# Proxy Protocols

## `[l4proxies]`

This section defines Layer 4 proxies, like Shadowsocks and VMess. The key for each entry is a user-defined name for the proxy.

### Common Fields

| Key | Type | Description | Required |
|---|---|---|---|
| `type` | String | The proxy type. Supported: `shadowsocks`, `vmess`, `anytls`, `vless`, `trojan`, `http`, `socks5`. | Yes |
| `nickname` | String | A user-friendly name. | No |
| `server` | String | The server address. | Yes |
| `port` | Integer | The server port. | Yes |
| `enabled` | Boolean | Whether the proxy is enabled. Defaults to `true`. | No |
| `route-via-vpn` | Boolean | (New in 1.8.0) Whether the proxy need to route over the VPN, thus you can chain it traffic to another VPN/Proxy server. Default to `false`, server IP must be in IPv4 address. | No |

### Shadowsocks Fields

| Key | Type | Description | Required |
|---|---|---|---|
| `password` | String | The password. | Yes |
| `method` | String | The encryption method. Supported AEAD methods: `aes-128-gcm`, `aes-256-gcm`, `chacha20-ietf-poly1305`. Supported Shadowsocks 2022 methods: `2022-blake3-aes-128-gcm`, `2022-blake3-aes-256-gcm`, `2022-blake3-chacha20-poly1305`. | Yes |
| `obfs-type` | String | Obfuscation type (`tls` or `http`). | No |
| `obfs-host` | String | Obfuscation host (required for `obfs-type`). | No |
| `obfs-path` | String | Obfuscation path (required for `obfs-type=http`). | No |
| `udp-forward`| Boolean | Whether to forward UDP traffic. Defaults to `false`. | No |

For Shadowsocks 2022 methods, `password` must be a base64-encoded pre-shared key. The decoded key must be 16 bytes for `2022-blake3-aes-128-gcm`, and 32 bytes for `2022-blake3-aes-256-gcm` or `2022-blake3-chacha20-poly1305`.

### VMess Fields

| Key | Type | Description | Required |
|---|---|---|---|
| `user-id` | UUID | The user ID. | Yes |
| `alter-id` | Integer | The alter ID. | Yes |
| `security` | String | Security type. E.g., `auto`. | Yes |
| `transport-type`| String | Transport type (`tcp` or `ws`). | Yes |
| `ws-path` | String | The WebSocket path (required for `transport-type=ws`). | No |
| `sni` | String | Server Name Indication for TLS. | No |
| `skip-cert-check`| Boolean | If `true`, skip certificate validation. Defaults to `false`. | No |
| `alpn` | String | Application-Layer Protocol Negotiation. Defaults to `h2,http/1.1`. | No |

| Key | Meaning |
|---|---|
| `ws-host` | Optional WebSocket HTTP Host, separate from TLS SNI. |
| `ws-h2-max-streams` | Optional HTTP/2 WebSocket concurrent-stream limit: 1–256. Omit to use the runtime default. |
| `tls-enabled` | Boolean; defaults to `true`. Enable TLS when required by the server. |

### AnyTLS Fields

AnyTLS is configured as an L4 proxy with `type=anytls`. The fields below configure authentication, TLS, and idle session reuse.

| Key | Type | Description | Required |
|---|---|---|---|
| `password` | String | AnyTLS password. | Yes |
| `sni` | String | TLS Server Name Indication. Defaults to the `server` value when omitted. | No |
| `skip-cert-check` | Boolean | If `true`, skip upstream certificate validation. Defaults to `false`. | No |
| `session-reuse` | Boolean | Enables AnyTLS idle session reuse. Defaults to `true`. | No |
| `idle-session-check-interval` | Integer | Interval in seconds for checking idle AnyTLS sessions. Valid range: `1` to `3600`. Defaults to `30`. | No |
| `idle-session-timeout` | Integer | Idle session timeout in seconds. Valid range: `1` to `3600`. Defaults to `60`. | No |
| `min-idle-sessions` | Integer | Minimum idle sessions to keep. Valid range: `0` to `64`. Defaults to `1`. | No |
| `max-idle-sessions` | Integer | Maximum idle sessions to keep. Valid range: `0` to `64`. Defaults to `4`. | No |

