hesoyam/sing-box-extended-mirror
1
0
Fork 0
mirror of https://github.com/shtorm-7/sing-box-extended.git synced 2026-10-27 13:36:57 +00:00
Code Issues Packages Projects Releases 2 Wiki Activity

Merge tag 'v1.14.0'

Browse Source
This commit is contained in:
Shtorm
2026-09-04 01:08:30 +03:00
parent 99bbd49406 0b8995879f
commit c0bfc731ec
987 changed files with 141481 additions and 11302 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/configuration/outbound/bridge.md
+77
View File
@@ -0,0 +1,77 @@
---
icon: material/new-box
---
!!! question "Since sing-box 1.14.0"
# Bridge
!!! quote ""
Requires privileges. Supported on Linux, macOS, Windows, rooted Android, and jailbroken iOS.
For graphical clients: on macOS, only available in the standalone version and requires the
Helper Service; on Android, requires root permission; on iOS, requires jailbreak.
`bridge` is the L3 counterpart of the `direct` outbound: it forwards L3 connections
(TCP, UDP and ICMP) directly out of a network interface. Route L3 traffic to it from a TUN
or other L3 endpoints via the `route` action in
[Pre-match](/configuration/shared/pre-match/); L4 connections will be rejected.
Traffic to local addresses of the machine (loopback, or addresses assigned to its
network interfaces) will be rejected.
It is recommended to use [`preferred_by`](/configuration/route/rule/#preferred_by)
as a gate in the `route` rule: it only matches in
[pre-match](/configuration/shared/pre-match/) and excludes local addresses that
cannot be routed.
### Structure
```json
{
"type": "bridge",
"tag": "bridge-out",
"interface": "",
"bridge_name": "",
"iproute2_table_index": 0,
"iproute2_rule_index": 0
}
```
### Fields
#### interface
Interface name for forwarded traffic to egress.
The default interface will be used by default.
Forwarded traffic will be dropped while the interface is unavailable.
#### bridge_name
Custom bridge TUN interface name prefix, `bridge` is used by default.
Not effective on Apple platforms.
#### iproute2_table_index
!!! quote ""
Only supported on Linux, and only takes effect when `interface` is set.
Linux iproute2 table index for pinned egress routes.
`2200` + instance index is used by default.
#### iproute2_rule_index
!!! quote ""
Only supported on Linux.
Linux iproute2 rule start index.
`100` is used by default.
docs/configuration/outbound/bridge.zh.md
+72
View File
@@ -0,0 +1,72 @@
---
icon: material/new-box
---
!!! question "自 sing-box 1.14.0 起"
# Bridge
!!! quote ""
需要特权。支持 Linux、macOS、Windows、rooted Android 和越狱 iOS。
对于图形客户端：macOS 仅独立版本可用，且需要辅助服务；Android 需要 root 权限；iOS 需要越狱。
`bridge` 是 `direct` 出站的 L3 版本：它将 L3 连接（TCP、UDP 和 ICMP）直接从网络接口转发出去。
通过[预匹配](/zh/configuration/shared/pre-match/)中的 `route` 动作，将 L3 流量从 TUN
或其他 L3 endpoints 路由到它；L4 连接将被拒绝。
到本机本地地址（loopback 或分配给本机网络接口的地址）的流量将被拒绝。
建议使用 [`preferred_by`](/zh/configuration/route/rule/#preferred_by) 作为 `route`
规则的门禁：它仅在[预匹配](/zh/configuration/shared/pre-match/)中匹配，且排除了无法路由的本地地址。
### 结构
```json
{
"type": "bridge",
"tag": "bridge-out",
"interface": "",
"bridge_name": "",
"iproute2_table_index": 0,
"iproute2_rule_index": 0
}
```
### 字段
#### interface
转发流量流出的网络接口名称。
默认使用默认接口。
接口不可用期间，转发流量将被丢弃。
#### bridge_name
自定义 bridge TUN 接口名前缀，默认使用 `bridge`。
在 Apple 平台上无效。
#### iproute2_table_index
!!! quote ""
仅支持 Linux，且仅在设置了 `interface` 时生效。
用于固定出口路由的 Linux iproute2 路由表索引。
默认使用 `2200` + 实例索引。
#### iproute2_rule_index
!!! quote ""
仅支持 Linux。
Linux iproute2 规则起始索引。
默认使用 `100`。
docs/configuration/outbound/hysteria.md
+34 -23
View File
@@ -27,13 +27,18 @@ icon: material/new-box
"obfs": "fuck me till the daylight",
"auth": "",
"auth_str": "password",
"network": "",
"tls": {},
... // QUIC Fields
... // Dial Fields
// Deprecated
"recv_window_conn": 0,
"recv_window": 0,
"disable_mtu_discovery": false,
"network": "tcp",
"tls": {},
... // Dial Fields
"disable_mtu_discovery": false
}
```
@@ -104,24 +109,6 @@ Authentication password, in base64.
