mihomo

https://wiki.metacubex.one/en
Admin
mihomo is a powerful and flexible proxy client with support for various protocols, advanced routing,...
Tokens:83,377
Snippets:1,007
Trust Score:6.1
Update:2 weeks ago
Show doc for...
Tokens:
Raw
### Start Mihomo service

Source: https://wiki.metacubex.one/en/startup/service

Starts the Mihomo service immediately.

```bash
systemctl start mihomo

```

--------------------------------

### ZeroTier proxy configuration example

Source: https://wiki.metacubex.one/en/config/proxies/zerotier

Example YAML configuration for a ZeroTier proxy. All optional fields are commented out with their default values or example values. The required fields are 'name', 'type', and 'network'.

```yaml
proxies:
  - name: zerotier
    type: zerotier
    network: "0123456789abcdef"
    # state-dir: ./zerotier-node
    # identity-secret: "0123456789:0:public-key:private-key"
    # planet: ./planet
    # mtu: 1400
    # physical-mtu: 1432
    # ip-stack:
    #   mode: auto
    #   congestion-controller: cubic
    # primary-port: 0
    # secondary-port: 0
    # tcp-fallback-mode: auto
    # tcp-fallback-relay: 204.80.128.1:443
    # remote-trace-target: "0123456789"
    # remote-trace-level: 0
    # low-bandwidth: false
    # encrypted-hello: false
    # orbit:
    #   - world: "0123456789abcdef"
    #     seed: "0123456789"
    udp: true
    # remote-dns-resolve: true
    # dns: [10.147.17.1]
    # dialer-proxy: "ss1"
    # interface-name: "WLAN"
    # routing-mark: 6666
    # ip-version: ipv4-prefer
```

--------------------------------

### EasyTier proxy configuration example

Source: https://wiki.metacubex.one/en/config/proxies/easytier

Full example of an EasyTier proxy configuration in mihomo, showing all available options. Required fields are name, type, and network-name. The example includes commented-out optional settings for hostname, ipv4, dhcp, peers, security, listeners, and more.

```yaml
proxies:
  - name: "easytier"
    type: easytier
    network-name: example
    network-secret: secret
    # hostname: mihomo
    # ipv4: 10.144.0.1/24
    # dhcp: true
    peers:
      - tcp://192.0.2.10:11010
      - udp://192.0.2.11:11010
    # secure-mode: true
    # local-private-key: "base64-x25519-private-key"
    # local-public-key: "base64-x25519-public-key"
    # listeners: ["tcp://0.0.0.0:11010"]
    # no-listener: true
    # mapped-listeners: ["tcp://203.0.113.10:11010"]
    # exit-nodes: ["10.144.0.1"]
    # proxy-networks: ["10.0.0.0/24"]
    # instance-name: mihomo-easytier
    # state-dir: ./easytier
    udp: true
    # accept-dns: false
    # enable-exit-node: false
    # enable-encryption: true
    # encryption-algorithm: aes-gcm
    # private-mode: false
    # latency-first: false
    # disable-p2p: false
    # enable-kcp-proxy: false
    # disable-kcp-input: false
    # enable-quic-proxy: false
    # disable-quic-input: false
    # mtu: 1380
    # tld-dns-zone: et.net.
    # dialer-proxy: "ss1"
    # interface-name: "WLAN"
    # routing-mark: 6666
    # ip-version: ipv4-prefer

```

--------------------------------

### Sudoku proxy configuration example

Source: https://wiki.metacubex.one/en/config/proxies/sudoku

Example configuration for a Sudoku proxy with HTTPMask settings. Includes commented-out optional fields for custom tables and multiplexing.

```yaml
proxies:
  - name: sudoku
    type: sudoku
    server: 1.2.3.4
    port: 443 
    key: "<client_key>"
    aead-method: chacha20-poly1305
    padding-min: 2
    padding-max: 7
    table-type: prefer_ascii
    # custom-table: xpxvvpvv
    # custom-tables: ["xpxvvpvv", "vxpvxvvp"]
    # multiplex: "off"
    httpmask:
      disable: false
      mode: legacy
      tls: true
      host: ""
      path-root: ""
      multiplex: "off"
    enable-pure-downlink: false
```

--------------------------------

### Expanded YAML anchor example

Source: https://wiki.metacubex.one/en/handbook/syntax

Equivalent expanded version of the anchor example. Shows the result of merging the anchor 'p' into each provider.

```yaml
proxy-providers:
  provider1:
    type: http
    interval: 3600
    health-check:
      enable: true
      url: https://www.gstatic.com/generate_204
      interval: 300
    url: ""
    path: ./proxy_providers/provider1.yaml

  provider2:
    interval: 3600
    health-check:
      enable: true
      url: https://www.gstatic.com/generate_204
      interval: 300
    type: file
    path: ./proxy_providers/provider2.yaml

