	string	unset	Supported	The interface to send through, by name. Loopback destinations still go over loopback, where sing-box applies the bind to them as well.
inet4_bind_address	string	unset	Supported	The local address for IPv4 destinations, loopback ones aside: as bind_interface.
inet6_bind_address	string	unset	Supported	The local address for IPv6 destinations, loopback ones aside: as bind_interface.
bind_address_no_port	bool	false	Supported	IP_BIND_ADDRESS_NO_PORT on TCP sockets bound to an address, so that the port is picked at connect: Linux only.
protect_path	string	unset	Supported	A Unix socket each socket’s descriptor is handed to, with SCM_RIGHTS, before it binds or connects, for the process there to protect it (from its VPN, say); it answers one byte. Besides what the host protects. Unix only.
routing_mark	number|string	unset	Supported	SO_MARK, Linux only.
reuse_addr	bool	false	Supported	SO_REUSEADDR, and SO_REUSEPORT on Unix, on UDP sockets.
netns	string	—	Error: Linux network namespaces: sockets would leave another way	Not implemented yet.
connect_timeout	duration	unset	Supported	How long a TCP connect to one address may take; 5s when unset.
tcp_fast_open	bool	false	Supported	TCP Fast Open: the first data written goes with the SYN. Its addresses are then tried one by one, not raced.
tcp_multi_path	bool	—	Warned: Socket tuning: connections go the same way without it	Not implemented yet.
disable_tcp_keep_alive	bool	false	Supported	No TCP keepalive at all.
tcp_keep_alive	duration	unset	Supported	How long a TCP connection is idle before keepalive probes it; 5m when unset.
tcp_keep_alive_interval	duration	unset	Supported	Between keepalive probes; 75s when unset.
udp_fragment	bool	unset	Supported	Whether UDP datagrams may be fragmented on the way; unset, as the place says, see udp_fragment_default.
domain_resolver	string|object → object	unset	Supported	The DNS server that resolves the names dialled.
network_strategy	string, one of default, fallback, hybrid	unset	Supported	Which of the host’s interfaces a connection goes out of, and how they race; default where only types are given. Only where the host lists its interfaces (NetworkState::interfaces).
network_type	listable-string, one of cellular, ethernet, other, wifi	[]	Supported	The types of interface the strategy goes out of first.
fallback_network_type	listable-string, one of cellular, ethernet, other, wifi	[]	Supported	The types it falls back to, with fallback.
fallback_delay	duration	unset	Supported	How long the addresses of one family are tried before those of the other are raced against them (Happy Eyeballs), and the first interfaces before the fallback ones; 300ms when unset.
server	string	unset	Supported	May be left out, with server_port, by an outbound with a detour: one over ShadowTLS, which dials its own server.
server_port	number	unset	Supported	—
username	string	unset	Supported	—
password	string	unset	Supported	—
tls	object → object	unset	Supported	—
path	string	unset	Supported	The request target instead of the destination, which then goes only in Host, as sing-box sends it.
headers	map	{}	Supported	Sent with every CONNECT.
domain_strategy	string	unset	Supported (deprecated in sing-box)	sing-box’s deprecated field for the families names resolve to, which a resolver’s own strategy goes before.
skip_default_domain_resolver	bool	false	sail extension	A sail extension: without a domain_resolver of its own, the names dialled resolve as the DNS rules say, not as route.default_domain_resolver does; as Mihomo’s DIRECT resolves apart from the proxies’ servers.
tcp_concurrent	bool	false	sail extension	A sail extension, Mihomo’s tcp-concurrent: a name’s addresses are all connected to at once and the first to connect is taken, rather than one family’s one by one, the other’s raced against them after fallback_delay (Happy Eyeballs). With network_strategy, each address is still raced over the interfaces, so as many sockets open at once as there are addresses times interfaces.
version	number	unset	sail extension	The HTTP version, sing-box 1.15’s: 1, 2 or 3; unset (or 0), 1, as sing-box 1.14 speaks, until sail follows 1.15 stable. HTTP/2 needs TLS, and not REALITY’s: without, HTTP/1.1. 3 is HTTP/2, which sail speaks in its place.
disable_version_fallback	bool	false	sail extension	HTTP/2 alone, never HTTP/1.1 in its place: a server that picks no h2 is an error.
idle_timeout	duration	unset	sail extension	HTTP/2’s, sing-box 1.15’s: how long a ping may go unanswered.
keep_alive_period	duration	unset	sail extension	HTTP/2’s: a ping after this long with nothing received.
stream_receive_window	number	unset	sail extension	HTTP/2’s: a tunnel’s receive window.
connection_receive_window	number	unset	sail extension	HTTP/2’s: a connection’s receive window.
max_concurrent_streams	number	unset	sail extension	HTTP/2’s: the most tunnels one connection carries.

outbounds[hysteria2]

Rust: Hysteria2OutboundOptions · Build: feature = "outbound-hysteria2"

Field	Type	Default	Status	Description
tag	string	""	Supported	Defaults to the type.
detour	string	unset	Supported	The outbound to dial through, in place of a socket of its own.
bind_interface	string	unset	Supported	The interface to send through, by name. Loopback destinations still go over loopback, where sing-box applies the bind to them as well.
inet4_bind_address	string	unset	Supported	The local address for IPv4 destinations, loopback ones aside: as bind_interface.
inet6_bind_address	string	unset	Supported	The local address for IPv6 destinations, loopback ones aside: as bind_interface.
bind_address_no_port	bool	false	Supported	IP_BIND_ADDRESS_NO_PORT on TCP sockets bound to an address, so that the port is picked at connect: Linux only.
protect_path	string	unset	Supported	A Unix socket each socket’s descriptor is handed to, with SCM_RIGHTS, before it binds or connects, for the process there to protect it (from its VPN, say); it answers one byte. Besides what the host protects. Unix only.
routing_mark	number|string	unset	Supported	SO_MARK, Linux only.
reuse_addr	bool	false	Supported	SO_REUSEADDR, and SO_REUSEPORT on Unix, on UDP sockets.
netns	string	—	Error: Linux network namespaces: sockets would leave another way	Not implemented yet.
connect_timeout	duration	unset	Supported	How long a TCP connect to one address may take; 5s when unset.
tcp_fast_open	bool	false	Supported	TCP Fast Open: the first data written goes with the SYN. Its addresses are then tried one by one, not raced.
tcp_multi_path	bool	—	Warned: Socket tuning: connections go the same way without it	Not implemented yet.
disable_tcp_keep_alive	bool	false	Supported	No TCP keepalive at all.
tcp_keep_alive	duration	unset	Supported	How long a TCP connection is idle before keepalive probes it; 5m when unset.
tcp_keep_alive_interval	duration	unset	Supported	Between keepalive probes; 75s when unset.
udp_fragment	bool	unset	Supported	Whether UDP datagrams may be fragmented on the way; unset, as the place says, see udp_fragment_default.
domain_resolver	string|object → object	unset	Supported	The DNS server that resolves the names dialled.
network_strategy	string, one of default, fallback, hybrid	unset	Supported	Which of the host’s interfaces a connection goes out of, and how they race; default where only types are given. Only where the host lists its interfaces (NetworkState::interfaces).
network_type	listable-string, one of cellular, ethernet, other, wifi	[]	Supported	The types of interface the strategy goes out of first.
fallback_network_type	listable-string, one of cellular, ethernet, other, wifi	[]	Supported	The types it falls back to, with fallback.
fallback_delay	duration	unset	Supported	How long the addresses of one family are tried before those of the other are raced against them (Happy Eyeballs), and the first interfaces before the fallback ones; 300ms when unset.
server	string	required	Supported	—
server_port	number	unset	Supported	The one port; with server_ports, not needed.
server_ports	listable-string	unset	Supported	Ports or ranges (“20000:30000”) to hop between.
hop_interval	duration	unset	Supported	How often to hop, 30s unless set.
hop_interval_max	duration	—	Warned: Hysteria’s congestion tuning and debugging, the longest hop interval, and its QUIC fingerprint: the same traffic	—
up_mbps	number	unset	Supported	What we may send at; set, it selects Brutal.
down_mbps	number	unset	Supported	What we can receive at, told to the server.
obfs	object → object, [gecko], [salamander]	unset	Supported	—
password	string	required	Supported	—
network	listable-string, one of tcp, udp	unset	Supported	“tcp” or “udp”, or both, as unset.
tls	object → object	required	Supported	—
idle_timeout	duration	—	Warned: QUIC tuning: the same connection without it	—
keep_alive_period	duration	—	Warned: QUIC tuning: the same connection without it	—
stream_receive_window	number|string	—	Warned: QUIC tuning: the same connection without it	—
connection_receive_window	number|string	—	Warned: QUIC tuning: the same connection without it	—
max_concurrent_streams	number	—	Warned: QUIC tuning: the same connection without it	—
initial_packet_size	number	—	Warned: QUIC tuning: the same connection without it	—
disable_path_mtu_discovery	bool	—	Warned: QUIC tuning: the same connection without it	—
bbr_profile	string, one of standard, conservative, aggressive	—	Warned: Hysteria’s congestion tuning and debugging, the longest hop interval, and its QUIC fingerprint: the same traffic	—
brutal_debug	bool	—	Warned: Hysteria’s congestion tuning and debugging, the longest hop interval, and its QUIC fingerprint: the same traffic	—
disable_chrome_parrot	bool	—	Warned: Hysteria’s congestion tuning and debugging, the longest hop interval, and its QUIC fingerprint: the same traffic	—
realm	object → object	—	Error: Meeting peers through a Hysteria realm: connections would be made otherwise	—
domain_strategy	string	unset	Supported (deprecated in sing-box)	sing-box’s deprecated field for the families names resolve to, which a resolver’s own strategy goes before.
skip_default_domain_resolver	bool	false	sail extension	A sail extension: without a domain_resolver of its own, the names dialled resolve as the DNS rules say, not as route.default_domain_resolver does; as Mihomo’s DIRECT resolves apart from the proxies’ servers.

