Outbound Proxies

Clash provides several outbound types. Each has its own characteristics and use cases. This page introduces their common behavior and how to use and configure them.

Proxies

Proxies are configurable outbound destinations. Like proxy servers, they define where packets are sent.

Shadowsocks

Clash supports the following Shadowsocks ciphers:

Clash also supports the popular Shadowsocks plugins obfs and v2ray-plugin.

- name: "ss1"
  type: ss
  # interface-name: eth0
  # routing-mark: 1234
  server: server
  port: 443
  cipher: chacha20-ietf-poly1305
  password: "password"
  # udp: true

- name: "ss2"
  type: ss
  # interface-name: eth0
  # routing-mark: 1234
  server: server
  port: 443
  cipher: chacha20-ietf-poly1305
  password: "password"
  plugin: obfs
  plugin-opts:
    mode: tls # or http
    # host: bing.com

- name: "ss3"
  type: ss
  # interface-name: eth0
  # routing-mark: 1234
  server: server
  port: 443
  cipher: chacha20-ietf-poly1305
  password: "password"
  plugin: v2ray-plugin
  plugin-opts:
    mode: websocket # 暂不支持 QUIC
    # tls: true # wss
    # skip-cert-verify: true
    # host: bing.com
    # path: "/"
    # mux: true
    # headers:
    #   custom: value

ShadowsocksR

Clash also supports the notorious anti-censorship protocol ShadowsocksR.

The following ShadowsocksR ciphers are supported:

Supported obfuscation methods:

• plain
• http_simple
• http_post
• random_head
• tls1.2_ticket_auth
• tls1.2_ticket_fastauth

Supported protocols:

• origin
• auth_sha1_v4
• auth_aes128_md5
• auth_aes128_sha1
• auth_chain_a
• auth_chain_b

- name: "ssr"
  type: ssr
  # interface-name: eth0
  # routing-mark: 1234
  server: server
  port: 443
  cipher: chacha20-ietf
  password: "password"
  obfs: tls1.2_ticket_auth
  protocol: auth_sha1_v4
  # obfs-param: domain.tld
  # protocol-param: "#"
  # udp: true

Vmess

Clash supports the following Vmess ciphers:

• auto
• aes-128-gcm
• chacha20-poly1305
• none

- name: "vmess"
  type: vmess
  # interface-name: eth0
  # routing-mark: 1234
  server: server
  port: 443
  uuid: uuid
  alterId: 32
  cipher: auto
  # udp: true
  # tls: true
  # skip-cert-verify: true
  # servername: example.com # 优先于 wss 主机
  # network: ws
  # ws-opts:
  #   path: /path
  #   headers:
  #     Host: v2ray.com
  #   max-early-data: 2048
  #   early-data-header-name: Sec-WebSocket-Protocol

- name: "vmess-http"
  type: vmess
  # interface-name: eth0
  # routing-mark: 1234
  server: server
  port: 443
  uuid: uuid
  alterId: 32
  cipher: auto
  # udp: true
  # network: http
  # http-opts:
  #   # method: "GET"
  #   # path:
  #   #   - '/'
  #   #   - '/video'
  #   # headers:
  #   #   Connection:
  #   #     - keep-alive

- name: "vmess-h2"
  type: vmess
  # interface-name: eth0
  # routing-mark: 1234
  server: server
  port: 443
  uuid: uuid
  alterId: 32
  cipher: auto
  network: h2
  tls: true
  h2-opts:
    host:
      - http.example.com
      - http-alt.example.com
    path: /

- name: vmess-grpc
  type: vmess
  # interface-name: eth0
  # routing-mark: 1234
  server: server
  port: 443
  uuid: uuid
  alterId: 32
  cipher: auto
  network: grpc
  tls: true
  servername: example.com
  # skip-cert-verify: true
  grpc-opts:
    grpc-service-name: "example"

Socks5

Clash also supports Socks5 proxies.

- name: "socks"
  type: socks5
  # interface-name: eth0
  # routing-mark: 1234
  server: server
  port: 443
  # username: username
  # password: password
  # tls: true
  # skip-cert-verify: true
  # udp: true

HTTP

Clash also supports HTTP proxy connections.