```

--------------------------------

### Proxy group configuration example

Source: https://wiki.metacubex.one/en/config/proxy-groups

Example of a proxy group configuration with all available fields. Shows the structure for a select-type group with proxies, providers, health check settings, and filtering options.

```yaml
proxy-groups:
- name: "proxy"
  type: select
  proxies:
  - DIRECT
  - ss
  use:
  - provider1
  - provider1

  url: 'https://www.gstatic.com/generate_204'
  interval: 300
  lazy: true
  default-selected: ss
  empty-fallback: COMPATIBLE
  timeout: 5000
  max-failed-times: 5

  disable-udp: true
  interface-name: en0
  routing-mark: 11451
  include-all: false
  include-all-proxies: false
  include-all-providers: false
  filter: "(?i)港|hk|hongkong|hong kong"
  exclude-filter: "美|日"
  exclude-type: "Shadowsocks|Http"
  expected-status: 204
  hidden: true
  icon: xxx

```

--------------------------------

### OpenVPN proxy configuration example

Source: https://wiki.metacubex.one/en/config/proxies/openvpn

Example configuration for an OpenVPN proxy. Includes auth-user-pass mode with username/password, certificate mode with CA, and commented optional settings like tls-auth, tls-crypt, ping, cipher, and more.

```yaml
proxies:
  - name: "openvpn"
    type: openvpn
    server: vpn.example.com
    port: 1194
    proto: udp
    # auth-user-pass mode
    username: "user"
    password: "pass"
    # Certificate mode (Alternative to the above)
    # cert: |
    #   -----BEGIN CERTIFICATE-----
    #   ...
    #   -----END CERTIFICATE-----
    # key: |
    #   -----BEGIN PRIVATE KEY-----
    #   ...
    #   -----END PRIVATE KEY-----
    # tls-auth: |
    #   -----BEGIN OpenVPN Static key V1-----
    #   ...
    #   -----END OpenVPN Static key V1-----
    # key-direction: "1"
    ca: |
      -----BEGIN CERTIFICATE-----
      MIIB...example
      -----END CERTIFICATE-----
    # tls-crypt: |
    #  -----BEGIN OpenVPN Static key V1-----
    #  ...
    #  -----END OpenVPN Static key V1-----
    # tls-crypt-v2: |
    #  -----BEGIN OpenVPN tls-crypt-v2 client key-----
    #  ...
    #  -----END OpenVPN tls-crypt-v2 client key-----
    # peer-info:
    #   IV_HWADDR: "52:54:00:ff:72:87"
    #   UV_DEVICE_ID: "laptop-001"
    # ping: 10
    # ping-restart: 60
    # tran-window: 3600
    # handshake-timeout: 30
    # dev: tun
    # cipher: AES-128-GCM
    # data-ciphers: [AES-256-GCM, AES-128-GCM]
    # data-ciphers-fallback: AES-128-CBC
    # auth: SHA256
    # comp-lzo: "no"
    udp: true
    # mtu: 1500
    # ip-stack:
    #   mode: auto
    #   congestion-controller: cubic
    # dialer-proxy: "ss1"
    # remote-dns-resolve: true
    # dns: [ 1.1.1.1, 8.8.8.8 ]
```

--------------------------------

### TUN configuration example with legacy syntax

Source: https://wiki.metacubex.one/en/config/inbound/tun

Complete TUN configuration example for mihomo, including modern and legacy routing options. Use this as a reference for all available TUN settings. The legacy syntax section shows deprecated inet4/inet6 route keys.

```yaml
tun:
  enable: true
  stack: mips
  auto-route: true
  auto-redirect: true
  auto-detect-interface: true
  dns-hijack:
    - any:53
    - tcp://any:53
  device: utun0
  mtu: 9000
  strict-route: true
  gso: true
  gso-max-size: 65536
  inet6-address: [fdfe:dcba:9876::1/126]
  udp-timeout: 300
  iproute2-table-index: 2022
  iproute2-rule-index: 9000
  endpoint-independent-nat: false
  route-address-set:
    - ruleset-1
  route-exclude-address-set:
    - ruleset-2
  route-address:
    - 0.0.0.0/1
    - 128.0.0.0/1
    - "::/1"
    - "8000::/1"
  route-exclude-address:
  - 192.168.0.0/16
  - fc00::/7
  include-interface:
  - eth0
  exclude-interface:
  - eth1
  include-uid:
  - 0
  include-uid-range:
  - 1000:9999
  exclude-uid:
  - 1000
  exclude-uid-range:
  - 1000:9999
  include-mac-address:
  - 00:11:22:33:44:55
  exclude-mac-address:
  - 00:11:22:33:44:66
  include-android-user:
  - 0
  - 10
  include-package:
  - com.android.chrome
  exclude-package:
  - com.android.captiveportallogin

## Legacy Syntax
  inet4-route-address:
  - 0.0.0.0/1
  - 128.0.0.0/1
  inet6-route-address:
  - "::/1"
  - "8000::/1"
  inet4-route-exclude-address:
  - 192.168.0.0/16
  inet6-route-exclude-address:
  - fc00::/7
```