outbounds[hysteria2].tls

Rust: OutboundTls

Field	Type	Default	Status	Description
enabled	bool	false	Supported	—
engine	string, one of go, apple, windows	—	Warned: The TLS stack: sail has one	—
disable_sni	bool	false	Supported	Sends no SNI. The certificate is still verified against server_name, unless insecure.
server_name	string	unset	Supported	Defaults to the server’s address.
insecure	bool	false	Supported	—
alpn	listable-string	unset	Supported	—
min_version	string, one of 1.0, 1.1, 1.2, 1.3	unset	Supported	The lowest TLS version to negotiate, 1.0 to 1.3; unset, 1.2.
max_version	string, one of 1.0, 1.1, 1.2, 1.3	unset	Supported	The highest; unset, 1.3.
cipher_suites	listable-string	—	Error: TLS cipher suites and key exchanges: sail’s TLS would negotiate others than asked	—
curve_preferences	listable-string, one of P256, P384, P521, X25519, X25519MLKEM768	—	Error: TLS cipher suites and key exchanges: sail’s TLS would negotiate others than asked	—
certificate	listable-string	unset	Supported	An inline PEM certificate to trust.
certificate_path	string	unset	Supported	A PEM certificate to trust, by path.
certificate_public_key_sha256	listable-string|array	unset	Supported	The SHA-256 hashes, base64, of the public keys to take a server’s certificate by, in place of the certificates trusted, the name and insecure.
client_certificate	listable-string	unset	Supported	An inline PEM certificate, its chain after it, presented when the server asks for one; with client_key.
client_certificate_path	string	unset	Supported	client_certificate, by path.
client_key	listable-string	unset	Supported	The inline PEM key of the client certificate.
client_key_path	string	unset	Supported	client_key, by path.
fragment	bool	—	Error: Fragmenting or spoofing the TLS handshake against censorship	—
fragment_fallback_delay	duration	—	Error: Fragmenting or spoofing the TLS handshake against censorship	—
record_fragment	bool	—	Error: Fragmenting or spoofing the TLS handshake against censorship	—
spoof	string	—	Error: Fragmenting or spoofing the TLS handshake against censorship	—
spoof_method	string, one of wrong-sequence, wrong-checksum, wrong-ack, wrong-md5, wrong-timestamp	—	Error: Fragmenting or spoofing the TLS handshake against censorship	—
kernel_tx	bool	—	Warned: The TLS stack, kernel TLS and the handshake’s timeout: the same TLS without them	—
kernel_rx	bool	—	Warned: The TLS stack, kernel TLS and the handshake’s timeout: the same TLS without them	—
handshake_timeout	duration	—	Warned: The TLS stack, kernel TLS and the handshake’s timeout: the same TLS without them	—
ech	object → object	unset	Supported	—
utls	object → object	—	Error: Not supported over QUIC	The browser the ClientHello imitates. Unset, it is Chrome’s.
reality	object → object	unset	Supported	—
certificate_sha256	string or array of string	unset	sail extension	sing-box 1.15’s, with Mihomo’s fingerprint semantics beyond it: the SHA-256 hashes, hex or base64, of whole certificates (DER) to take a server by, in place of the certificates trusted and insecure. A hash of the server’s own certificate takes it outright: no CA and no name are checked, so that exact certificate is trusted for any server name. A hash of a certificate sent after it, an intermediate or a root, is the only CA the server’s certificate is verified by, with the server name. With certificate_public_key_sha256, either passing is enough.

outbounds[hysteria2].tls.utls

Rust: OutboundUtls

Field	Type	Default	Status	Description
enabled	bool	true	Supported	—
fingerprint	string, one of chrome_psk, chrome_psk_shuffle, chrome_padding_psk_shuffle, chrome_pq, chrome_pq_psk, chrome, firefox, edge, safari, 360, qq, ios, android, random, randomized	—	Error: Not supported over QUIC	—

outbounds[hysteria2].realm

Field	Type	Default	Status	Description
server_url	string	—	Error: Meeting peers through a Hysteria realm: connections would be made otherwise	—
token	string	—	Error: Meeting peers through a Hysteria realm: connections would be made otherwise	—
realm_id	string	—	Error: Meeting peers through a Hysteria realm: connections would be made otherwise	—
stun_servers	listable-string	—	Error: Meeting peers through a Hysteria realm: connections would be made otherwise	—
ip_version	number, one of 0, 4, 6	—	Error: Meeting peers through a Hysteria realm: connections would be made otherwise	—
port_mapping	object → object	—	Error: Meeting peers through a Hysteria realm: connections would be made otherwise	—
http_client	string|object → object	—	Error: Meeting peers through a Hysteria realm: connections would be made otherwise	—

outbounds[load-balance]

Rust: LoadBalanceOutboundOptions · Build: feature = "outbound-load-balance" · sail extension

Field	Type	Default	Status	Description
tag	string	""	sail extension	Defaults to the type.
outbounds	array of string	[]	sail extension	Its members; none may be when its providers give others.
providers	string or array of string	[]	sail extension	The outbound providers, by tag, whose outbounds join the group’s own, in this order.
filter	string or array of string	[]	sail extension	Regular expressions, as Mihomo’s filter: of the providers’ outbounds, only those whose names match one are members, those of the first first. The group’s own outbounds are not filtered.
exclude_filter	string or array of string	[]	sail extension	Regular expressions no member’s name may match, the group’s own outbounds’ too.
exclude_type	string or array of string	[]	sail extension	The types no member may be of, the group’s own outbounds too, in Mihomo’s names for them, without case: Shadowsocks, Vmess, Socks5, Direct, …
empty_fallback	string	unset	sail extension	An outbound, not a group, that is the member while there is none else. Without it such a group has none, and its connections fail.
strategy	string, one of consistent-hashing, round-robin, sticky-sessions	consistent-hashing	sail extension	—
hash_key	string, one of user	unset	sail extension	user: a connection’s user is its key, not its destination (and source); a sail extension. Unset, or a connection of no user, as without it. round-robin keys on nothing, and refuses it.
url	string	default_url()	sail extension	What is requested through each member to test it.
interval	duration	unset	sail extension	—
expected_status	string	unset	sail extension	The HTTP statuses a test must be answered with to pass, as urltest’s; any when unset.
unified_delay	bool	false	sail extension	The latency of a second request on the connection the first opened, without the connect and handshakes, as Mihomo’s unified-delay; a sail extension.
timeout	duration	unset	sail extension	How long a test may take before its member counts as failed; 5s. Also how close together max_failed_times failures must come, as urltest’s.
max_failed_times	number	unset	sail extension	How many failed connections, within timeout of the first, have the members tested again; 5, as urltest’s.
lazy	bool	true	sail extension	Tests only while the group is in use: not when it was not used since the last ones.
disable_udp	—	—	sail extension	The group carries TCP alone, whatever member it picks (Mihomo’s disable-udp)

outbounds[mptp]

Rust: MptpOutboundOptions · Build: feature = "outbound-mptp" · sail extension

Field	Type	Default	Status	Description
tag	string	""	sail extension	Defaults to the type.
outbounds	array of string	required	sail extension	—
server	string	required	sail extension	—
server_port	number	required	sail extension	—

outbounds[network]

Rust: NetworkGroupOptions · Build: feature = "outbound-network-group" · sail extension