Authentication password.
#### recv_window_conn
The QUIC stream-level flow control window for receiving data.
`15728640 (15 MB/s)` will be used if empty.
#### recv_window
The QUIC connection-level flow control window for receiving data.
`67108864 (64 MB/s)` will be used if empty.
#### disable_mtu_discovery
Disables Path MTU Discovery (RFC 8899). Packets will then be at most 1252 (IPv4) / 1232 (IPv6) bytes in size.
Force enabled on for systems other than Linux and Windows (according to upstream).
#### network
Enabled network
@@ -136,6 +123,30 @@ Both is enabled by default.
TLS configuration, see [TLS](/configuration/shared/tls/#outbound).
### QUIC Fields
See [QUIC Fields](/configuration/shared/quic/) for details.
### Dial Fields
See [Dial Fields](/configuration/shared/dial/) for details.
### Deprecated Fields
#### recv_window_conn
!!! failure "Deprecated in sing-box 1.14.0"
Use QUIC fields `stream_receive_window` instead.
#### recv_window
!!! failure "Deprecated in sing-box 1.14.0"
Use QUIC fields `connection_receive_window` instead.
#### disable_mtu_discovery
!!! failure "Deprecated in sing-box 1.14.0"
Use QUIC fields `disable_path_mtu_discovery` instead.
docs/configuration/outbound/hysteria.zh.md
+33 -23
View File
@@ -27,13 +27,18 @@ icon: material/new-box
"obfs": "fuck me till the daylight",
"auth": "",
"auth_str": "password",
"network": "",
"tls": {},
... // QUIC 字段
... // 拨号字段
// 废弃的
"recv_window_conn": 0,
"recv_window": 0,
"disable_mtu_discovery": false,
"network": "tcp",
"tls": {},
... // 拨号字段
"disable_mtu_discovery": false
}
```
@@ -104,24 +109,6 @@ base64 编码的认证密码。
认证密码。
#### recv_window_conn
用于接收数据的 QUIC 流级流控制窗口。
默认 `15728640 (15 MB/s)`。
#### recv_window
用于接收数据的 QUIC 连接级流控制窗口。
默认 `67108864 (64 MB/s)`。
#### disable_mtu_discovery
禁用路径 MTU 发现 (RFC 8899)。 数据包的大小最多为 1252 (IPv4) / 1232 (IPv6) 字节。
强制为 Linux 和 Windows 以外的系统启用（根据上游）。
#### network
启用的网络协议。
@@ -136,7 +123,30 @@ base64 编码的认证密码。
TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#出站)。
### QUIC 字段
参阅 [QUIC 字段](/zh/configuration/shared/quic/) 了解详情。
### 拨号字段
参阅 [拨号字段](/zh/configuration/shared/dial/)。
### 废弃字段
#### recv_window_conn
!!! failure "已在 sing-box 1.14.0 废弃"
请使用 QUIC 字段 `stream_receive_window` 代替。
#### recv_window
!!! failure "已在 sing-box 1.14.0 废弃"
请使用 QUIC 字段 `connection_receive_window` 代替。
#### disable_mtu_discovery
!!! failure "已在 sing-box 1.14.0 废弃"
请使用 QUIC 字段 `disable_path_mtu_discovery` 代替。
docs/configuration/outbound/hysteria2.md
+164 -4
View File
@@ -1,3 +1,11 @@
!!! quote "Changes in sing-box 1.14.0"
:material-plus: [hop_interval_max](#hop_interval_max)
:material-plus: [bbr_profile](#bbr_profile)
:material-plus: [disable_chrome_parrot](#disable_chrome_parrot)
:material-plus: [realm](#realm)
:material-alert: [obfs](#obfstype)
!!! quote "Changes in sing-box 1.11.0"
:material-plus: [server_ports](#server_ports)
@@ -9,13 +17,14 @@
{
"type": "hysteria2",
"tag": "hy2-out",
"server": "127.0.0.1",