--------------------------------

### Sniffer configuration example

Source: https://wiki.metacubex.one/en/config/sniff

Example configuration for the sniffer section, showing all available options: enable, force-dns-mapping, parse-pure-ip, override-destination, sniff protocols with ports, force-domain, skip-domain, skip-src-address, and skip-dst-address.

```yaml
sniffer:
  enable: false
  force-dns-mapping: true
  parse-pure-ip: true
  override-destination: false
  sniff:
    HTTP:
      ports: [80, 8080-8880]
      override-destination: true
    TLS:
      ports: [443, 8443]
    QUIC:
      ports: [443, 8443]
  force-domain:
    - +.v2ex.com
  skip-domain:
    - Mijia Cloud
  skip-src-address:
    - 192.168.0.3/32
  skip-dst-address:
    - 192.168.0.3/32
```

--------------------------------

### proxy-providers configuration example

Source: https://wiki.metacubex.one/en/config/proxy-providers

Defines a proxy provider named 'provider1' with an HTTP source, health checks, overrides, filtering, and an inline payload. The example shows the full YAML structure with commented-out override expressions and filter examples.

```yaml
proxy-providers:
  provider1:
    type: http
    url: "http://test.com"
    path: ./proxy_providers/provider1.yaml
    interval: 3600
    proxy: DIRECT
    size-limit: 0
    age-secret-key: AGE-SECRET-KEY-1ZTQLLN0A4U3ZTT3DCZKYN0CGZEZQLWX2DFTXUWMT4ZHR0N2UG6LSW9NT0N
    header:
      User-Agent:
      - "mihomo/1.18.3"
      Authorization:
      - 'token 1231231'
      # X-Age-Public-Key:
      # - 'age1xh86kh9v23vattr58yedspm3f57sxvnswu9krr6ns438amekx5gsd09uma'
    health-check:
      enable: true
      url: https://www.gstatic.com/generate_204
      interval: 300
      timeout: 5000
      lazy: true
      expected-status: 204
    override:
      tfo: false
      mptcp: false
      udp: true
      udp-over-tcp: false
      down: "50 Mbps"
      up: "10 Mbps"
      skip-cert-verify: true
      name-cert-verify: example.com
      dialer-proxy: proxy
      interface-name: tailscale0
      routing-mark: 233
      ip-version: ipv4-prefer
      additional-prefix: "provider1 prefix |"
      additional-suffix: "| provider1 suffix"
      proxy-name:
      - pattern: "IPLC-(.*?)倍"
        target: "iplc x $1"
      # override-expr:
      #   - '.name = "[provider1] " + .name'                    
      #   - '.plugin-opts.mode = "tls"'                        
      #   - '.alpn[] |= upcase'                                
      #   - 'del(.skip-cert-verify)'                           
      #   - '.name = (.name | trim | upcase)'                  
      #   - '.name = "[\(.type)] \(.name):\(.port)"'       
      #   - '(select(.port == 443) | .tls) = true'             
      #   - '.tags |= (unique | sort)'                         
      #   - '.names = [.servers[] | select(.enabled) | .name]' 
      #   - '.servers |= map(select(.enabled))'                
      #   - '.options |= with_entries(.key |= upcase)'         
      #   - '. | with_entries(.key |= upcase)'                 
    filter: "(?i)港|hk|hongkong|hong kong"
    exclude-filter: "xxx"
    exclude-type: "ss|http"
    payload:
      - name: "ss1"
        type: ss
        server: server
        port: 443
        cipher: chacha20-ietf-poly1305
        password: "password"
```