Field	Type	Default	Status	Description
tag	string	""	sail extension	Defaults to the type.
branches	array of object → []	required	sail extension	Tried in order: the first whose conditions the network matches takes the connection.
default	string	required	sail extension	Where connections go when no branch matches.

outbounds[network].branches[]

Rust: Branch · Build: feature = "outbound-network-group" · sail extension

Field	Type	Default	Status	Description
outbound	string	required	sail extension	—
wifi_ssid	string or array of string	[]	sail extension	—
wifi_bssid	string or array of string	[]	sail extension	—
network_type	string or array of string	[]	sail extension	wifi, cellular, ethernet, other.
network_is_expensive	bool	false	sail extension	—
network_is_constrained	bool	false	sail extension	—
wifi_ssid_regex	string or array of string	[]	sail extension	—
wifi_bssid_regex	string or array of string	[]	sail extension	Matched whatever the case.
network_gateway	string or array of string	[]	sail extension	—
network_mcc_mnc	string or array of string	[]	sail extension	Only off Wi-Fi.

outbounds[pass]

Rust: PassOptions · Build: feature = "outbound-pass" · sail extension

Field	Type	Default	Status	Description
tag	string	""	sail extension	Defaults to the type.

outbounds[plugin]

Rust: PluginOutboundOptions · Build: feature = "outbound-select" and feature = "plugin" · sail extension

Field	Type	Default	Status	Description
tag	string	""	sail extension	Defaults to the type.
path	string	required	sail extension	The shared library to load.
args	string	""	sail extension	—

outbounds[redirect]

Rust: RedirectOptions · Build: feature = "outbound-redirect" · sail extension

Field	Type	Default	Status	Description
tag	string	""	sail extension	Defaults to the type.
detour	string	unset	sail extension	The outbound to dial through, in place of a socket of its own.
bind_interface	string	unset	sail extension	The interface to send through, by name. Loopback destinations still go over loopback, where sing-box applies the bind to them as well.
inet4_bind_address	string	unset	sail extension	The local address for IPv4 destinations, loopback ones aside: as bind_interface.
inet6_bind_address	string	unset	sail extension	The local address for IPv6 destinations, loopback ones aside: as bind_interface.
bind_address_no_port	bool	false	sail extension	IP_BIND_ADDRESS_NO_PORT on TCP sockets bound to an address, so that the port is picked at connect: Linux only.
protect_path	string	unset	sail extension	A Unix socket each socket’s descriptor is handed to, with SCM_RIGHTS, before it binds or connects, for the process there to protect it (from its VPN, say); it answers one byte. Besides what the host protects. Unix only.
routing_mark	number	unset	sail extension	SO_MARK, Linux only.
reuse_addr	bool	false	sail extension	SO_REUSEADDR, and SO_REUSEPORT on Unix, on UDP sockets.
netns	any JSON	unset	sail extension	Not implemented yet.
connect_timeout	duration	unset	sail extension	How long a TCP connect to one address may take; 5s when unset.
tcp_fast_open	bool	false	sail extension	TCP Fast Open: the first data written goes with the SYN. Its addresses are then tried one by one, not raced.
tcp_multi_path	any JSON	unset	sail extension	Not implemented yet.
disable_tcp_keep_alive	bool	false	sail extension	No TCP keepalive at all.
tcp_keep_alive	duration	unset	sail extension	How long a TCP connection is idle before keepalive probes it; 5m when unset.
tcp_keep_alive_interval	duration	unset	sail extension	Between keepalive probes; 75s when unset.
udp_fragment	bool	unset	sail extension	Whether UDP datagrams may be fragmented on the way; unset, as the place says, see udp_fragment_default.
domain_resolver	object → object	unset	sail extension	The DNS server that resolves the names dialled.
skip_default_domain_resolver	bool	false	sail extension	A sail extension: without a domain_resolver of its own, the names dialled resolve as the DNS rules say, not as route.default_domain_resolver does; as Mihomo’s DIRECT resolves apart from the proxies’ servers.
tcp_concurrent	bool	false	sail extension	A sail extension, Mihomo’s tcp-concurrent: a name’s addresses are all connected to at once and the first to connect is taken, rather than one family’s one by one, the other’s raced against them after fallback_delay (Happy Eyeballs). With network_strategy, each address is still raced over the interfaces, so as many sockets open at once as there are addresses times interfaces.
domain_strategy	string, one of prefer_ipv4, prefer_ipv6, ipv4_only, ipv6_only	unset	sail extension	sing-box’s deprecated field for the families names resolve to, which a resolver’s own strategy goes before.
network_strategy	string, one of default, hybrid, fallback	unset	sail extension	Which of the host’s interfaces a connection goes out of, and how they race; default where only types are given. Only where the host lists its interfaces (NetworkState::interfaces).
network_type	string, one of wifi, cellular, ethernet, other or array of string, one of wifi, cellular, ethernet, other	[]	sail extension	The types of interface the strategy goes out of first.
fallback_network_type	string, one of wifi, cellular, ethernet, other or array of string, one of wifi, cellular, ethernet, other	[]	sail extension	The types it falls back to, with fallback.
fallback_delay	duration	unset	sail extension	How long the addresses of one family are tried before those of the other are raced against them (Happy Eyeballs), and the first interfaces before the fallback ones; 300ms when unset.
detour	string	unset	sail extension	The outbound to dial through, in place of a socket of its own.
bind_interface	string	unset	sail extension	The interface to send through, by name. Loopback destinations still go over loopback, where sing-box applies the bind to them as well.
inet4_bind_address	string	unset	sail extension	The local address for IPv4 destinations, loopback ones aside: as bind_interface.
inet6_bind_address	string	unset	sail extension	The local address for IPv6 destinations, loopback ones aside: as bind_interface.
bind_address_no_port	bool	false	sail extension	IP_BIND_ADDRESS_NO_PORT on TCP sockets bound to an address, so that the port is picked at connect: Linux only.
protect_path	string	unset	sail extension	A Unix socket each socket’s descriptor is handed to, with SCM_RIGHTS, before it binds or connects, for the process there to protect it (from its VPN, say); it answers one byte. Besides what the host protects. Unix only.
routing_mark	number	unset	sail extension	SO_MARK, Linux only.
reuse_addr	bool	false	sail extension	SO_REUSEADDR, and SO_REUSEPORT on Unix, on UDP sockets.
netns	any JSON	unset	sail extension	Not implemented yet.
connect_timeout	duration	unset	sail extension	How long a TCP connect to one address may take; 5s when unset.
tcp_fast_open	bool	false	sail extension	TCP Fast Open: the first data written goes with the SYN. Its addresses are then tried one by one, not raced.
tcp_multi_path	any JSON	unset	sail extension	Not implemented yet.
disable_tcp_keep_alive	bool	false	sail extension	No TCP keepalive at all.
tcp_keep_alive	duration	unset	sail extension	How long a TCP connection is idle before keepalive probes it; 5m when unset.
tcp_keep_alive_interval	duration	unset	sail extension	Between keepalive probes; 75s when unset.
udp_fragment	bool	unset	sail extension	Whether UDP datagrams may be fragmented on the way; unset, as the place says, see udp_fragment_default.
domain_resolver	object → object	unset	sail extension	The DNS server that resolves the names dialled.
skip_default_domain_resolver	bool	false	sail extension	A sail extension: without a domain_resolver of its own, the names dialled resolve as the DNS rules say, not as route.default_domain_resolver does; as Mihomo’s DIRECT resolves apart from the proxies’ servers.
tcp_concurrent	bool	false	sail extension	A sail extension, Mihomo’s tcp-concurrent: a name’s addresses are all connected to at once and the first to connect is taken, rather than one family’s one by one, the other’s raced against them after fallback_delay (Happy Eyeballs). With network_strategy, each address is still raced over the interfaces, so as many sockets open at once as there are addresses times interfaces.
domain_strategy	string, one of prefer_ipv4, prefer_ipv6, ipv4_only, ipv6_only	unset	sail extension	sing-box’s deprecated field for the families names resolve to, which a resolver’s own strategy goes before.
network_strategy	string, one of default, hybrid, fallback	unset	sail extension	Which of the host’s interfaces a connection goes out of, and how they race; default where only types are given. Only where the host lists its interfaces (NetworkState::interfaces).
network_type	string, one of wifi, cellular, ethernet, other or array of string, one of wifi, cellular, ethernet, other	[]	sail extension	The types of interface the strategy goes out of first.
fallback_network_type	string, one of wifi, cellular, ethernet, other or array of string, one of wifi, cellular, ethernet, other	[]	sail extension	The types it falls back to, with fallback.
fallback_delay	duration	unset	sail extension	How long the addresses of one family are tried before those of the other are raced against them (Happy Eyeballs), and the first interfaces before the fallback ones; 300ms when unset.
server	string	required	sail extension	—
server_port	number	required	sail extension	—

outbounds[redirect].domain_resolver

Rust: DomainResolver · sail extension

Field	Type	Default	Status	Description
server	string	required	sail extension	—
strategy	string, one of prefer_ipv4, prefer_ipv6, ipv4_only, ipv6_only	unset	sail extension	—
timeout	duration	unset	sail extension	—
disable_cache	bool	false	sail extension	—
disable_optimistic_cache	bool	false	sail extension	—
rewrite_ttl	number	unset	sail extension	—
client_subnet	object → object	unset	sail extension	—

outbounds[selector]