"server_port": 1080,
"server_ports": [
"2080:3000"
],
"hop_interval": "",
"hop_interval_max": "",
"up_mbps": 100,
"down_mbps": 100,
"obfs": {
@@ -25,8 +34,26 @@
"password": "goofy_ahh_password",
"network": "tcp",
"tls": {},
... // QUIC Fields
"bbr_profile": "",
"brutal_debug": false,
"disable_chrome_parrot": false,
"realm": {
"server_url": "https://realm.example.com",
"token": "",
"realm_id": "",
"stun_servers": [],
"ip_version": 0,
"port_mapping": {
"enabled": false,
"timeout": "",
"lifetime": ""
},
"http_client": {}
},
... // Dial Fields
}
```
@@ -51,6 +78,8 @@
The server address.
Conflicts with `realm`.
#### server_port
==Required==
@@ -59,13 +88,15 @@ The server port.
Ignored if `server_ports` is set.
Conflicts with `realm`.
#### server_ports
!!! question "Since sing-box 1.11.0"
Server port range list.
Conflicts with `server_port`.
Conflicts with `server_port` and `realm`.
#### hop_interval
@@ -75,6 +106,14 @@ Port hopping interval.
`30s` is used by default.
#### hop_interval_max
!!! question "Since sing-box 1.14.0"
Maximum port hopping interval, used for randomization.
If set, the actual hop interval will be randomly chosen between `hop_interval` and `hop_interval_max`.
#### up_mbps, down_mbps
Max bandwidth, in Mbps.
@@ -83,7 +122,7 @@ If empty, the BBR congestion control algorithm will be used instead of Hysteria
#### obfs.type
QUIC traffic obfuscator type, only available with `salamander`.
QUIC traffic obfuscator type, one of `salamander` `gecko`.
Disabled if empty.
@@ -91,6 +130,22 @@ Disabled if empty.
QUIC traffic obfuscator password.
#### obfs.min_packet_size
!!! question "Since sing-box 1.14.0"
Minimum on-wire packet size in bytes. Gecko only.
`512` is used by default.
#### obfs.max_packet_size
!!! question "Since sing-box 1.14.0"
Maximum on-wire packet size in bytes. Gecko only.
`1200` is used by default.
#### password
Authentication password.
@@ -109,10 +164,115 @@ Both is enabled by default.
TLS configuration, see [TLS](/configuration/shared/tls/#outbound).
### QUIC Fields
See [QUIC Fields](/configuration/shared/quic/) for details.
#### bbr_profile
!!! question "Since sing-box 1.14.0"
BBR congestion control algorithm profile, one of `conservative` `standard` `aggressive`.
`standard` is used by default.
#### brutal_debug
Enable debug information logging for Hysteria Brutal CC.
#### disable_chrome_parrot
!!! question "Since sing-box 1.14.0"
Disable Chrome QUIC fingerprint parroting.
If it is not disabled, the client's QUIC handshake is made to parrot Chrome's, so that Hysteria traffic
is harder to identify by handshake fingerprinting.
To match Chrome, the client uses Chrome's own QUIC parameters, which override some settings:
`idle_timeout` is fixed at 30 seconds, `max_concurrent_streams` and `initial_packet_size` are replaced by
Chrome's values, and the receive windows start at Chrome's initial values before growing to the configured
maximums.