--------------------------------

### mihomo config example with proxy providers and proxy groups

Source: https://wiki.metacubex.one/en/example/conf

Complete mihomo configuration example with proxy providers, DNS settings, TUN, and proxy groups. Requires valid subscription URLs in provider1 and provider2. Uses fake-ip mode and external UI from metacubexd.

```yaml
# Enter your subscription URLs below. Provider names must be unique.
proxy-providers:
  provider1:
    url: ""
    type: http
    interval: 86400
    health-check: {enable: true,url: "https://www.gstatic.com/generate_204",interval: 300}
    override:
      additional-prefix: "[provider1]"

  provider2:
    url: ""
    type: http
    interval: 86400
    health-check: {enable: true,url: "https://www.gstatic.com/generate_204",interval: 300}
    override:
      additional-prefix: "[provider2]"

proxies:
  - name: "Direct"
    type: direct
    udp: true

mixed-port: 7890
ipv6: true
allow-lan: true
unified-delay: false
tcp-concurrent: true
external-controller: 127.0.0.1:9090
external-ui: ui
external-ui-url: "https://github.com/MetaCubeX/metacubexd/archive/refs/heads/gh-pages.zip"

find-process-mode: strict

profile:
  store-selected: true
  store-fake-ip: true

sniffer:
  enable: true
  sniff:
    HTTP:
      ports: [80, 8080-8880]
      override-destination: true
    TLS:
      ports: [443, 8443]
    QUIC:
      ports: [443, 8443]
  skip-domain:
    - "Mijia Cloud"
    - "+.push.apple.com"

tun:
  enable: true
  stack: mixed
  dns-hijack:
    - "any:53"
    - "tcp://any:53"
  auto-route: true
  auto-redirect: true
  auto-detect-interface: true

dns:
  enable: true
  ipv6: true
  enhanced-mode: fake-ip
  fake-ip-filter:
    - "*"
    - "+.lan"
    - "+.local"
    - "+.market.xiaomi.com"
  default-nameserver:
    - tls://223.5.5.5
    - tls://223.6.6.6
  nameserver:
    - https://doh.pub/dns-query
    - https://dns.alidns.com/dns-query

proxy-groups:

  - name: Default
    type: select
    proxies: [Auto,Direct,Hong Kong,Taiwan,Japan,Singapore,United States,Other Regions,All Proxies]

  - name: Google
    type: select
    proxies: [Default,Hong Kong,Taiwan,Japan,Singapore,United States,Other Regions,All Proxies,Auto,Direct]

  - name: Telegram
    type: select
    proxies: [Default,Hong Kong,Taiwan,Japan,Singapore,United States,Other Regions,All Proxies,Auto,Direct]

  - name: Twitter
    type: select
    proxies: [Default,Hong Kong,Taiwan,Japan,Singapore,United States,Other Regions,All Proxies,Auto,Direct]

  - name: Bilibili
    type: select
    proxies: [Default,Hong Kong,Taiwan,Japan,Singapore,United States,Other Regions,All Proxies,Auto,Direct]
```

--------------------------------

### ShadowQUIC proxy configuration example

Source: https://wiki.metacubex.one/en/config/proxies/shadowquic

Example configuration for a ShadowQUIC proxy in mihomo. Includes required fields (name, server, port, type, username, password) and commented optional settings for TLS, QUIC versions, congestion control, and other advanced options.

```yaml
proxies:
- name: shadowquic
  server: www.example.com
  port: 10443
  type: shadowquic
  username: username
  password: password
  # sni: example.com
  # alpn: [h3]
  # quic-versions: [v1] # support v1/v2, default v1
  # udp-over-stream: false # UDP over stream, default false
  # zero-rtt: false
  # keep-alive-interval: 10000
  # congestion-controller: cubic
  # up: 100 Mbps
  # down: 100 Mbps
  # cwnd: 32
  # bbr-profile: "standard"
  # max-datagram-frame-size: 1400
  # max-open-streams: 1024
  # recv-window-conn: 0
  # recv-window: 0
  # disable-mtu-discovery: false

```

--------------------------------

### rule-providers configuration example

Source: https://wiki.metacubex.one/en/config/rule-providers

Example configuration for a rule-provider named 'google' using HTTP type. It specifies the URL, update interval, proxy, behavior, format, custom headers, and inline payload. The 'path' is optional and defaults to MD5 of URL if not provided.

```yaml
rule-providers:
  google:
    type: http
    path: ./rule1.yaml
    url: "https://raw.githubusercontent.com/../Google.yaml"
    interval: 600
    proxy: DIRECT
    behavior: classical
    format: yaml
    # path-in-bundle: "geo/geosite/cn.mrs"
    size-limit: 0
    header:
      User-Agent:
      - "mihomo/1.18.3"
      Authorization:
      - 'token 1231231'
    payload:
      - 'DOMAIN-SUFFIX,google.com'
```

--------------------------------

### Enable Mihomo service

Source: https://wiki.metacubex.one/en/startup/service

Enables the Mihomo service to start automatically at boot.

```bash
systemctl enable mihomo