Rust: SelectorOutboundOptions · Build: feature = "outbound-select"

Field	Type	Default	Status	Description
tag	string	""	Supported	Defaults to the type.
outbounds	array	[]	Supported	Its members; none may be when its providers give others.
default	string	unset	Supported	Selected when nothing was selected before, or what was is no longer a member; defaults to the first. It may be a member a provider gives, the first so named.
interrupt_exist_connections	bool	false	Supported	Ends the connections through the member selected before once another is selected, rather than leaving them on it.
providers	string or array of string	[]	sail extension	The outbound providers, by tag, whose outbounds join the group’s own, in this order.
filter	string or array of string	[]	sail extension	Regular expressions, as Mihomo’s filter: of the providers’ outbounds, only those whose names match one are members, those of the first first. The group’s own outbounds are not filtered.
exclude_filter	string or array of string	[]	sail extension	Regular expressions no member’s name may match, the group’s own outbounds’ too.
exclude_type	string or array of string	[]	sail extension	The types no member may be of, the group’s own outbounds too, in Mihomo’s names for them, without case: Shadowsocks, Vmess, Socks5, Direct, …
empty_fallback	string	unset	sail extension	An outbound, not a group, that is the member while there is none else. Without it such a group has none, and its connections fail.
disable_udp	—	—	sail extension	The group carries TCP alone, whatever member it picks (Mihomo’s disable-udp)

outbounds[shadowsocks]

Rust: ShadowsocksOutboundOptions · Build: feature = "outbound-shadowsocks"

Field	Type	Default	Status	Description
tag	string	""	Supported	Defaults to the type.
detour	string	unset	Supported	The outbound to dial through, in place of a socket of its own.
bind_interface	string	unset	Supported	The interface to send through, by name. Loopback destinations still go over loopback, where sing-box applies the bind to them as well.
inet4_bind_address	string	unset	Supported	The local address for IPv4 destinations, loopback ones aside: as bind_interface.
inet6_bind_address	string	unset	Supported	The local address for IPv6 destinations, loopback ones aside: as bind_interface.
bind_address_no_port	bool	false	Supported	IP_BIND_ADDRESS_NO_PORT on TCP sockets bound to an address, so that the port is picked at connect: Linux only.
protect_path	string	unset	Supported	A Unix socket each socket’s descriptor is handed to, with SCM_RIGHTS, before it binds or connects, for the process there to protect it (from its VPN, say); it answers one byte. Besides what the host protects. Unix only.
routing_mark	number|string	unset	Supported	SO_MARK, Linux only.
reuse_addr	bool	false	Supported	SO_REUSEADDR, and SO_REUSEPORT on Unix, on UDP sockets.
netns	string	—	Error: Linux network namespaces: sockets would leave another way	Not implemented yet.
connect_timeout	duration	unset	Supported	How long a TCP connect to one address may take; 5s when unset.
tcp_fast_open	bool	false	Supported	TCP Fast Open: the first data written goes with the SYN. Its addresses are then tried one by one, not raced.
tcp_multi_path	bool	—	Warned: Socket tuning: connections go the same way without it	Not implemented yet.
disable_tcp_keep_alive	bool	false	Supported	No TCP keepalive at all.
tcp_keep_alive	duration	unset	Supported	How long a TCP connection is idle before keepalive probes it; 5m when unset.
tcp_keep_alive_interval	duration	unset	Supported	Between keepalive probes; 75s when unset.
udp_fragment	bool	unset	Supported	Whether UDP datagrams may be fragmented on the way; unset, as the place says, see udp_fragment_default.
domain_resolver	string|object → object	unset	Supported	The DNS server that resolves the names dialled.
network_strategy	string, one of default, fallback, hybrid	unset	Supported	Which of the host’s interfaces a connection goes out of, and how they race; default where only types are given. Only where the host lists its interfaces (NetworkState::interfaces).
network_type	listable-string, one of cellular, ethernet, other, wifi	[]	Supported	The types of interface the strategy goes out of first.
fallback_network_type	listable-string, one of cellular, ethernet, other, wifi	[]	Supported	The types it falls back to, with fallback.
fallback_delay	duration	unset	Supported	How long the addresses of one family are tried before those of the other are raced against them (Happy Eyeballs), and the first interfaces before the fallback ones; 300ms when unset.
server	string	unset	Supported	May be left out, with server_port, by an outbound with a detour: one over ShadowTLS, which dials its own server.
server_port	number	unset	Supported	—
method	string, one of none, aes-128-gcm, aes-192-gcm, aes-256-gcm, chacha20-ietf-poly1305, xchacha20-ietf-poly1305, 2022-blake3-aes-128-gcm, 2022-blake3-aes-256-gcm, 2022-blake3-chacha20-poly1305, aes-128-ctr, aes-192-ctr, aes-256-ctr, aes-128-cfb, aes-192-cfb, aes-256-cfb, rc4-md5, chacha20-ietf, xchacha20	required	Supported	—
password	string	required	Supported	With a 2022 method, the base64 PSK, or iPSK:uPSK for a server with users.
plugin	string	unset	Supported	Only obfs-local (simple-obfs) is supported.
plugin_opts	string	unset	Supported	obfs=http|tls;obfs-host=<host>;obfs-uri=<path>, as simple-obfs takes them.
network	listable-string, one of tcp, udp	—	Supported	—
udp_over_tcp	bool|object → object	unset	Supported	UDP over its TCP, to sp.v2.udp-over-tcp.arpa (version 2, the default) or sp.udp-over-tcp.arpa (version 1), instead of its own UDP.
multiplex	object → object	unset	Supported	—
domain_strategy	string	unset	Supported (deprecated in sing-box)	sing-box’s deprecated field for the families names resolve to, which a resolver’s own strategy goes before.
skip_default_domain_resolver	bool	false	sail extension	A sail extension: without a domain_resolver of its own, the names dialled resolve as the DNS rules say, not as route.default_domain_resolver does; as Mihomo’s DIRECT resolves apart from the proxies’ servers.
tcp_concurrent	bool	false	sail extension	A sail extension, Mihomo’s tcp-concurrent: a name’s addresses are all connected to at once and the first to connect is taken, rather than one family’s one by one, the other’s raced against them after fallback_delay (Happy Eyeballs). With network_strategy, each address is still raced over the interfaces, so as many sockets open at once as there are addresses times interfaces.
prefix	string	unset	sail extension	Bytes sent before the first payload, percent-encoded.

outbounds[shadowtls]

Rust: ShadowTlsOutboundOptions · Build: feature = "outbound-shadowtls"

