|
| 1 | +# VLESS |
| 2 | + |
| 3 | +```{.yaml linenums="1"} |
| 4 | +listeners: |
| 5 | +- name: vless-in-1 |
| 6 | + type: vless |
| 7 | + port: 10817 # supports ports format, e.g., 200,302 or 200,204,401-429,501-503 |
| 8 | + listen: 0.0.0.0 |
| 9 | + # routing-mark: 0 # set routing-mark for listening socket (Linux only) |
| 10 | + # rule: sub-rule-name1 # uses rules by default; if sub-rule is not found, uses rules directly |
| 11 | + # proxy: proxy # if not empty, directly hands over inbound traffic to the specified proxy (if proxy is not empty, the proxy name here must be valid, otherwise an error will occur) |
| 12 | + users: |
| 13 | + - username: 1 |
| 14 | + uuid: 9d0cb9d0-964f-4ef6-897d-6c6b3ccf9e68 |
| 15 | + flow: xtls-rprx-vision |
| 16 | + # ws-path: "/" # if not empty, enables websocket transport layer |
| 17 | + # grpc-service-name: "GunService" # if not empty, enables grpc transport layer |
| 18 | + # xhttp-config: # If the field is not empty, enable the xhttp transport layer. |
| 19 | + # path: "/" |
| 20 | + # host: "" |
| 21 | + # mode: auto # Available: "stream-one", "stream-up" or "packet-up" |
| 22 | + # no-sse-header: false |
| 23 | + # x-padding-bytes: "100-1000" |
| 24 | + # x-padding-obfs-mode: false |
| 25 | + # x-padding-key: x_padding |
| 26 | + # x-padding-header: Referer |
| 27 | + # x-padding-placement: queryInHeader # Available: queryInHeader, cookie, header, query |
| 28 | + # x-padding-method: repeat-x # Available: repeat-x, tokenish |
| 29 | + # uplink-http-method: POST # Available: POST, PUT, PATCH, DELETE |
| 30 | + # session-placement: path # Available: path, query, cookie, header |
| 31 | + # session-key: "" |
| 32 | + # session-table: "" # Available: "", "uuid", "ALPHABET", "Alphabet", "BASE36", "Base62", "HEX", "alphabet", "base36", "hex", "number" |
| 33 | + # session-length: "16-32" # the initial value cannot be 0, and the total ID space must be greater than 2.1 billion; takes effect only if session-table is not empty or uuid |
| 34 | + # seq-placement: path # Available: path, query, cookie, header |
| 35 | + # seq-key: "" |
| 36 | + # uplink-data-placement: body # Available: body, cookie, header |
| 37 | + # uplink-data-key: "" |
| 38 | + # uplink-chunk-size: 0 # only applicable when uplink-data-placement is not body |
| 39 | + # sc-max-buffered-posts: 30 |
| 40 | + # sc-stream-up-server-secs: "20-80" |
| 41 | + # sc-max-each-post-bytes: 1000000 |
| 42 | + # ------------------------- |
| 43 | + # Configuration of server-side vless encryption: |
| 44 | + # (native mode / public key XOR only / fully random. 1-RTT generates a random ticket valid for 300-600 seconds each time for 0-RTT reuse / only 1-RTT is allowed) |
| 45 | + # Filling in "600s" will randomly take between 50% and 100%, which is equivalent to filling in "300-600s" |
| 46 | + # / means selecting only one option, followed by base64 - at least one, infinite chain, use `mihomo generate vless-x25519` and `mihomo generate vless-mlkem768` to generate, remove parentheses when replacing values |
| 47 | + # |
| 48 | + # Padding is an optional parameter, taking effect only on 1-RTT to eliminate handshake length characteristics, default value on both sides is "100-111-1111.75-0-111.50-0-3333": |
| 49 | + # After 1-RTT client/server hello, a random padding of 111 to 1111 bytes is added with 100% probability |
| 50 | + # With 75% probability, a random delay of 0 to 111 milliseconds is applied ("probability-from-to") |
| 51 | + # Again with 50% probability, a random padding of 0 to 3333 bytes is sent (if 0, Write() is not called) |
