Proxy Protocols · Clash documentation

SOCKS5 Outbound Proxy

Configure SOCKS5 outbound proxies in the Clash ecosystem using current Mihomo fields, including TCP CONNECT, UDP Associate, authentication, and TLS wrapping.

Read the articleBack to documentation home
  • CONNECT
  • UDP Associate
  • TLS
  • Certificate verification
  • ip-version
Proxy Protocols

How TCP and UDP work in SOCKS5

TCP requests use the SOCKS5 CONNECT command through the upstream proxy. When udp is enabled, the client uses UDP ASSOCIATE to establish UDP forwarding while maintaining the corresponding TCP control connection.

The SOCKS5 protocol does not encrypt the connection from the client to the upstream.tls: true adds a TLS wrapper around the SOCKS5 handshake, provided the upstream service listens in the same way.

Minimum configuration and authentication fields

Without authentication, provide only the node name, type, server, and port. Add authentication fields when the upstream requires a username and password.

nameRequired
The node name, which must be unique within the current configuration.
typeRequired
Set this to socks5。
serverRequired
The domain name or IP address of the upstream SOCKS5 service.
portRequired
The upstream SOCKS5 service port.
usernameOptional
Provide this when the upstream uses username-and-password authentication.
passwordOptional
The authentication password for the username.

TLS and certificate verification

The TLS fields verify the certificate of the upstream SOCKS5 server. The current SOCKS5 outbound implementation has no separate sni field; TLS ServerName defaults to server。

tlsOptional
When the upstream provides a TLS-wrapped SOCKS5 service, set this to true。
skip-cert-verifyUse with caution
Skips certificate verification. Recommended only for short-term diagnosis of certificate issues.
name-cert-verifyOptional
Changes the certificate DNSName verification target without changing the connection address.
fingerprintOptional
The SHA-256 fingerprint of the complete certificate, not a uTLS browser fingerprint.
certificate / private-keyOptional
When both values are provided, they enable client-certificate authentication for the upstream TLS connection.

UDP and IP versions

UDP Associate returns a UDP relay address from the upstream. If it returns an unspecified address, the client fills it in with the upstream server address. The upstream must still allow the corresponding UDP port and source.

udpOptional
Allows this node to handle UDP. Disabled by default.
ip-versionOptional
When server is a domain name, controls whether IPv4, IPv6, dual stack, or a preferred order is used.
dialer-proxyOptional
Makes the current SOCKS5 node establish its upstream connection through another node or policy group.

Authenticated SOCKS5 example

This example uses username-and-password authentication and requests UDP forwarding. If the upstream does not support UDP, remove udp. If the upstream uses TLS wrapping, add tls: true and the relevant certificate-verification fields.

  • If TCP works but UDP does not, first check whether the upstream implements UDP Associate.
  • If the TLS handshake fails, confirm that the port runs a TLS-wrapped SOCKS5 service rather than ordinary SOCKS5.
  • If authentication fails, use the authentication methods actually supported by the server. SOCKS5 outbound does not automatically negotiate third-party authentication plugins.
YAML
proxies:
  - name: socks-upstream
    type: socks5
    server: proxy.example.com
    port: 1080
    username: user
    password: pass
    udp: true
Previous articleHTTP / HTTPS Outbound ProxyNext articleShadowsocks (SS)