!!! warning ""
Chrome does not declare support for Ed25519, so a server using an Ed25519 certificate will fail the
handshake. Use an ECDSA or RSA certificate instead; certificates issued by ACME are unaffected.
#### realm
!!! question "Since sing-box 1.14.0"
Connect to a Hysteria2 server through a Hysteria Realm rendezvous service.
The outbound queries the realm for the server's current public addresses, performs UDP hole-punching, and proceeds with the normal QUIC handshake.
Conflicts with `server`, `server_port` and `server_ports`.
The TLS SNI defaults to the host portion of `server_url`. Set `tls.server_name` to match the certificate the Hysteria2 server presents.
See [Hysteria Realm](/configuration/service/hysteria-realm/) for the rendezvous service.
#### realm.server_url
==Required==
Realm rendezvous service URL.
#### realm.token
Bearer token for the realm. Must match one of `users[].token` configured on the realm.
#### realm.realm_id
==Required==
The same slot identifier the target Hysteria2 server registered.
#### realm.stun_servers
==Required==
List of STUN servers (`host` or `host:port`) used to discover this client's public addresses.
Domain names are resolved using [`domain_resolver`](/configuration/shared/dial/#domain_resolver) from Dial Fields.
#### realm.ip_version
Restrict realm connections (STUN, hole punching, and the resulting QUIC path) to a single IP version.
`4` or `6`. Both are used if empty.
#### realm.port_mapping
Maintain a UDP port mapping on the local gateway via UPnP or NAT-PMP.
The mapping is established before STUN discovery and improves hole-punching reliability behind gateways that support it; failures are non-fatal.
Requires IPv4: conflicts with `"ip_version": 6`.
#### realm.port_mapping.enabled
Enable port mapping.
#### realm.port_mapping.timeout
Timeout for gateway discovery and mapping operations.
`10s` is used by default.
#### realm.port_mapping.lifetime
Lease lifetime of the mapping; it is renewed at half the lifetime.
`10m` is used by default.
#### realm.http_client
HTTP client used to talk to the realm.
See [HTTP Client](/configuration/shared/http-client/) for details.
### Dial Fields
See [Dial Fields](/configuration/shared/dial/) for details.
docs/configuration/outbound/hysteria2.zh.md
+162 -4
View File
@@ -1,3 +1,11 @@
!!! quote "sing-box 1.14.0 中的更改"
:material-plus: [hop_interval_max](#hop_interval_max)
:material-plus: [bbr_profile](#bbr_profile)
:material-plus: [disable_chrome_parrot](#disable_chrome_parrot)
:material-plus: [realm](#realm)
:material-alert: [obfs](#obfstype)
!!! quote "sing-box 1.11.0 中的更改"
:material-plus: [server_ports](#server_ports)
@@ -16,6 +24,7 @@
"2080:3000"
],
"hop_interval": "",
"hop_interval_max": "",
"up_mbps": 100,
"down_mbps": 100,
"obfs": {
@@ -25,8 +34,26 @@
"password": "goofy_ahh_password",
"network": "tcp",
"tls": {},
... // QUIC 字段
"bbr_profile": "",
"brutal_debug": false,
"disable_chrome_parrot": false,
"realm": {
"server_url": "https://realm.example.com",
"token": "",
"realm_id": "",
"stun_servers": [],
"ip_version": 0,
"port_mapping": {
"enabled": false,
"timeout": "",
"lifetime": ""
},
"http_client": {}
},
... // 拨号字段
}
```
@@ -49,6 +76,8 @@
服务器地址。
与 `realm` 冲突。
#### server_port
==必填==
@@ -57,13 +86,15 @@
如果设置了 `server_ports`，则忽略此项。
与 `realm` 冲突。
#### server_ports
!!! question "自 sing-box 1.11.0 起"
服务器端口范围列表。
与 `server_port` 冲突。
与 `server_port` 和 `realm` 冲突。
#### hop_interval
@@ -73,6 +104,14 @@
默认使用 `30s`。
#### hop_interval_max
!!! question "自 sing-box 1.14.0 起"
最大端口跳跃间隔，用于随机化。
如果设置，实际跳跃间隔将在 `hop_interval` 和 `hop_interval_max` 之间随机选择。
#### up_mbps, down_mbps
最大带宽。
@@ -81,13 +120,29 @@
#### obfs.type
QUIC 流量混淆器类型，仅可设为 `salamander`。
QUIC 流量混淆器类型，可选 `salamander` `gecko`。
如果为空则禁用。
#### obfs.password
QUIC 流量混淆器密码.