```

--------------------------------

### Hysteria2 proxy configuration example

Source: https://wiki.metacubex.one/en/config/proxies/hysteria2

Example proxy configuration for Hysteria2. Includes port jumping, rate control, obfuscation, TLS settings, and optional realm options. Commented lines show available settings and defaults.

```yaml
proxies:
- name: "hysteria2"
  type: hysteria2
  server: server.com
  port: 443
  ports: 443-8443
  hop-interval: 30
  password: yourpassword
  up: "30 Mbps"
  down: "200 Mbps"
  # bbr-profile: "" # Available: "standard", "conservative", "aggressive". Default: "standard"
  obfs: salamander # Defaults to empty. If filled, obfs will be enabled. Currently supports `salamander` and `gecko`.
  obfs-password: yourpassword
  # obfs-min-packet-size: 512
  # obfs-max-packet-size: 1200
  sni: server.com
  skip-cert-verify: false
  name-cert-verify: example.com
  fingerprint: xxxx # Configuring the fingerprint provides SSL pinning. Obtain it with: openssl x509 -noout -fingerprint -sha256 -inform pem -in yourcert.pem
  alpn:
    - h3
  # realm-opts:
  #   enable: true # Must be turned on manually
  #   server-url: https://realm.hy2.io
  #   token: public
  #   realm-id: my-cabin-1f3a8c2e9b
  #   stun-servers:
  #     - stun.nextcloud.com:3478
  #     - stun.sip.us:3478
  #     - global.stun.twilio.com:3478
  #   # The following supports entering TLS configuration for the server-url (sni, skip-cert-verify, name-cert-verify, fingerprint, certificate, private-key, alpn)
  #   # skip-cert-verify： false
  #   # name-cert-verify: example.com
  #   # ......
  # handshake-timeout: 30
  ###Special quic-go options. Do not modify them unless you know what you are doing.###
  # initial-stream-receive-window： 8388608
  # max-stream-receive-window： 8388608
  # initial-connection-receive-window： 20971520
  # max-connection-receive-window： 20971520
```

--------------------------------

### TUIC proxy configuration example

Source: https://wiki.metacubex.one/en/config/proxies/tuic

Example configuration for a TUIC proxy. Required fields include token (for TUIC V4) or uuid and password (for TUIC V5). Optional fields are commented out.

```yaml
proxies:
- name: tuic
  server: www.example.com
  port: 10443
  type: tuic
  token: TOKEN
  uuid: 00000000-0000-0000-0000-000000000001
  password: PASSWORD_1
  # ip: 127.0.0.1
  # heartbeat-interval: 10000
  # alpn: [h3]
  disable-sni: true
  reduce-rtt: true
  request-timeout: 8000
  udp-relay-mode: native
  # congestion-controller: bbr
  # bbr-profile: "" # Available: "standard", "conservative", "aggressive". Default: "standard"
  # max-udp-relay-packet-size: 1500
  # fast-open: true
  # skip-cert-verify: true
  # name-cert-verify: example.com
  # max-open-streams: 20
  # sni: example.com

```

--------------------------------

### Tailscale proxy configuration example

Source: https://wiki.metacubex.one/en/config/proxies/tailscale

Example configuration for a Tailscale proxy node in Mihomo. All fields are optional except name and type. The type must be fixed to 'tailscale'. If auth-key is omitted, an interactive login URL is printed in the logs on first startup.

```yaml
proxies:
  - name: "tailscale"
    type: tailscale
    hostname: mihomo
    auth-key: tskey-auth-xxxx
    control-url: https://controlplane.tailscale.com
    state-dir: ./tailscale
    ephemeral: false
    udp: true
    accept-routes: true
    exit-node: 100.64.0.1
    exit-node-allow-lan-access: true
    dialer-proxy: "ss1"
    interface-name: "WLAN"
    routing-mark: 6666
    ip-version: ipv4-prefer
```

--------------------------------

### VLESS proxy configuration example

Source: https://wiki.metacubex.one/en/config/proxies/vless

Example VLESS proxy configuration for mihomo. Includes TLS, Reality, shadow-tls, restls, jls, and smux options. The `flow` field uses `xtls-rprx-vision` and `packet-encoding` is set to `xudp`.

```yaml
proxies:
- name: "vless"
  type: vless
  server: server
  port: 443
  udp: true
  uuid: uuid
  flow: xtls-rprx-vision
  packet-encoding: xudp

  tls: true
  servername: example.com
  alpn:
  - h2
  - http/1.1
  fingerprint: xxxx
  client-fingerprint: chrome
  skip-cert-verify: true
  name-cert-verify: example.com
  shadow-tls-opts:
    version: 3
    password: shadow-tls-password
  restls-opts:
    password: restls-password
    version-hint: tls13
  jls-opts:
    username: jls-user
    password: jls-password
  reality-opts:
    public-key: xxxx
    short-id: xxxx
  encryption: ""

  network: tcp

  smux:
    enabled: false