Field	Type	Default	Status	Description
tag	string	""	Supported	Defaults to the type.
detour	string	unset	Supported	The outbound to dial through, in place of a socket of its own.
bind_interface	string	unset	Supported	The interface to send through, by name. Loopback destinations still go over loopback, where sing-box applies the bind to them as well.
inet4_bind_address	string	unset	Supported	The local address for IPv4 destinations, loopback ones aside: as bind_interface.
inet6_bind_address	string	unset	Supported	The local address for IPv6 destinations, loopback ones aside: as bind_interface.
bind_address_no_port	bool	false	Supported	IP_BIND_ADDRESS_NO_PORT on TCP sockets bound to an address, so that the port is picked at connect: Linux only.
protect_path	string	unset	Supported	A Unix socket each socket’s descriptor is handed to, with SCM_RIGHTS, before it binds or connects, for the process there to protect it (from its VPN, say); it answers one byte. Besides what the host protects. Unix only.
routing_mark	number|string	unset	Supported	SO_MARK, Linux only.
reuse_addr	bool	false	Supported	SO_REUSEADDR, and SO_REUSEPORT on Unix, on UDP sockets.
netns	string	—	Error: Linux network namespaces: sockets would leave another way	Not implemented yet.
connect_timeout	duration	unset	Supported	How long a TCP connect to one address may take; 5s when unset.
tcp_fast_open	bool	false	Supported	TCP Fast Open: the first data written goes with the SYN. Its addresses are then tried one by one, not raced.
tcp_multi_path	bool	—	Warned: Socket tuning: connections go the same way without it	Not implemented yet.
disable_tcp_keep_alive	bool	false	Supported	No TCP keepalive at all.
tcp_keep_alive	duration	unset	Supported	How long a TCP connection is idle before keepalive probes it; 5m when unset.
tcp_keep_alive_interval	duration	unset	Supported	Between keepalive probes; 75s when unset.
udp_fragment	bool	unset	Supported	Whether UDP datagrams may be fragmented on the way; unset, as the place says, see udp_fragment_default.
domain_resolver	string|object → object	unset	Supported	The DNS server that resolves the names dialled.
network_strategy	string, one of default, fallback, hybrid	unset	Supported	Which of the host’s interfaces a connection goes out of, and how they race; default where only types are given. Only where the host lists its interfaces (NetworkState::interfaces).
network_type	listable-string, one of cellular, ethernet, other, wifi	[]	Supported	The types of interface the strategy goes out of first.
fallback_network_type	listable-string, one of cellular, ethernet, other, wifi	[]	Supported	The types it falls back to, with fallback.
fallback_delay	duration	unset	Supported	How long the addresses of one family are tried before those of the other are raced against them (Happy Eyeballs), and the first interfaces before the fallback ones; 300ms when unset.
server	string	required	Supported	—
server_port	number	required	Supported	—
version	number, one of 1, 2, 3	1	Supported	Must be 3: versions 1 and 2 are not supported. sing-box’s default is 1.
password	string	""	Supported	Cannot be empty.
tls	object → object	unset	Supported	Must be enabled: the handshake with the site the server imitates, server_name being the site’s (the server’s address when unset). A browser fingerprint, disable_sni and a client certificate apply as for TLS; REALITY and ECH do not.
domain_strategy	string	unset	Supported (deprecated in sing-box)	sing-box’s deprecated field for the families names resolve to, which a resolver’s own strategy goes before.
skip_default_domain_resolver	bool	false	sail extension	A sail extension: without a domain_resolver of its own, the names dialled resolve as the DNS rules say, not as route.default_domain_resolver does; as Mihomo’s DIRECT resolves apart from the proxies’ servers.
tcp_concurrent	bool	false	sail extension	A sail extension, Mihomo’s tcp-concurrent: a name’s addresses are all connected to at once and the first to connect is taken, rather than one family’s one by one, the other’s raced against them after fallback_delay (Happy Eyeballs). With network_strategy, each address is still raced over the interfaces, so as many sockets open at once as there are addresses times interfaces.

outbounds[smart]

Rust: SmartOutboundOptions · Build: feature = "outbound-smart" · sail extension

Field	Type	Default	Status	Description
tag	string	""	sail extension	Defaults to the type.
outbounds	array of string	[]	sail extension	Its members; none may be when its providers give others.
providers	string or array of string	[]	sail extension	The outbound providers, by tag, whose outbounds join the group’s own, in this order.
filter	string or array of string	[]	sail extension	Regular expressions, as Mihomo’s filter: of the providers’ outbounds, only those whose names match one are members, those of the first first. The group’s own outbounds are not filtered.
exclude_filter	string or array of string	[]	sail extension	Regular expressions no member’s name may match, the group’s own outbounds’ too.
exclude_type	string or array of string	[]	sail extension	The types no member may be of, the group’s own outbounds too, in Mihomo’s names for them, without case: Shadowsocks, Vmess, Socks5, Direct, …
empty_fallback	string	unset	sail extension	An outbound, not a group, that is the member while there is none else. Without it such a group has none, and its connections fail.
url	string	default_url()	sail extension	What is requested through each member to probe it.
interval	duration	unset	sail extension	How often members nothing told of lately are probed; 5 minutes.
timeout	duration	unset	sail extension	How long a probe, or a connection attempt that has a member left to try, may take before its member counts as failed; 5 seconds.
idle_timeout	duration	unset	sail extension	Probes pause once the group has not been used for this long; 30 minutes.
unified_delay	bool	false	sail extension	The latency of a second request on the connection the first opened, without the connect and handshakes, as Mihomo’s unified-delay; a sail extension.
tolerance	number	30	sail extension	Milliseconds: a member whose score is within this of the best may be picked.
tolerance_ratio	number	0.2	sail extension	A member whose score is within this fraction of the best may be picked too, whichever of the two is the wider.
policy_priority	array of object → []	[]	sail extension	Factors of the scores of the members whose names match a regular expression, the first that matches: below 1 prefers them, above 1 avoids them. 1 for the others.
site_ttl	duration	unset	sail extension	How long a site is kept on its member after its last connection; an hour.
site_capacity	number	4096	sail extension	How many sites are kept at most; the least recently used goes first.
prefer_asn	bool	false	sail extension	Destinations known by address alone are sites by their autonomous system, but those of CDNs, rather than by their network. Needs an ASN database: asn.mmdb in the asset directory, or asn_file.
asn_file	string	unset	sail extension	The ASN database, for prefer_asn; relative to the asset directory.
evaluate_before_use	bool	false	sail extension	The first connection waits for the first probes, timeout at most, rather than going through a member not measured yet.
interrupt_exist_connections	bool	false	sail extension	Ends the connections through a member once it leaves the group.
disable_udp	—	—	sail extension	The group carries TCP alone, whatever member it picks (Mihomo’s disable-udp)

outbounds[smart].policy_priority[]

Rust: PolicyPriority · Build: feature = "outbound-smart" · sail extension

Field	Type	Default	Status	Description
regex	string	required	sail extension	Matched against the member’s name, as Mihomo’s filters are: lookarounds included, backtracking bounded.
factor	number	required	sail extension	Multiplies the member’s score: above 0.

outbounds[socks]

Rust: SocksOutboundOptions · Build: feature = "outbound-socks"

Field	Type	Default	Status	Description
tag	string	""	Supported	Defaults to the type.
detour	string	unset	Supported	The outbound to dial through, in place of a socket of its own.
bind_interface	string	unset	Supported	The interface to send through, by name. Loopback destinations still go over loopback, where sing-box applies the bind to them as well.
inet4_bind_address	string	unset	Supported	The local address for IPv4 destinations, loopback ones aside: as bind_interface.
inet6_bind_address	string	unset	Supported	The local address for IPv6 destinations, loopback ones aside: as bind_interface.
bind_address_no_port	bool	false	Supported	IP_BIND_ADDRESS_NO_PORT on TCP sockets bound to an address, so that the port is picked at connect: Linux only.
protect_path	string	unset	Supported	A Unix socket each socket’s descriptor is handed to, with SCM_RIGHTS, before it binds or connects, for the process there to protect it (from its VPN, say); it answers one byte. Besides what the host protects. Unix only.
routing_mark	number|string	unset	Supported	SO_MARK, Linux only.
reuse_addr	bool	false	Supported	SO_REUSEADDR, and SO_REUSEPORT on Unix, on UDP sockets.
netns	string	—	Error: Linux network namespaces: sockets would leave another way	Not implemented yet.
connect_timeout	duration	unset	Supported	How long a TCP connect to one address may take; 5s when unset.
tcp_fast_open	bool	false	Supported	TCP Fast Open: the first data written goes with the SYN. Its addresses are then tried one by one, not raced.
tcp_multi_path	bool	—	Warned: Socket tuning: connections go the same way without it	Not implemented yet.
disable_tcp_keep_alive	bool	false	Supported	No TCP keepalive at all.
tcp_keep_alive	duration	unset	Supported	How long a TCP connection is idle before keepalive probes it; 5m when unset.
tcp_keep_alive_interval	duration	unset	Supported	Between keepalive probes; 75s when unset.
udp_fragment	bool	unset	Supported	Whether UDP datagrams may be fragmented on the way; unset, as the place says, see udp_fragment_default.
domain_resolver	string|object → object	unset	Supported	The DNS server that resolves the names dialled.
network_strategy	string, one of default, fallback, hybrid	unset	Supported	Which of the host’s interfaces a connection goes out of, and how they race; default where only types are given. Only where the host lists its interfaces (NetworkState::interfaces).
network_type	listable-string, one of cellular, ethernet, other, wifi	[]	Supported	The types of interface the strategy goes out of first.
fallback_network_type	listable-string, one of cellular, ethernet, other, wifi	[]	Supported	The types it falls back to, with fallback.
fallback_delay	duration	unset	Supported	How long the addresses of one family are tried before those of the other are raced against them (Happy Eyeballs), and the first interfaces before the fallback ones; 300ms when unset.
server	string	unset	Supported	May be left out, with server_port, by an outbound with a detour: one over ShadowTLS, which dials its own server.
server_port	number	unset	Supported	—
version	string, one of 4, 4a, 5	unset	Supported	5, the default, which is all sail speaks. sing-box also takes 4 and 4a (option/simple.go:25), which are errors here.
username	string	""	Supported	—
password	string	""	Supported	—
network	listable-string, one of tcp, udp	—	Supported	—
udp_over_tcp	bool|object → object	unset	Supported	UDP over its TCP, to sp.v2.udp-over-tcp.arpa (version 2, the default) or sp.udp-over-tcp.arpa (version 1), instead of UDP ASSOCIATE.
domain_strategy	string	unset	Supported (deprecated in sing-box)	sing-box’s deprecated field for the families names resolve to, which a resolver’s own strategy goes before.
skip_default_domain_resolver	bool	false	sail extension	A sail extension: without a domain_resolver of its own, the names dialled resolve as the DNS rules say, not as route.default_domain_resolver does; as Mihomo’s DIRECT resolves apart from the proxies’ servers.
tcp_concurrent	bool	false	sail extension	A sail extension, Mihomo’s tcp-concurrent: a name’s addresses are all connected to at once and the first to connect is taken, rather than one family’s one by one, the other’s raced against them after fallback_delay (Happy Eyeballs). With network_strategy, each address is still raced over the interfaces, so as many sockets open at once as there are addresses times interfaces.