QUIC 流量混淆器密码。
#### obfs.min_packet_size
!!! question "自 sing-box 1.14.0 起"
最小线上数据包大小（字节）。仅限 Gecko。
默认使用 `512`。
#### obfs.max_packet_size
!!! question "自 sing-box 1.14.0 起"
最大线上数据包大小（字节）。仅限 Gecko。
默认使用 `1200`。
#### password
@@ -107,10 +162,113 @@ QUIC 流量混淆器密码.
TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#出站)。
### QUIC 字段
参阅 [QUIC 字段](/zh/configuration/shared/quic/) 了解详情。
#### bbr_profile
!!! question "自 sing-box 1.14.0 起"
BBR 拥塞控制算法配置，可选 `conservative` `standard` `aggressive`。
默认使用 `standard`。
#### brutal_debug
启用 Hysteria Brutal CC 的调试信息日志记录。
#### disable_chrome_parrot
!!! question "自 sing-box 1.14.0 起"
禁用 Chrome QUIC 指纹模仿。
如果没有禁用，客户端的 QUIC 握手将被构造为模仿 Chrome，使 Hysteria 流量更难通过握手指纹识别。
为了与 Chrome 一致，客户端使用 Chrome 自己的 QUIC 参数，其覆盖部分设置：
`idle_timeout` 固定为 30 秒，`max_concurrent_streams` 与 `initial_packet_size` 被替换为 Chrome 的值，
接收窗口从 Chrome 的初始值开始，再增长到配置的最大值。
!!! warning ""
Chrome 不声明支持 Ed25519，因此使用 Ed25519 证书的服务端将无法完成握手。
请改用 ECDSA 或 RSA 证书；由 ACME 签发的证书不受影响。
#### realm
!!! question "自 sing-box 1.14.0 起"
通过 Hysteria Realm 会合服务连接 Hysteria2 服务器。
出站从 realm 查询服务器当前的公网地址，执行 UDP 打洞，然后进行常规的 QUIC 握手。
与 `server`、`server_port` 和 `server_ports` 冲突。
TLS SNI 默认使用 `server_url` 中的主机名。需设置 `tls.server_name` 以匹配 Hysteria2 服务器证书覆盖的名字。
会合服务参阅 [Hysteria Realm](/zh/configuration/service/hysteria-realm/)。
#### realm.server_url
==必填==
Realm 会合服务 URL。
#### realm.token
Realm 的 Bearer 令牌，需与 realm 上配置的 `users[].token` 之一匹配。
#### realm.realm_id
==必填==
目标 Hysteria2 服务器注册时使用的相同槽位标识符。
#### realm.stun_servers
==必填==
用于发现本客户端公网地址的 STUN 服务器列表（`host` 或 `host:port`）。
域名通过 [拨号字段](/zh/configuration/shared/dial/) 中的 [`domain_resolver`](/zh/configuration/shared/dial/#domain_resolver) 解析。
#### realm.ip_version
将 realm 连接（STUN、打洞与最终的 QUIC 路径）限制为单一 IP 版本。
`4` 或 `6`。默认使用两者。
#### realm.port_mapping
通过 UPnP 或 NAT-PMP 在本地网关上维护 UDP 端口映射。
映射在 STUN 发现之前建立，可在支持的网关后提升打洞成功率；失败不影响正常流程。
需要 IPv4：与 `"ip_version": 6` 冲突。
#### realm.port_mapping.enabled
启用端口映射。
#### realm.port_mapping.timeout
网关发现与映射操作的超时。
默认使用 `10s`。
#### realm.port_mapping.lifetime
映射的租约时长；每过一半时长续期一次。
默认使用 `10m`。
#### realm.http_client
与 realm 通信使用的 HTTP 客户端。
参阅 [HTTP 客户端](/zh/configuration/shared/http-client/) 了解详情。
### 拨号字段
参阅 [拨号字段](/zh/configuration/shared/dial/)。
docs/configuration/outbound/index.md
+2 -1
View File
@@ -18,6 +18,7 @@
| Type | Format |