```

--------------------------------

### ShadowQUIC listener configuration example

Source: https://wiki.metacubex.one/en/config/inbound/listeners/shadowquic

Example configuration for a ShadowQUIC inbound listener. It defines a listener named shadowquic-in-1 on port 10822 with a user and a JLS camouflage upstream. All optional fields are commented out with their default values or usage notes.

```yaml
listeners:
- name: shadowquic-in-1
  type: shadowquic
  port: 10822
  listen: 0.0.0.0
  # routing-mark: 0 # Sets routing-mark for the listening socket (Linux only)
  # rule: sub-rule-name1
  # proxy: proxy
  users:
    - username: username
      password: password
  jls-upstream:
    addr: www.example.com:443
    # sni: example.com
    # proxy: proxy
    # rate-limit: 0
  # alpn:
  #   - h3
  # quic-versions: [v1]
  # zero-rtt: true
  # congestion-controller: bbr
  # up: 100 Mbps
  # down: 100 Mbps
  # ignore-client-bandwidth: false
  # cwnd: 10
  # bbr-profile: ""
  # max-idle-time: 30000
  # max-datagram-frame-size: 1400
  # recv-window-conn: 0
  # recv-window: 0
  # disable-mtu-discovery: false
```

--------------------------------

### DNS Additional Parameters Example

Source: https://wiki.metacubex.one/en/config/dns

Example configuration for DNS servers with additional parameters. Uses '#' to add parameters and '&' to connect them. The 'proxy' parameter uses an existing proxy named 'proxy', and 'ecs' specifies the subnet address. Other parameters are boolean values.

```yaml
dns:
  nameserver:
  - 'https://8.8.8.8/dns-query#proxy&ecs=1.1.1.1/24&ecs-override=true'
proxies:
- name: proxy
  type: ss

```

--------------------------------

### MASQUE proxy configuration examples

Source: https://wiki.metacubex.one/en/config/proxies/masque

Example configuration for three MASQUE proxy variants: standard masque, masque-h3-l4proxy (UDP disabled), and masque-h2. Includes commented optional fields such as ip-stack, sni, dialer-proxy, remote-dns-resolve, dns, congestion-controller, bbr-profile, and handshake-timeout.

```yaml
proxies:
# masque
- name: "masque"
  type: masque
  server: server.com
  port: 443
  private-key: BASE64_ENCODED_PRIVATE_KEY
  public-key: BASE64_ENCODED_PUBLIC_KEY
  ip: 172.16.0.2/32
  ipv6: fd00::2/128
  mtu: 1280
  udp: true
  # ip-stack:
  #   mode: auto
  #   congestion-controller: cubic
  # sni: example.com
  # Identifier of an outbound proxy. When non-empty, connections are sent through the specified proxy.
  # dialer-proxy: "ss1"
  # remote-dns-resolve: true # Force remote DNS resolution, default is false
  # dns: [ 1.1.1.1, 8.8.8.8 ] # Effective only when remote-dns-resolve is true
  # congestion-controller: bbr # Disabled by default
  # bbr-profile: "" # Available: "standard", "conservative", "aggressive". Default: "standard"
  # handshake-timeout: 30

# masque-h3-l4proxy
- name: "masque-h3-l4proxy"
  type: masque
  server: server.com
  port: 443
  private-key: BASE64_ENCODED_PRIVATE_KEY
  public-key: BASE64_ENCODED_PUBLIC_KEY
  udp: false # l4proxy mode currently does not support UDP
  # ip-stack:
  #   mode: auto
  #   congestion-controller: cubic
  network: h3-l4proxy
  # remote-dns-resolve: true # Force remote DNS resolution, default is false
  # dns: [ tls://1.1.1.1, tls://1.0.0.1 ] # Effective only when remote-dns-resolve is true
  # congestion-controller: bbr # Disabled by default
  # handshake-timeout: 30

# masque-h2
- name: "masque-h2"
  type: masque
  server: server.com
  port: 443
  private-key: BASE64_ENCODED_PRIVATE_KEY
  public-key: BASE64_ENCODED_PUBLIC_KEY
  ip: 172.16.0.2/32
  ipv6: fd00::2/128
  mtu: 1280
  udp: true
  # ip-stack:
  #   mode: auto
  #   congestion-controller: cubic
  # sni: example.com
  network: h2
  # Identifier of an outbound proxy. When non-empty, connections are sent through the specified proxy.
  # dialer-proxy: "ss1"
  # remote-dns-resolve: true # Force remote DNS resolution, default is false
  # dns: [ 1.1.1.1, 8.8.8.8 ] # Effective only when remote-dns-resolve is true
  # handshake-timeout: 30
```