- name: "http"
  type: http
  # interface-name: eth0
  # routing-mark: 1234
  server: server
  port: 443
  # username: username
  # password: password

- name: "http"
  type: http
  # interface-name: eth0
  # routing-mark: 1234
  server: server
  port: 443
  # username: username
  # password: password
  tls: true
  skip-cert-verify: true

Snell

Clash also integrates support for Snell as an optional anti-censorship protocol.

# 暂不支持 UDP
- name: "snell"
  type: snell
  # interface-name: eth0
  # routing-mark: 1234
  server: server
  port: 44046
  psk: yourpsk
  # version: 2
  # obfs-opts:
    # mode: http # or tls
    # host: bing.com

Trojan

Clash includes built-in support for the popular Trojan protocol:

- name: "trojan"
  type: trojan
  # interface-name: eth0
  # routing-mark: 1234
  server: server
  port: 443
  password: yourpsk
  # udp: true
  # sni: example.com # aka server name
  # alpn:
  #   - h2
  #   - http/1.1
  # skip-cert-verify: true

- name: trojan-grpc
  type: trojan
  # interface-name: eth0
  # routing-mark: 1234
  server: server
  port: 443
  password: "example"
  network: grpc
  sni: example.com
  # skip-cert-verify: true
  udp: true
  grpc-opts:
    grpc-service-name: "example"

- name: trojan-ws
  type: trojan
  # interface-name: eth0
  # routing-mark: 1234
  server: server
  port: 443
  password: "example"
  network: ws
  sni: example.com
  # skip-cert-verify: true
  udp: true
  # ws-opts:
    # path: /path
    # headers:
    #   Host: example.com

Proxy Groups

Proxy Groups distribute requests passed from rules according to different strategies. A group can be referenced directly by rules or by another group; the top-level group is referenced by rules.

relay

Requests are relayed through the listed proxy servers in order. UDP is not currently supported. A listed proxy server must not contain another relay.

url-test

Clash periodically sends HTTP HEAD requests to each proxy server in the list through the specified URL to measure its latency. You can configure the maximum tolerance, test interval, and target URL.

fallback

Clash periodically sends HTTP HEAD requests to each proxy server in the list through the specified URL to test its availability. The first available server is used.

load-balance

Requests with the same eTLD+1 use the same proxy server.

select

At startup, Clash uses the first proxy server in the policy group by default. Users can select a proxy server through the RESTful API. In this mode, you can hard-code servers in the configuration or add them dynamically with Proxy Providers.

At times, however, you may want to route packets over a direct connection. In that case, use the DIRECT outbound.

To use a different network interface, create a policy group containing the DIRECT outbound and set the interface-name option.

- name: "My Wireguard Outbound"
  type: select
  interface-name: wg0
  proxies: [ 'DIRECT' ]

Proxy Providers

Proxy providers dynamically load lists of proxy servers instead of hard-coding them in the configuration. Two provider types can currently load server lists:

• http: Clash loads the server list from the specified URL at startup. If the interval option is set, Clash periodically refreshes the list from the remote source.
• file: Clash loads the server list from the specified file at startup.

Health checks are available in both modes and work exactly like fallback in a policy group. The server-list file uses the same configuration format as the main configuration file:

proxy-providers:
  provider1:
    type: http
    url: "url"
    interval: 3600
    path: ./provider1.yaml
    # filter: 'a|b' # golang regex 正则表达式
    health-check:
      enable: true
      interval: 600
      # lazy: true
      url: http://www.gstatic.com/generate_204
  test:
    type: file
    path: /test.yaml
    health-check:
      enable: true
      interval: 36000
      url: http://www.gstatic.com/generate_204

proxies:
  - name: "ss1"
    type: ss
    server: server
    port: 443
    cipher: chacha20-ietf-poly1305
    password: "password"

  - name: "ss2"
    type: ss
    server: server
    port: 443
    cipher: chacha20-ietf-poly1305
    password: "password"
    plugin: obfs
    plugin-opts:
      mode: tls