VLESS

VLESS outbound fields

This page describes clients in the Clash ecosystem proxies VLESS outbound fields in the array. VLESS user authentication, flow control, protocol encryption, transport, and the TLS security layer are separate levels; one field cannot be used to infer another.

The minimal configuration contains only the common required fields and uuid。flow、encryption. Add TLS, Reality, UDP, and non-TCP transports according to the actual server configuration.

nameRequired

The node name, which must be unique within the configuration.

typeRequired

Set this to vless; a modern core with VLESS support is required.

serverRequired

The domain name or IP address of the VLESS server.

portRequired

The server's listening port, which must match the server.

uuidRequired

The VLESS user ID. Use the value assigned by the server.

Flow and XTLS Vision

flow Selects the VLESS subprotocol. The current field reference lists only xtls-rprx-vision; leaving it empty disables this flow control.

flowOptional

The currently available value is xtls-rprx-vision, which must match the server's user configuration.

xtls-rprx-visionFlow control

Vision does not automatically enable TLS or Reality and does not replace uuid or encryption。

VLESS Encryption

encryption is optional encryption at the VLESS protocol layer. It is not the VMess cipherand does not automatically enable TLS or Reality. The current official base example uses an empty string, meaning the new VLESS Encryption parameter is disabled.

When enabled, use the complete string generated and distributed by the server. It contains the algorithm, operating mode, handshake mode, optional padding, and key material; client and server must be configured as a pair.

encryptionFollow the server

Use the empty string from the official example when the new scheme is disabled. When the server enables it, provide the complete matching value.

mlkem768x25519plusAlgorithm

Use the hybrid key-exchange scheme identifier documented here; do not manually substitute an undocumented algorithm name.

native / xorpub / randomChoose one of three

Choose exactly one operating mode. Among them, native and xorpub can use Splice with Vision.

1rtt / 0rttChoose one of two

Choose exactly one handshake mode. 0-RTT reuse also depends on the server's ticket settings.

vless-x25519Generation commands

Use mihomo generate vless-x25519 to generate the X25519-related material; do not invent it.

vless-mlkem768Generation commands

Use mihomo generate vless-mlkem768 to generate the ML-KEM-768-related material.

padding1-RTT only

Padding parameters apply only to 1-RTT and may be omitted. The first padding segment must have 100% probability and be at least 35 bytes.

UDP and packet encoding

udp controls whether UDP may pass through the node, whilepacket-encoding controls VLESS UDP encapsulation. They are separate fields.

udpOptional

Common field; the default is false. Set it to truewhen UDP proxying is required, and confirm server support.

packet-encodingOptional

When left empty, the current VLESS implementation defaults to xudp; you can also explicitly provide packetaddr or xudp, which must be compatible with the server implementation.

TLS, Reality, and certificate fields

TLS and Reality operate at the transport-security layer.reality-opts A non-empty value enables Reality, and tls must also be set to true; otherwise, the current core refuses to create the node.

tlsRequired with Reality

Set to true enables TLS. If you provide reality-opts , you must enable it as well.

servernameOptional

The VLESS SNI field. When empty, it generally uses server. If the WebSocket configuration includes a Host request header, the current implementation prefers that Host as the SNI.

alpnOptional

The TLS application-protocol list, which must match the selected transport and server.

client-fingerprintOptional

A uTLS client fingerprint, such as chrome, not a certificate fingerprint.

fingerprintOptional

The SHA-256 fingerprint of the server certificate, which differs from client-fingerprint .

reality-opts.public-keyReality

The public key corresponding to the server's Reality private key.

reality-opts.short-idReality

Provide one of the short IDs allowed by the server.

reality-opts.support-x25519mlkem768Optional

Declares support for X25519-MLKEM768 key exchange; the server must support it as well.

skip-cert-verifyUse with caution

Skipping certificate verification weakens identity verification and should not be a long-term troubleshooting measure.

Choose a VLESS transport

When omitted network or set to an unsupported value, the current core treats it as TCP. The corresponding *-opts takes effect only when that network is selected.

xhttp-opts.pathFollow the server

The XHTTP request path, which must match the server or reverse-proxy route.

xhttp-opts.hostFollow the server

The XHTTP Host, which is associated with servername They serve different purposes; use the values from the server deployment.

xhttp-opts.modeOptional

Available auto、stream-one、stream-up or packet-up。

Reality and Vision configuration example

This example shows the field hierarchy for VLESS, Reality, and Vision. It leaves encryption as an empty string, indicating that the new VLESS Encryption parameter is not enabled.

• Do not copy VMess alterId or cipher into a VLESS node.
• If the server enables VLESS Encryption while the client still uses an empty string, the configurations will not match.
• flow: xtls-rprx-vision, TLS, and Reality are three separate settings and must be checked independently.
• If the XHTTP path, Host, mode, or ALPN does not match the server, the connection may fail.

proxies:
  - name: vless-reality-vision
    type: vless
    server: 203.0.113.10
    port: 443
    uuid: 00000000-0000-0000-0000-000000000001
    udp: true
    packet-encoding: xudp
    flow: xtls-rprx-vision
    encryption: ""
    tls: true
    servername: cover.example.com
    client-fingerprint: chrome
    reality-opts:
      public-key: your-public-key
      short-id: your-short-id
    network: tcp