|----------------|--------------------------------|
| `direct` | [Direct](./direct/) |
| `bridge` | [Bridge](./bridge/) |
| `block` | [Block](./block/) |
| `socks` | [SOCKS](./socks/) |
| `http` | [HTTP](./http/) |
@@ -32,7 +33,7 @@
| `hysteria2` | [Hysteria2](./hysteria2/) |
| `mieru` | [Mieru](./mieru/) |
| `anytls` | [AnyTLS](./anytls/) |
| `mieru` | [Mieru](./mieru/) |
| `snell` | [Snell](./snell/) |
| `tor` | [Tor](./tor/) |
| `ssh` | [SSH](./ssh/) |
| `dns` | [DNS](./dns/) |
docs/configuration/outbound/index.zh.md
+2 -1
View File
@@ -18,6 +18,7 @@
| 类型 | 格式 |
|----------------|--------------------------------|
| `direct` | [Direct](./direct/) |
| `bridge` | [Bridge](./bridge/) |
| `block` | [Block](./block/) |
| `socks` | [SOCKS](./socks/) |
| `http` | [HTTP](./http/) |
@@ -32,7 +33,7 @@
| `hysteria2` | [Hysteria2](./hysteria2/) |
| `mieru` | [Mieru](./mieru/) |
| `anytls` | [AnyTLS](./anytls/) |
| `mieru` | [Mieru](./mieru/) |
| `snell` | [Snell](./snell/) |
| `tor` | [Tor](./tor/) |
| `ssh` | [SSH](./ssh/) |
| `dns` | [DNS](./dns/) |
docs/configuration/outbound/naive.md
+21 -1
View File
@@ -17,9 +17,11 @@ icon: material/new-box
"password": "password",
"insecure_concurrency": 0,
"extra_headers": {},
"stream_receive_window": "",
"udp_over_tcp": false | {},
"quic": false,
"quic_congestion_control": "",
"quic_session_receive_window": "",
"tls": {},
... // Dial Fields
@@ -78,6 +80,14 @@ Number of concurrent tunnel connections. Multiple connections make the tunneling
Extra headers to send in HTTP requests.
#### stream_receive_window
The flow control window.
When `quic` is enabled, it sets the initial QUIC stream receive window, and `6 MB` is used by default.
Otherwise, it sets the HTTP/2 session receive window, the stream receive window is set to half of it, and `4 MB` is used by default on iOS, `128 MB` on other platforms.
#### udp_over_tcp
UDP over TCP protocol settings.
@@ -99,7 +109,17 @@ QUIC congestion control algorithm.
| `cubic` | CUBIC |
| `reno` | New Reno |
`bbr` is used by default (the default of QUICHE, used by Chromium which NaiveProxy is based on).
`cubic` is used by default (the default of Chromium, which NaiveProxy is based on).
#### quic_session_receive_window
!!! note ""
Only used when `quic` is enabled.
The initial QUIC session receive window.
`15 MB` is used by default.