--------------------------------

### AnyTLS proxy configuration example

Source: https://wiki.metacubex.one/en/config/proxies/anytls

Example AnyTLS proxy configuration for Mihomo. Includes common fields (name, type, server, port, password, udp), TLS fields (sni, alpn, skip-cert-verify, name-cert-verify), and optional ShadowTLS, ResTLS, and JLS options. Note that Mihomo does not support AnyTLS+Reality.

```yaml
proxies:
- name: anytls
  type: anytls
  server: 1.2.3.4
  port: 443
  password: "<your password>"
  client-fingerprint: chrome
  udp: true
  # client-metadata: ""
  idle-session-check-interval: 30
  idle-session-timeout: 30
  min-idle-session: 0
  sni: "example.com"
  alpn:
    - h2
    - http/1.1
  skip-cert-verify: true
  name-cert-verify: example.com
  shadow-tls-opts:
    version: 3
    password: shadow-tls-password
  restls-opts:
    password: restls-password
    version-hint: tls13
  jls-opts:
    username: jls-user
    password: jls-password
```

--------------------------------

### Trojan proxy configuration example

Source: https://wiki.metacubex.one/en/config/proxies/trojan

Complete Trojan proxy configuration example. Includes required fields (name, type, server, port, password) and optional TLS, transport, and multiplexing settings. The `network` field supports `ws`/`grpc`; if unset or set to another value, TCP is used.

```yaml
proxies:
- name: "trojan"
  type: trojan
  server: server
  port: 443
  password: yourpsk
  udp: true

  sni: example.com
  alpn:
  - h2
  - http/1.1
  client-fingerprint: random
  fingerprint: xxxx
  skip-cert-verify: true
  name-cert-verify: example.com
  shadow-tls-opts:
    version: 3
    password: shadow-tls-password
  restls-opts:
    password: restls-password
    version-hint: tls13
  jls-opts:
    username: jls-user
    password: jls-password
  ss-opts:
    enabled: false
    method: aes-128-gcm
    password: "example"
  reality-opts:
    public-key: xxxx
    short-id: xxxx

  network: tcp

  smux:
    enabled: false

```

--------------------------------

### GET /debug/pprof

Source: https://wiki.metacubex.one/en/api

Provides raw DEBUG information, including memory allocation and heap usage reports. Requires the kernel to be started with debug log level.

```APIDOC
## GET /debug/pprof

### Description
Open in a browser `http://${controller-api}/debug/pprof` to view raw DEBUG information. The `allocs` report indicates memory allocation for each function call, including the size of memory allocated on the stack and heap, as well as the number of allocations. The `heap` report provides detailed information about memory usage on the heap, including the size, number, and address of allocated memory blocks, sorted by size.

### Method
GET

### Endpoint
/debug/pprof

### Response
#### Success Response (200)
- **body** (HTML) - Raw DEBUG information page.

### Notes
- Requires the kernel to be started with the log level set to `debug`.
- To view graphical heap report: `go tool pprof -http=:8080 http://127.0.0.1:xxxx/debug/pprof/heap`
- To view graphical allocs report: `go tool pprof -http=:8080 http://127.0.0.1:xxxx/debug/pprof/allocs`
- To submit output report: Access `http://${controller-api}/debug/pprof/heap?raw=true` in a browser to download the file, and upload it to issues.
```

--------------------------------

### Full DNS configuration example

Source: https://wiki.metacubex.one/en/config/dns

Complete DNS configuration example for mihomo, showing all available options with typical values. Includes settings for cache algorithm, listen address, enhanced mode, fake-ip range and filter, nameserver policies, fallback, and fallback-filter. Note that commented lines show optional settings like fake-ip-range6 and fake-ip-ttl.

```yaml
dns:
  enable: true
  cache-algorithm: arc
  prefer-h3: false
  use-hosts: true
  use-system-hosts: true
  respect-rules: false
  listen: 0.0.0.0:1053
  ipv6: false
  default-nameserver:
    - 223.5.5.5
  enhanced-mode: fake-ip
  fake-ip-range: 198.18.0.1/16
  # fake-ip-range6: fdfe:dcba:9876::1/64
  fake-ip-filter-mode: blacklist
  fake-ip-filter:
    - '*.lan'
  # fake-ip-ttl: 1
  nameserver-policy:
    '+.arpa': '10.0.0.1'
    'rule-set:cn':
    - https://doh.pub/dns-query
    - https://dns.alidns.com/dns-query
  nameserver:
    - https://doh.pub/dns-query
    - https://dns.alidns.com/dns-query
  fallback:
    - tls://8.8.4.4
    - tls://1.1.1.1
  proxy-server-nameserver:
    - https://doh.pub/dns-query
  proxy-server-nameserver-policy:
    'www.yournode.com': '114.114.114.114'
  direct-nameserver:
    - system
  direct-nameserver-follow-policy: false
  fallback-filter:
    geoip: true
    geoip-code: CN
    geosite:
      - gfw
    ipcidr:
      - 240.0.0.0/4
      - 0.0.0.0/32
      - 127.0.0.1/32
      - 100.64.0.0/10
    domain:
      - '+.google.com'
      - '+.facebook.com'
      - '+.youtube.com'
  # fallback-lazy-query: false
```

