Transport Configuration

How network and opts are associated

Transport configuration is attached to a specific outbound node; it is not a standalone proxy protocol. First enter the required VMess, VLESS, or Trojan fields, then use network to select the carrier.

Each *-opts is read only under the network with the same name. TLS, Reality, UDP, and protocol authentication generally remain top-level node fields; selecting WebSocket, gRPC, or XHTTP does not enable them automatically. XHTTP's download-settings is an exception that can override nested TLS and Reality parameters for the downstream connection.

networkSelector

Selects the transport. When empty or set to a value unsupported by the protocol, the current core uses TCP.

*-optsConditionally active

Read only under the corresponding network , for example, ws-opts works only with network: ws。

tls / reality-optsUsually at the top level

Controls transport security and must be configured separately to match the server. For an XHTTP downstream connection, it can be overridden in download-settings .

udp / packet-encodingVMess / VLESS

Controls proxy UDP support and packet encoding for these two protocols. It is not a Trojan transport field and is not determined automatically by network .

Protocol support matrix

The permitted network values differ by protocol. The table uses values from the current public configuration reference.

HTTP and HTTP/2

http and h2 are two different network. Both require the path, Host, and server routing to match, but they use different opts objects.

http-opts.methodHTTP

The HTTP request method; set it to match the server implementation.

http-opts.pathHTTP

The list of HTTP request paths. It must match the server configuration.

http-opts.headersHTTP

Additional HTTP request headers. Values such as Host or Connection should match the reverse-proxy rules.

h2-opts.hostHTTP/2

A list of host domains. When multiple values are configured, the client chooses one at random and the server validates it.

h2-opts.pathHTTP/2

The HTTP/2 request path. It must match the server.

gRPC

The gRPC transport consists of network: grpc and grpc-opts . The service name is the first field to verify. Adjust connection and stream counts only when you clearly understand the server and concurrency requirements.

grpc-opts.grpc-service-nameFollow the server

The gRPC service name. It must match the server.

grpc-opts.grpc-user-agentOptional

Overrides the gRPC User-Agent. Standard nodes usually do not need this.

grpc-opts.ping-intervalOptional

Heartbeat interval in seconds; disabled by default.

grpc-opts.max-connectionsOptional

Maximum number of underlying connections. Default: 1, conflicts with max-streams .

grpc-opts.min-streamsOptional

Minimum number of multiplexed streams before opening a new connection; conflicts with max-streams .

grpc-opts.max-streamsOptional

Maximum number of multiplexed streams before opening a new connection; conflicts with max-connections and min-streams .

WebSocket

The WebSocket transport consists of network: ws and ws-opts . The path and Host usually must also pass CDN or reverse-proxy validation.

ws-opts.pathFollow the server

The WebSocket request path. It must match the server or reverse-proxy route.

ws-opts.headersOptional

Additional request headers, commonly Host; do not confuse this with TLS servername as though they were the same field.

ws-opts.max-early-dataOptional

The initial-packet length threshold for WebSocket Early Data. Enable only when the server supports it.

ws-opts.early-data-header-nameOptional

The request-header name that carries Early Data. It must match the server implementation.

ws-opts.v2ray-http-upgradeOptional

Uses V2Ray HTTP Upgrade mode. It cannot be enabled without corresponding server support.

ws-opts.v2ray-http-upgrade-fast-openOptional

Enables Fast Open for HTTP Upgrade; depends on the preceding field and server support.

mKCP and Mekya

mKCP and Mekya currently apply only to VMess. Neither is a general-purpose transport for VLESS or Trojan; do not retain them across protocols during subscription conversion.

mkcp-opts.mtumKCP

Maximum transmission unit; adjust it for the link MTU.

mkcp-opts.ttimKCP

Transmission interval in milliseconds.

mkcp-opts.uplink-capacitymKCP

Uplink capacity in MB/s.

mkcp-opts.downlink-capacitymKCP

Downlink capacity in MB/s.

mkcp-opts.congestionmKCP

Controls whether congestion control is enabled.

mkcp-opts.seedmKCP

Seed used for AES-GCM authentication. Leave empty to use the default authentication.