outbounds[trojan]

Rust: TrojanOutboundOptions · Build: feature = "outbound-trojan"

Field	Type	Default	Status	Description
tag	string	""	Supported	Defaults to the type.
detour	string	unset	Supported	The outbound to dial through, in place of a socket of its own.
bind_interface	string	unset	Supported	The interface to send through, by name. Loopback destinations still go over loopback, where sing-box applies the bind to them as well.
inet4_bind_address	string	unset	Supported	The local address for IPv4 destinations, loopback ones aside: as bind_interface.
inet6_bind_address	string	unset	Supported	The local address for IPv6 destinations, loopback ones aside: as bind_interface.
bind_address_no_port	bool	false	Supported	IP_BIND_ADDRESS_NO_PORT on TCP sockets bound to an address, so that the port is picked at connect: Linux only.
protect_path	string	unset	Supported	A Unix socket each socket’s descriptor is handed to, with SCM_RIGHTS, before it binds or connects, for the process there to protect it (from its VPN, say); it answers one byte. Besides what the host protects. Unix only.
routing_mark	number|string	unset	Supported	SO_MARK, Linux only.
reuse_addr	bool	false	Supported	SO_REUSEADDR, and SO_REUSEPORT on Unix, on UDP sockets.
netns	string	—	Error: Linux network namespaces: sockets would leave another way	Not implemented yet.
connect_timeout	duration	unset	Supported	How long a TCP connect to one address may take; 5s when unset.
tcp_fast_open	bool	false	Supported	TCP Fast Open: the first data written goes with the SYN. Its addresses are then tried one by one, not raced.
tcp_multi_path	bool	—	Warned: Socket tuning: connections go the same way without it	Not implemented yet.
disable_tcp_keep_alive	bool	false	Supported	No TCP keepalive at all.
tcp_keep_alive	duration	unset	Supported	How long a TCP connection is idle before keepalive probes it; 5m when unset.
tcp_keep_alive_interval	duration	unset	Supported	Between keepalive probes; 75s when unset.
udp_fragment	bool	unset	Supported	Whether UDP datagrams may be fragmented on the way; unset, as the place says, see udp_fragment_default.
domain_resolver	string|object → object	unset	Supported	The DNS server that resolves the names dialled.
network_strategy	string, one of default, fallback, hybrid	unset	Supported	Which of the host’s interfaces a connection goes out of, and how they race; default where only types are given. Only where the host lists its interfaces (NetworkState::interfaces).
network_type	listable-string, one of cellular, ethernet, other, wifi	[]	Supported	The types of interface the strategy goes out of first.
fallback_network_type	listable-string, one of cellular, ethernet, other, wifi	[]	Supported	The types it falls back to, with fallback.
fallback_delay	duration	unset	Supported	How long the addresses of one family are tried before those of the other are raced against them (Happy Eyeballs), and the first interfaces before the fallback ones; 300ms when unset.
server	string	unset	Supported	May be left out, with server_port, by an outbound with a detour: one over ShadowTLS, which dials its own server.
server_port	number	unset	Supported	—
password	string	required	Supported	—
network	listable-string, one of tcp, udp	—	Supported	—
tls	object → object	unset	Supported	—
multiplex	object → object	unset	Supported	—
transport	object → object, [grpc], [http], [httpupgrade], [ws]	unset	Supported	—
domain_strategy	string	unset	Supported (deprecated in sing-box)	sing-box’s deprecated field for the families names resolve to, which a resolver’s own strategy goes before.
skip_default_domain_resolver	bool	false	sail extension	A sail extension: without a domain_resolver of its own, the names dialled resolve as the DNS rules say, not as route.default_domain_resolver does; as Mihomo’s DIRECT resolves apart from the proxies’ servers.
tcp_concurrent	bool	false	sail extension	A sail extension, Mihomo’s tcp-concurrent: a name’s addresses are all connected to at once and the first to connect is taken, rather than one family’s one by one, the other’s raced against them after fallback_delay (Happy Eyeballs). With network_strategy, each address is still raced over the interfaces, so as many sockets open at once as there are addresses times interfaces.

outbounds[tryall]

Rust: TryAllOutboundOptions · Build: feature = "outbound-tryall" · sail extension

Field	Type	Default	Status	Description
tag	string	""	sail extension	Defaults to the type.
outbounds	array of string	required	sail extension	A group trying its members at once
delay_base	number	0	sail extension	Milliseconds to wait before trying each next outbound.

outbounds[tuic]

Rust: TuicOutboundOptions · Build: feature = "outbound-tuic"

Field	Type	Default	Status	Description
tag	string	""	Supported	Defaults to the type.
detour	string	unset	Supported	The outbound to dial through, in place of a socket of its own.
bind_interface	string	unset	Supported	The interface to send through, by name. Loopback destinations still go over loopback, where sing-box applies the bind to them as well.
inet4_bind_address	string	unset	Supported	The local address for IPv4 destinations, loopback ones aside: as bind_interface.
inet6_bind_address	string	unset	Supported	The local address for IPv6 destinations, loopback ones aside: as bind_interface.
bind_address_no_port	bool	false	Supported	IP_BIND_ADDRESS_NO_PORT on TCP sockets bound to an address, so that the port is picked at connect: Linux only.
protect_path	string	unset	Supported	A Unix socket each socket’s descriptor is handed to, with SCM_RIGHTS, before it binds or connects, for the process there to protect it (from its VPN, say); it answers one byte. Besides what the host protects. Unix only.
routing_mark	number|string	unset	Supported	SO_MARK, Linux only.
reuse_addr	bool	false	Supported	SO_REUSEADDR, and SO_REUSEPORT on Unix, on UDP sockets.
netns	string	—	Error: Linux network namespaces: sockets would leave another way	Not implemented yet.
connect_timeout	duration	unset	Supported	How long a TCP connect to one address may take; 5s when unset.
tcp_fast_open	bool	false	Supported	TCP Fast Open: the first data written goes with the SYN. Its addresses are then tried one by one, not raced.
tcp_multi_path	bool	—	Warned: Socket tuning: connections go the same way without it	Not implemented yet.
disable_tcp_keep_alive	bool	false	Supported	No TCP keepalive at all.
tcp_keep_alive	duration	unset	Supported	How long a TCP connection is idle before keepalive probes it; 5m when unset.
tcp_keep_alive_interval	duration	unset	Supported	Between keepalive probes; 75s when unset.
udp_fragment	bool	unset	Supported	Whether UDP datagrams may be fragmented on the way; unset, as the place says, see udp_fragment_default.
domain_resolver	string|object → object	unset	Supported	The DNS server that resolves the names dialled.
network_strategy	string, one of default, fallback, hybrid	unset	Supported	Which of the host’s interfaces a connection goes out of, and how they race; default where only types are given. Only where the host lists its interfaces (NetworkState::interfaces).
network_type	listable-string, one of cellular, ethernet, other, wifi	[]	Supported	The types of interface the strategy goes out of first.
fallback_network_type	listable-string, one of cellular, ethernet, other, wifi	[]	Supported	The types it falls back to, with fallback.
fallback_delay	duration	unset	Supported	How long the addresses of one family are tried before those of the other are raced against them (Happy Eyeballs), and the first interfaces before the fallback ones; 300ms when unset.
server	string	required	Supported	—
server_port	number	required	Supported	—
uuid	string	required	Supported	—
password	string	""	Supported	—
congestion_control	string, one of cubic, new_reno, bbr	cubic	Supported	—
udp_relay_mode	string, one of native, quic	unset	Supported	—
udp_over_stream	bool	false	Supported	UDP over TCP (v2), as sing-box has it: each UDP session a Connect stream to sp.v2.udp-over-tcp.arpa, instead of TUIC’s own relay.
zero_rtt_handshake	bool	false	Supported	—
heartbeat	duration	unset	Supported	—
network	listable-string, one of tcp, udp	unset	Supported	tcp or udp; both when not set.
tls	object → object	required	Supported	—
idle_timeout	duration	—	Warned: QUIC tuning: the same connection without it	—
keep_alive_period	duration	—	Warned: QUIC tuning: the same connection without it	—
stream_receive_window	number|string	—	Warned: QUIC tuning: the same connection without it	—
connection_receive_window	number|string	—	Warned: QUIC tuning: the same connection without it	—
max_concurrent_streams	number	—	Warned: QUIC tuning: the same connection without it	—
initial_packet_size	number	—	Warned: QUIC tuning: the same connection without it	—
disable_path_mtu_discovery	bool	—	Warned: QUIC tuning: the same connection without it	—
domain_strategy	string	unset	Supported (deprecated in sing-box)	sing-box’s deprecated field for the families names resolve to, which a resolver’s own strategy goes before.
skip_default_domain_resolver	bool	false	sail extension	A sail extension: without a domain_resolver of its own, the names dialled resolve as the DNS rules say, not as route.default_domain_resolver does; as Mihomo’s DIRECT resolves apart from the proxies’ servers.