#### tls
docs/configuration/outbound/naive.zh.md
+21 -1
View File
@@ -17,9 +17,11 @@ icon: material/new-box
"password": "password",
"insecure_concurrency": 0,
"extra_headers": {},
"stream_receive_window": "",
"udp_over_tcp": false | {},
"quic": false,
"quic_congestion_control": "",
"quic_session_receive_window": "",
"tls": {},
... // 拨号字段
@@ -78,6 +80,14 @@ icon: material/new-box
HTTP 请求中发送的额外头部。
#### stream_receive_window
流量控制窗口。
当 `quic` 启用时，它设置 QUIC 初始流接收窗口，默认使用 `6 MB`。
否则，它设置 HTTP/2 会话接收窗口，流接收窗口被设置为它的一半，在 iOS 上默认使用 `4 MB`，在其他平台上默认使用 `128 MB`。
#### udp_over_tcp
UDP over TCP 配置。
@@ -99,7 +109,17 @@ QUIC 拥塞控制算法。
| `cubic` | CUBIC |
| `reno` | New Reno |
默认使用 `bbr`（NaiveProxy 基于的 Chromium 使用的 QUICHE 的默认值）。
默认使用 `cubic`（NaiveProxy 基于的 Chromium 的默认值）。
#### quic_session_receive_window
!!! note ""
仅在 `quic` 启用时使用。
QUIC 初始会话接收窗口。
默认使用 `15 MB`。
#### tls
docs/configuration/outbound/snell.md
+125
View File
@@ -0,0 +1,125 @@
---
icon: material/new-box
---
!!! question "Since sing-box 1.14.0"
### Structure
```json
{
"type": "snell",
"tag": "snell-out",
"server": "127.0.0.1",
"server_port": 1080,
"version": 4,
"psk": "password",
"userkey": "",
"reuse": false,
"network": "tcp",
"obfs_mode": "",
"obfs_host": "",
... // Dial Fields
}
```
### Version 6 Structure
```json
{
"type": "snell",
"tag": "snell-out",
"server": "127.0.0.1",
"server_port": 1080,
"version": 6,
"psk": "password",
"userkey": "",
"reuse": false,
"network": "tcp",
"mode": "",
... // Dial Fields
}
```
### Fields
#### server
==Required==
The server address.
#### server_port
==Required==
The server port.
#### version
==Required==
The Snell protocol version, one of `4` `6`.
Version `4` supports HTTP obfuscation (`obfs_mode` / `obfs_host`); version `6`
replaces it with traffic shaping (`mode`) and requires a `psk` of 12 to 255
bytes.
!!! note
Since we intentionally do not support the QUIC proxy mode of Snell v5, the v5 wire protocol
is effectively identical to v4, so no separate v4 server or v5 client is provided.
#### psk
==Required==
The pre-shared key.
#### userkey
The user key, used to authenticate against a multi-user server.
#### reuse
Enable connection reuse (the Snell v2 `CONNECT` command).
#### network
Enabled network
One of `tcp` `udp`.
Both is enabled by default.
#### obfs_mode
==Version 4 only==
HTTP obfuscation mode, one of `none` `http`.
`none` is used by default.
#### obfs_host
==Version 4 only==
The HTTP `Host` header sent when `obfs_mode` is `http`.
`bing.com` is used by default.
#### mode
==Version 6 only==
Traffic shaping mode, one of `default` `unshaped` `unsafe-raw`.
`default` is used by default.
### Dial Fields
See [Dial Fields](/configuration/shared/dial/) for details.
docs/configuration/outbound/snell.zh.md
+124
View File
@@ -0,0 +1,124 @@
---
icon: material/new-box
---
!!! question "自 sing-box 1.14.0 起"
### 结构
```json
{
"type": "snell",
"tag": "snell-out",
"server": "127.0.0.1",
"server_port": 1080,
"version": 4,
"psk": "password",
"userkey": "",
"reuse": false,
"network": "tcp",
"obfs_mode": "",
"obfs_host": "",
... // 拨号字段
}
```
### 版本 6 结构
```json
{
"type": "snell",
"tag": "snell-out",
"server": "127.0.0.1",
"server_port": 1080,
"version": 6,