mkcp-opts.headermKCP

Available obfuscation packet headers: none、srtp、utp、wechat-video、dtls or wireguard。

mekya-opts.urlMekya

The Mekya server URL. It must match the server entry point.

mekya-opts.max-write-delayMekya

Maximum aggregation wait after the first packet, in milliseconds.

mekya-opts.max-request-sizeMekya

Maximum payload per HTTP request, in bytes.

mekya-opts.polling-interval-initialMekya

Initial interval for empty polling, in milliseconds.

mekya-opts.h2-pool-sizeMekya

HTTP/2 connection-pool size.

mekya-opts.kcpMekya

Mekya's internal KCP parameters; their meanings are the same as mkcp-opts .

XHTTP

XHTTP currently applies only to VLESS. It uses H2 by default; H3 requires tls: true and alpn: [h3], and the current H3 implementation does not accept Reality, ShadowTLS, Restls, or JLS. For HTTP/1.1, set alpn: [http/1.1]。

UUID and VLESS Encryption remain at the node's top level. TLS and Reality also usually remain at the top level, but xhttp-opts.download-settings can provide nested overrides for TLS, Reality, ECH, SNI, and other parameters on the downstream connection.

Advanced XHTTP fields change uplink splitting, padding, session identifiers, and connection reuse. Without matching server or reverse-proxy settings, start with path、host and the default mode instead of filling every option at once.

xhttp-opts.pathFollow the server

The request path. It must match the server or reverse-proxy route.

xhttp-opts.hostFollow the server

The HTTP Host, which is a different field from TLS servername .

xhttp-opts.modeOptional

Available auto、stream-one、stream-up or packet-up。

xhttp-opts.headersOptional

Additional HTTP request headers.

xhttp-opts.no-grpc-headerOptional

Controls whether stream-up or stream-one uplinks omit the Content-Type header used to resemble gRPC.

xhttp-opts.x-padding-bytesOptional

Request-header padding length range. Default: 100-1000。

xhttp-opts.x-padding-obfs-modeOptional

Enables padding obfuscation; defaults to false。

xhttp-opts.uplink-http-methodOptional

The uplink may use a request-body method allowed by the server and intermediary network, such as POST, PUT, PATCH, or DELETE.

xhttp-opts.session-placementOptional

The session ID may be placed in the path, query, cookie, or header.

xhttp-opts.seq-placementOptional

The sequence-number location must be compatible with the session-location rules. When the session is in the path, the sequence number must also be in the path.

xhttp-opts.uplink-data-placementpacket-up

In packet-up mode, controls where split uplink data is placed.

xhttp-opts.uplink-chunk-sizeConditionally active

When uplink data is not placed in the body, controls the maximum bytes per chunk; the minimum is 64 bytes.

xhttp-opts.reuse-settingsOptional

XHTTP connection-reuse settings. There is no default; omitting them leaves reuse disabled.

xhttp-opts.reuse-settings.max-concurrencyChoose one of two

Maximum concurrent requests per underlying connection; conflicts with max-connections .

xhttp-opts.reuse-settings.max-connectionsChoose one of two

Maximum simultaneous connections; conflicts with max-concurrency .

xhttp-opts.download-settingsOptional

Overrides downstream connection parameters. It can contain nested TLS, Reality, ECH, SNI, ALPN, client fingerprint, and related fields; omitted values inherit the uplink configuration.

• Do not use xhttp on a VMess or Trojan node.
• Do not enable XHTTP reuse-settings and generic smuxat the same time, which would create two redundant reuse layers.
• If the path, Host, ALPN, or mode does not match the server, fix those fundamental fields first.
• uplink-http-method: GET is not among the available uplink methods listed in the current field reference.

proxies:
  - name: vless-xhttp-h2
    type: vless
    server: edge.example.com
    port: 443
    uuid: 00000000-0000-0000-0000-000000000001
    encryption: ""
    udp: true
    tls: true
    servername: origin.example.com
    alpn:
      - h2
    client-fingerprint: chrome
    network: xhttp
    xhttp-opts:
      path: /xhttp
      host: origin.example.com
      mode: auto