| 52 | + # Server and client can set different padding parameters, infinite chain in the order of len, gap, the first padding requires 100% probability, minimum 35 bytes |
| 53 | + # ------------------------- |
| 54 | + # decryption: "mlkem768x25519plus.native/xorpub/random.600s(300-600s)/0s.(padding len).(padding gap).(X25519 PrivateKey).(ML-KEM-768 Seed)..." |
| 55 | + # if the following two options are filled, enables tls (must be filled together) |
| 56 | + # certificate: ./server.crt # certificate in PEM format, or the path to the certificate |
| 57 | + # private-key: ./server.key # corresponding private key in PEM format, or the path to the private key |
| 58 | + # the following two options are for mTLS configuration. If client-auth-type is set to "verify-if-given" or "require-and-verify", client-auth-cert must not be empty |
| 59 | + # client-auth-type: "" # available values: "", "request", "require-any", "verify-if-given", "require-and-verify" |
| 60 | + # client-auth-cert: string # certificate in PEM format, or the path to the certificate |
| 61 | + # if filled, enables ECH (can be generated by `mihomo generate ech-keypair <plaintext-domain>`) |
| 62 | + # ech-key: | |
| 63 | + # -----BEGIN ECH KEYS----- |
| 64 | + # ACATwY30o/RKgD6hgeQxwrSiApLaCgU+HKh7B6SUrAHaDwBD/g0APwAAIAAgHjzK |
| 65 | + # madSJjYQIf9o1N5GXjkW4DEEeb17qMxHdwMdNnwADAABAAEAAQACAAEAAwAIdGVz |
| 66 | + # dC5jb20AAA== |
| 67 | + # -----END ECH KEYS----- |
| 68 | + # if reality-config is filled, enables reality (note: cannot be filled simultaneously with certificate and private-key) |
| 69 | + reality-config: |
| 70 | + dest: test.com:443 |
| 71 | + private-key: jNXHt1yRo0vDuchQlIP6Z0ZvjT3KtzVI-T4E7RoLJS0 # can be generated by `mihomo generate reality-keypair` command |
| 72 | + short-id: |
| 73 | + - 0123456789abcdef |
| 74 | + server-names: |
| 75 | + - test.com |
| 76 | + # the following two limits are optional, used to rate-limit fallback connections that fail verification, bytesPerSec defaults to 0 which means disabled |
| 77 | + # fallback rate limiting is a fingerprint feature and is not recommended; if you are a panel/one-click script developer, make sure to randomize these parameters |
| 78 | + limit-fallback-upload: |
| 79 | + after-bytes: 0 # starts rate limiting after transmitting specified bytes |
| 80 | + bytes-per-sec: 0 # baseline speed (bytes/second) |
| 81 | + burst-bytes-per-sec: 0 # burst speed (bytes/second), takes effect when greater than bytesPerSec |
| 82 | + limit-fallback-download: |
| 83 | + after-bytes: 0 # starts rate limiting after transmitting specified bytes |
| 84 | + bytes-per-sec: 0 # baseline speed (bytes/second) |
| 85 | + burst-bytes-per-sec: 0 # burst speed (bytes/second), takes effect when greater than bytesPerSec |
| 86 | + # shadow-tls: |
| 87 | + # enable: true |
| 88 | + # version: 3 # supports v1/v2/v3 |
| 89 | + # # password: shadow-tls-password # v2 configuration item |
| 90 | + # users: # v3 configuration item |
| 91 | + # - name: shadow-tls-user |
| 92 | + # password: shadow-tls-password |
| 93 | + # handshake: |
| 94 | + # dest: [www.example.com:443](https://www.example.com:443) |
| 95 | + # # proxy: "" |
| 96 | + ### NOTE: For vless listener, if "allow-insecure" is not true, at least one of "certificate and private-key" or "shadow-tls" or "jls-config" or "reality-config" or "decryption" must be filled in ### |
| 97 | + # allow-insecure: false # whether to allow disabling TLS encryption (NOTE: only used when upstreamed by nginx, caddy, etc.) |
| 98 | + # mux-option: |
| 99 | + # padding: true |
| 100 | + # brutal: |
| 101 | + # enabled: true |
| 102 | + # up: 1000 # default Mbps |
| 103 | + # down: 1000 |
0 commit comments