outbounds[tuic].tls

Rust: OutboundTls

Field	Type	Default	Status	Description
enabled	bool	false	Supported	—
engine	string, one of go, apple, windows	—	Warned: The TLS stack: sail has one	—
disable_sni	bool	false	Supported	Sends no SNI. The certificate is still verified against server_name, unless insecure.
server_name	string	unset	Supported	Defaults to the server’s address.
insecure	bool	false	Supported	—
alpn	listable-string	unset	Supported	—
min_version	string, one of 1.0, 1.1, 1.2, 1.3	unset	Supported	The lowest TLS version to negotiate, 1.0 to 1.3; unset, 1.2.
max_version	string, one of 1.0, 1.1, 1.2, 1.3	unset	Supported	The highest; unset, 1.3.
cipher_suites	listable-string	—	Error: TLS cipher suites and key exchanges: sail’s TLS would negotiate others than asked	—
curve_preferences	listable-string, one of P256, P384, P521, X25519, X25519MLKEM768	—	Error: TLS cipher suites and key exchanges: sail’s TLS would negotiate others than asked	—
certificate	listable-string	unset	Supported	An inline PEM certificate to trust.
certificate_path	string	unset	Supported	A PEM certificate to trust, by path.
certificate_public_key_sha256	listable-string|array	unset	Supported	The SHA-256 hashes, base64, of the public keys to take a server’s certificate by, in place of the certificates trusted, the name and insecure.
client_certificate	listable-string	unset	Supported	An inline PEM certificate, its chain after it, presented when the server asks for one; with client_key.
client_certificate_path	string	unset	Supported	client_certificate, by path.
client_key	listable-string	unset	Supported	The inline PEM key of the client certificate.
client_key_path	string	unset	Supported	client_key, by path.
fragment	bool	—	Error: Fragmenting or spoofing the TLS handshake against censorship	—
fragment_fallback_delay	duration	—	Error: Fragmenting or spoofing the TLS handshake against censorship	—
record_fragment	bool	—	Error: Fragmenting or spoofing the TLS handshake against censorship	—
spoof	string	—	Error: Fragmenting or spoofing the TLS handshake against censorship	—
spoof_method	string, one of wrong-sequence, wrong-checksum, wrong-ack, wrong-md5, wrong-timestamp	—	Error: Fragmenting or spoofing the TLS handshake against censorship	—
kernel_tx	bool	—	Warned: The TLS stack, kernel TLS and the handshake’s timeout: the same TLS without them	—
kernel_rx	bool	—	Warned: The TLS stack, kernel TLS and the handshake’s timeout: the same TLS without them	—
handshake_timeout	duration	—	Warned: The TLS stack, kernel TLS and the handshake’s timeout: the same TLS without them	—
ech	object → object	unset	Supported	—
utls	object → object	—	Error: Not supported with TUIC	The browser the ClientHello imitates. Unset, it is Chrome’s.
reality	object → object	unset	Supported	—
certificate_sha256	string or array of string	unset	sail extension	sing-box 1.15’s, with Mihomo’s fingerprint semantics beyond it: the SHA-256 hashes, hex or base64, of whole certificates (DER) to take a server by, in place of the certificates trusted and insecure. A hash of the server’s own certificate takes it outright: no CA and no name are checked, so that exact certificate is trusted for any server name. A hash of a certificate sent after it, an intermediate or a root, is the only CA the server’s certificate is verified by, with the server name. With certificate_public_key_sha256, either passing is enough.

outbounds[tuic].tls.utls

Rust: OutboundUtls

Field	Type	Default	Status	Description
enabled	bool	true	Supported	—
fingerprint	string, one of chrome_psk, chrome_psk_shuffle, chrome_padding_psk_shuffle, chrome_pq, chrome_pq_psk, chrome, firefox, edge, safari, 360, qq, ios, android, random, randomized	—	Error: Not supported with TUIC	—

outbounds[urltest]

Rust: UrlTestOutboundOptions · Build: feature = "outbound-urltest"

Field	Type	Default	Status	Description
tag	string	""	Supported	Defaults to the type.
outbounds	array	[]	Supported	Its members; none may be when its providers give others.
url	string	default_url()	Supported	What is requested through each member; sing-box’s default.
interval	duration	unset	Supported	—
tolerance	number	50	Supported	Milliseconds.
idle_timeout	duration	unset	Supported	Tests pause once the group has not been used for this long; 30m, sing-box’s. A Clash url-test group, lazy, has it equal to its interval, as Mihomo’s.
interrupt_exist_connections	bool	false	Supported	Ends the connections through the member left once the group switches.
providers	string or array of string	[]	sail extension	The outbound providers, by tag, whose outbounds join the group’s own, in this order.
filter	string or array of string	[]	sail extension	Regular expressions, as Mihomo’s filter: of the providers’ outbounds, only those whose names match one are members, those of the first first. The group’s own outbounds are not filtered.
exclude_filter	string or array of string	[]	sail extension	Regular expressions no member’s name may match, the group’s own outbounds’ too.
exclude_type	string or array of string	[]	sail extension	The types no member may be of, the group’s own outbounds too, in Mihomo’s names for them, without case: Shadowsocks, Vmess, Socks5, Direct, …
empty_fallback	string	unset	sail extension	An outbound, not a group, that is the member while there is none else. Without it such a group has none, and its connections fail.
timeout	duration	unset	sail extension	How long a test may take before its member counts as failed; 5s. Also how close together max_failed_times failures must come; Mihomo’s timeout.
max_failed_times	number	unset	sail extension	How many failed connections, within timeout of the first, have the members tested again; 5, as Mihomo’s max-failed-times. One whose member’s server cannot be reached has them tested at once.
expected_status	string	unset	sail extension	The HTTP statuses a test must be answered with to pass, as Mihomo’s expected-status: codes and ranges, 200/204/401-429; any when unset.
lazy	bool	true	sail extension	false: tests never pause, used or not, as Mihomo’s lazy: false; idle_timeout is then a mistake.
unified_delay	bool	false	sail extension	The latency of a second request on the connection the first opened, without the connect and handshakes, as Mihomo’s unified-delay; a sail extension.
disable_udp	—	—	sail extension	The group carries TCP alone, whatever member it picks (Mihomo’s disable-udp)

outbounds[vless]

Rust: VlessOutboundOptions · Build: feature = "outbound-vless"