--------------------------------

### Start DoH Server on API Port

Source: https://wiki.metacubex.one/en/config/general

Start a DoH server on the RESTful API port. This URL does not verify the API secret; secure it appropriately.

```yaml
external-doh-server: /dns-query
```

--------------------------------

### TLS proxy configuration example

Source: https://wiki.metacubex.one/en/config/proxies/tls

Complete TLS configuration example for a proxy named 'tls-example'. Shows all TLS-related options: tls, sni, servername, fingerprint, alpn, skip-cert-verify, client-fingerprint, reality-opts, ech-opts, shadow-tls-opts, restls-opts, jls-opts, and tlsmirror-opts. Includes commented-out mTLS fields (name-cert-verify, certificate, private-key) and a full tlsmirror embedded-traffic-generator configuration.

```yaml
proxies:
- name: "tls-example"
  tls: true
  sni: example.com
  servername: example.com
  fingerprint: xxx
  alpn:
  - h2
  - http/1.1
  skip-cert-verify: true
  # name-cert-verify: example.com
  # certificate: xxxx
  # private-key: xxx
  client-fingerprint: chrome
  reality-opts:
    public-key: xxxx
    short-id: xxxx
    support-x25519mlkem768: true
  ech-opts:
    enable: true
    config: base64_encoded_config
    # query-server-name: xxx.com
  shadow-tls-opts: 
    version: 3 
    password: shadow-tls-password
  restls-opts:
    password: restls-password
    version-hint: tls13
  jls-opts:
    username: jls-user
    password: jls-password
  tlsmirror-opts:
    primary-key: MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY=
    explicit-nonce-ciphersuites: [
      156, 157, 158, 159, 160, 161, 162, 163, 164, 165, 166, 167, 168, 169, 170, 171,
      172, 173, 49195, 49196, 49197, 49198, 49199, 49200, 49201, 49202, 49290, 49291,
      49293, 49316, 49317, 49318, 49319, 49320, 49321, 49322, 49323, 49324, 49325,
      49326, 49327, 52392, 52393, 52394, 52395, 52396, 52397, 52398
    ]
    defer-instance-derived-write-time:
      base-nanoseconds: 0
      uniform-random-multiplier-nanoseconds: 0
    transport-layer-padding:
      enabled: false
    connection-enrolment:
      primary-egress-outbound: ""
    sequence-watermarking-enabled: false
    embedded-traffic-generator:
      steps:
        - name: example
          host: example.com
          path: /
          method: GET
          headers:
            - name: User-Agent
              value: mihomo
            - name: Accept
              values:
                - text/html
                - application/xhtml+xml
          connection-ready: true
          connection-recall-exit: true
          h2-do-not-wait-for-download-finish: false
          wait-time:
            base-nanoseconds: 1000000000
            uniform-random-multiplier-nanoseconds: 0
          next-step:
            - weight: 1
              goto-location: 0
```

--------------------------------

### Copy Mihomo binary and config

Source: https://wiki.metacubex.one/en/startup/service

Copies the Mihomo binary to /usr/local/bin and the configuration file to /etc/mihomo. Run these commands before creating the systemd service.

```bash
cp mihomo /usr/local/bin
cp config.yaml /etc/mihomo

```

--------------------------------

### ipcidr rule provider example (YAML and text)

Source: https://wiki.metacubex.one/en/config/rule-providers/content

Example of the ipcidr rule provider type. The YAML block uses a payload list with quoted CIDR entries; the text block shows the same entries without quotes.

```yaml
payload:
- '192.168.1.0/24'
- '10.0.0.0.1/32'

```

```text
192.168.1.0/24
10.0.0.0.1/32

```

--------------------------------

### GET /rules

Source: https://wiki.metacubex.one/en/api

Retrieves all rule information.

```APIDOC
## GET /rules

### Description
Retrieve rule information.

### Method
GET

### Endpoint
/rules

### Response
#### Success Response (200)
- **rules** (array) - Array of rule objects, each containing:
  - **index** (integer) - Rule index (0-based).
  - **type** (string) - Rule type (e.g. `DOMAIN`, `IP-CIDR`, `GEOIP`, etc.).
  - **payload** (string) - Rule match content.
  - **proxy** (string) - Target proxy or policy group name.
  - **size** (integer) - Number of entries in the rule set (only valid for `GEOIP` / `GEOSITE`, `-1` otherwise).
  - **extra** (object, optional) - Additional information:
    - **disabled** (boolean) - Whether the rule is disabled.
    - **hitCount** (integer) - Number of times the rule was matched.
    - **hitAt** (timestamp) - Timestamp of the last match.
    - **missCount** (integer) - Number of times the rule was not matched.
    - **missAt** (timestamp) - Timestamp of the last miss.

#### Response Example
{
  "rules": []
}
```
Tokens:
Raw