"psk": "password",
"userkey": "",
"reuse": false,
"network": "tcp",
"mode": "",
... // 拨号字段
}
```
### 字段
#### server
==必填==
服务器地址。
#### server_port
==必填==
服务器端口。
#### version
==必填==
Snell 协议版本，`4` `6` 之一。
版本 `4` 支持 HTTP 混淆（`obfs_mode` / `obfs_host`）；版本 `6` 以流量整形（`mode`）
取而代之，并要求 `psk` 长度为 12 到 255 字节。
!!! note
由于我们有意不支持 Snell v5 的 QUIC 代理模式，v5 的线路协议实际上与 v4 没有区别，
因此不提供独立的 v4 服务器和 v5 客户端。
#### psk
==必填==
预共享密钥。
#### userkey
用户密钥，用于向多用户服务器进行认证。
#### reuse
启用连接复用（Snell v2 `CONNECT` 命令）。
#### network
启用的网络协议。
`tcp` 或 `udp`。
默认所有。
#### obfs_mode
==仅版本 4==
HTTP 混淆模式，`none` `http` 之一。
默认为 `none`。
#### obfs_host
==仅版本 4==
`obfs_mode` 为 `http` 时发送的 HTTP `Host` 头。
默认为 `bing.com`。
#### mode
==仅版本 6==
流量整形模式，`default` `unshaped` `unsafe-raw` 之一。
默认为 `default`。
### 拨号字段
参阅 [拨号字段](/zh/configuration/shared/dial/)。
docs/configuration/outbound/ssh.md
+27
View File
@@ -1,3 +1,9 @@
!!! quote "Changes in sing-box 1.14.0"
:material-plus: [cipher](#cipher)
:material-plus: [mac](#mac)
:material-plus: [kex_algorithm](#kex_algorithm)
### Structure
```json
@@ -17,6 +23,9 @@
],
"host_key_algorithms": [],
"client_version": "SSH-2.0-OpenSSH_7.4p1",
"cipher": [],
"mac": [],
"kex_algorithm": [],
... // Dial Fields
}
@@ -66,6 +75,24 @@ Host key algorithms.
Client version. Random version will be used if empty.
#### cipher
!!! question "Since sing-box 1.14.0"
Allowed ciphers. Default values are used if empty.
#### mac
!!! question "Since sing-box 1.14.0"
Allowed MAC algorithms. Default values are used if empty.
#### kex_algorithm
!!! question "Since sing-box 1.14.0"
Allowed key exchange algorithms. Default values are used if empty.
### Dial Fields
See [Dial Fields](/configuration/shared/dial/) for details.
docs/configuration/outbound/ssh.zh.md
+27
View File
@@ -1,3 +1,9 @@
!!! quote "sing-box 1.14.0 中的更改"
:material-plus: [cipher](#cipher)
:material-plus: [mac](#mac)
:material-plus: [kex_algorithm](#kex_algorithm)
### 结构
```json
@@ -17,6 +23,9 @@
],
"host_key_algorithms": [],
"client_version": "SSH-2.0-OpenSSH_7.4p1",
"cipher": [],
"mac": [],
"kex_algorithm": [],
... // 拨号字段
}
@@ -66,6 +75,24 @@ SSH 用户, 默认使用 root。
客户端版本，默认使用随机值。
#### cipher
!!! question "自 sing-box 1.14.0 起"
允许的加密算法。留空使用默认值。
#### mac
!!! question "自 sing-box 1.14.0 起"
允许的 MAC 算法。留空使用默认值。
#### kex_algorithm
!!! question "自 sing-box 1.14.0 起"
允许的密钥交换算法。留空使用默认值。
### 拨号字段
参阅 [拨号字段](/zh/configuration/shared/dial/)。
docs/configuration/outbound/tuic.md
+7 -1
View File
@@ -16,7 +16,9 @@
"heartbeat": "10s",
"network": "tcp",
"tls": {},
... // QUIC Fields
... // Dial Fields
}
```
@@ -91,6 +93,10 @@ Both is enabled by default.
TLS configuration, see [TLS](/configuration/shared/tls/#outbound).
### QUIC Fields
See [QUIC Fields](/configuration/shared/quic/) for details.
### Dial Fields
See [Dial Fields](/configuration/shared/dial/) for details.
docs/configuration/outbound/tuic.zh.md
+7 -1
View File
@@ -16,7 +16,9 @@
"heartbeat": "10s",
"network": "tcp",
"tls": {},
... // QUIC 字段
... // 拨号字段
}
```
@@ -99,6 +101,10 @@ UDP 包中继模式
TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#出站)。
### QUIC 字段
参阅 [QUIC 字段](/zh/configuration/shared/quic/) 了解详情。
### 拨号字段
参阅 [拨号字段](/zh/configuration/shared/dial/)。