**Example:**
```ini
[l4proxies]
any=type:anytls,nickname:AnyTLS,server:any.example.com,port:443,password:secret,sni:cdn.example.com,skip-cert-check:false,session-reuse:true,idle-session-check-interval:30,idle-session-timeout:60,min-idle-sessions:1,max-idle-sessions:4,enabled:true
```

### HTTP&Socks5 Fields

| Key | Type | Description | Required |
|---|---|---|---|
| `username` | String | Proxy username for upstream authentication. | No |
| `password` | String | Proxy password for upstream authentication. | No |
| `udp-forward` | Boolean | SOCKS5 UDP forwarding flag. Currently kept for profile compatibility; UDP forwarding depends on runtime support. | No |

**Example:**
```ini
[l4proxies]
tshttp=type:http,nickname:tshttp,server:3.3.3.3,port:1055,enabled:true
tssocks=type:socks5,nickname:tssocks,server:10.1.1.1,port:1055,username:user,password:pass,enabled:true,udp-forward:false,route-via-vpn:true
ss2022=type:shadowsocks,nickname:SS2022,server:ss.example.com,port:8388,password:base64-psk,method:2022-blake3-aes-256-gcm,udp-forward:true,enabled:true
any=type:anytls,nickname:AnyTLS,server:any.example.com,port:443,password:secret,sni:cdn.example.com,skip-cert-check:false,session-reuse:true
```

### VLESS: TCP + REALITY + Vision (Pro)

Only this combination is supported in 2.1.0. UDP/XUDP, WebSocket, gRPC, other fingerprints, and plain VLESS/TLS are unsupported. Replace all sample server credentials with your server's values.

| Key | Meaning |
|---|---|
| `user-id` | User UUID. |
| `transport-type` | `tcp` only; default `tcp`. |
| `transport-security` | Required: `reality`. |
| `flow` | Required: `xtls-rprx-vision`. |
| `encryption` | `none` only; default `none`. |
| `sni` | Required REALITY cover server DNS name, as configured by the server. |
| `reality-public-key` | Required canonical 32-byte base64url public key, without padding. |
| `reality-short-id` | Optional; empty or an even number of hexadecimal digits, at most 16. Must match the server. |
| `reality-fingerprint` | `chrome` only; default `chrome`. |
| `udp-forward` | Must be `false` or omitted; TCP only. |

```ini
[l4proxies]
vless-1=type:vless,server:proxy.example.com,port:443,user-id:00010203-0405-0607-0809-0a0b0c0d0e0f,transport-type:tcp,transport-security:reality,flow:xtls-rprx-vision,encryption:none,sni:cover.example.com,reality-public-key:E59WjnvZcQMu7tR7_BgyhycuEdBS-CtKxfImRCdAvFM,reality-short-id:0123456789abcdef,reality-fingerprint:chrome,udp-forward:false
```

### Trojan: TCP or WebSocket + TLS (Pro)

TLS is required. UDP, gRPC, mux, and early data are unsupported. Keep certificate verification enabled for normal use.

| Key | Meaning |
|---|---|
| `password` | Required server password. |
| `transport-type` | `tcp` (default) or `ws`. |
| `sni` | TLS server name; defaults to `server`. Must match the certificate. |
| `skip-cert-check` | Defaults to `false`. `true` disables server certificate verification. |
| `alpn` | Comma-separated TLS ALPN, quoted as one value. WebSocket requires `http/1.1`. |
| `ws-path` | WebSocket path beginning with `/`; used with `ws`. |
| `ws-host` | Optional WebSocket HTTP Host, independent of TLS SNI. |
| `tls-enabled` | Must be `true` or omitted. |
| `udp-forward` | Must be `false` or omitted; TCP only. |

```ini
[l4proxies]
trojan-1=type:trojan,server:trojan.example.com,port:443,password:"replace-with-password",sni:trojan.example.com,skip-cert-check:false
trojan-ws=type:trojan,server:trojan.example.com,port:443,password:"replace-with-password",transport-type:ws,ws-path:/proxy,ws-host:trojan.example.com,sni:trojan.example.com,alpn:"http/1.1",skip-cert-check:false
```

## Import share links

Paste a supported `vless://`, `trojan://`, `vmess://`, `anytls://`, or `ss://` link, scan a QR code, or choose a QR image. Review the imported draft and save. Importing fills settings; it does not connect or verify the server. Unsupported options produce errors instead of being silently discarded.