Field	Type	Default	Status	Description
tag	string	""	Supported	Defaults to the type.
detour	string	unset	Supported	The outbound to dial through, in place of a socket of its own.
bind_interface	string	unset	Supported	The interface to send through, by name. Loopback destinations still go over loopback, where sing-box applies the bind to them as well.
inet4_bind_address	string	unset	Supported	The local address for IPv4 destinations, loopback ones aside: as bind_interface.
inet6_bind_address	string	unset	Supported	The local address for IPv6 destinations, loopback ones aside: as bind_interface.
bind_address_no_port	bool	false	Supported	IP_BIND_ADDRESS_NO_PORT on TCP sockets bound to an address, so that the port is picked at connect: Linux only.
protect_path	string	unset	Supported	A Unix socket each socket’s descriptor is handed to, with SCM_RIGHTS, before it binds or connects, for the process there to protect it (from its VPN, say); it answers one byte. Besides what the host protects. Unix only.
routing_mark	number|string	unset	Supported	SO_MARK, Linux only.
reuse_addr	bool	false	Supported	SO_REUSEADDR, and SO_REUSEPORT on Unix, on UDP sockets.
netns	string	—	Error: Linux network namespaces: sockets would leave another way	Not implemented yet.
connect_timeout	duration	unset	Supported	How long a TCP connect to one address may take; 5s when unset.
tcp_fast_open	bool	false	Supported	TCP Fast Open: the first data written goes with the SYN. Its addresses are then tried one by one, not raced.
tcp_multi_path	bool	—	Warned: Socket tuning: connections go the same way without it	Not implemented yet.
disable_tcp_keep_alive	bool	false	Supported	No TCP keepalive at all.
tcp_keep_alive	duration	unset	Supported	How long a TCP connection is idle before keepalive probes it; 5m when unset.
tcp_keep_alive_interval	duration	unset	Supported	Between keepalive probes; 75s when unset.
udp_fragment	bool	unset	Supported	Whether UDP datagrams may be fragmented on the way; unset, as the place says, see udp_fragment_default.
domain_resolver	string|object → object	unset	Supported	The DNS server that resolves the names dialled.
network_strategy	string, one of default, fallback, hybrid	unset	Supported	Which of the host’s interfaces a connection goes out of, and how they race; default where only types are given. Only where the host lists its interfaces (NetworkState::interfaces).
network_type	listable-string, one of cellular, ethernet, other, wifi	[]	Supported	The types of interface the strategy goes out of first.
fallback_network_type	listable-string, one of cellular, ethernet, other, wifi	[]	Supported	The types it falls back to, with fallback.
fallback_delay	duration	unset	Supported	How long the addresses of one family are tried before those of the other are raced against them (Happy Eyeballs), and the first interfaces before the fallback ones; 300ms when unset.
server	string	unset	Supported	May be left out, with server_port, by an outbound with a detour: one over ShadowTLS, which dials its own server.
server_port	number	unset	Supported	—
uuid	string	required	Supported	—
flow	string	""	Supported	"" or xtls-rprx-vision.
network	listable-string, one of tcp, udp	—	Supported	—
tls	object → object	unset	Supported	—
multiplex	object → object	unset	Supported	—
transport	object → object, [grpc], [http], [httpupgrade], [ws]	unset	Supported	—
packet_encoding	string	unset	Supported	How UDP travels: unset means xudp, as in sing-box; "" is VLESS’s own UDP, one destination per connection.
domain_strategy	string	unset	Supported (deprecated in sing-box)	sing-box’s deprecated field for the families names resolve to, which a resolver’s own strategy goes before.
skip_default_domain_resolver	bool	false	sail extension	A sail extension: without a domain_resolver of its own, the names dialled resolve as the DNS rules say, not as route.default_domain_resolver does; as Mihomo’s DIRECT resolves apart from the proxies’ servers.
tcp_concurrent	bool	false	sail extension	A sail extension, Mihomo’s tcp-concurrent: a name’s addresses are all connected to at once and the first to connect is taken, rather than one family’s one by one, the other’s raced against them after fallback_delay (Happy Eyeballs). With network_strategy, each address is still raced over the interfaces, so as many sockets open at once as there are addresses times interfaces.

outbounds[vmess]

Rust: VMessOutboundOptions · Build: feature = "outbound-vmess"

Field	Type	Default	Status	Description
tag	string	""	Supported	Defaults to the type.
detour	string	unset	Supported	The outbound to dial through, in place of a socket of its own.
bind_interface	string	unset	Supported	The interface to send through, by name. Loopback destinations still go over loopback, where sing-box applies the bind to them as well.
inet4_bind_address	string	unset	Supported	The local address for IPv4 destinations, loopback ones aside: as bind_interface.
inet6_bind_address	string	unset	Supported	The local address for IPv6 destinations, loopback ones aside: as bind_interface.
bind_address_no_port	bool	false	Supported	IP_BIND_ADDRESS_NO_PORT on TCP sockets bound to an address, so that the port is picked at connect: Linux only.
protect_path	string	unset	Supported	A Unix socket each socket’s descriptor is handed to, with SCM_RIGHTS, before it binds or connects, for the process there to protect it (from its VPN, say); it answers one byte. Besides what the host protects. Unix only.
routing_mark	number|string	unset	Supported	SO_MARK, Linux only.
reuse_addr	bool	false	Supported	SO_REUSEADDR, and SO_REUSEPORT on Unix, on UDP sockets.
netns	string	—	Error: Linux network namespaces: sockets would leave another way	Not implemented yet.
connect_timeout	duration	unset	Supported	How long a TCP connect to one address may take; 5s when unset.
tcp_fast_open	bool	false	Supported	TCP Fast Open: the first data written goes with the SYN. Its addresses are then tried one by one, not raced.
tcp_multi_path	bool	—	Warned: Socket tuning: connections go the same way without it	Not implemented yet.
disable_tcp_keep_alive	bool	false	Supported	No TCP keepalive at all.
tcp_keep_alive	duration	unset	Supported	How long a TCP connection is idle before keepalive probes it; 5m when unset.
tcp_keep_alive_interval	duration	unset	Supported	Between keepalive probes; 75s when unset.
udp_fragment	bool	unset	Supported	Whether UDP datagrams may be fragmented on the way; unset, as the place says, see udp_fragment_default.
domain_resolver	string|object → object	unset	Supported	The DNS server that resolves the names dialled.
network_strategy	string, one of default, fallback, hybrid	unset	Supported	Which of the host’s interfaces a connection goes out of, and how they race; default where only types are given. Only where the host lists its interfaces (NetworkState::interfaces).
network_type	listable-string, one of cellular, ethernet, other, wifi	[]	Supported	The types of interface the strategy goes out of first.
fallback_network_type	listable-string, one of cellular, ethernet, other, wifi	[]	Supported	The types it falls back to, with fallback.
fallback_delay	duration	unset	Supported	How long the addresses of one family are tried before those of the other are raced against them (Happy Eyeballs), and the first interfaces before the fallback ones; 300ms when unset.
server	string	unset	Supported	May be left out, with server_port, by an outbound with a detour: one over ShadowTLS, which dials its own server.
server_port	number	unset	Supported	—
uuid	string	required	Supported	—
security	string, one of auto, none, zero, aes-128-cfb, aes-128-gcm, chacha20-poly1305	"auto"	Supported	auto, aes-128-gcm, chacha20-poly1305, none or zero.
alter_id	number	0	Supported	Only 0: legacy VMess is not spoken.
global_padding	bool	false	Supported	Random padding after each chunk, as v2ray pads.
authenticated_length	bool	—	Error: VMess’s authenticated length: sail would speak VMess otherwise	—
network	listable-string, one of tcp, udp	—	Supported	—
tls	object → object	unset	Supported	—
packet_encoding	string, one of packetaddr, xudp	""	Supported	"" (VMess’s own UDP) or xudp.
multiplex	object → object	unset	Supported	—
transport	object → object, [grpc], [http], [httpupgrade], [ws]	unset	Supported	—
domain_strategy	string	unset	Supported (deprecated in sing-box)	sing-box’s deprecated field for the families names resolve to, which a resolver’s own strategy goes before.
skip_default_domain_resolver	bool	false	sail extension	A sail extension: without a domain_resolver of its own, the names dialled resolve as the DNS rules say, not as route.default_domain_resolver does; as Mihomo’s DIRECT resolves apart from the proxies’ servers.
tcp_concurrent	bool	false	sail extension	A sail extension, Mihomo’s tcp-concurrent: a name’s addresses are all connected to at once and the first to connect is taken, rather than one family’s one by one, the other’s raced against them after fallback_delay (Happy Eyeballs). With network_strategy, each address is still raced over the interfaces, so as many sockets open at once as there are addresses times interfaces.

Types sail does not implement: outbounds

Type	Status	Fields
outbounds[bridge]	Error: A protocol sail does not implement	5
outbounds[hysteria]	Error: A protocol sail does not implement	90
outbounds[naive]	Error: A protocol sail does not implement	81
outbounds[snell]	Error: A protocol sail does not implement	40
outbounds[ssh]	Error: A protocol sail does not implement	43
outbounds[tor]	Error: A protocol sail does not implement	34