Configuration examples

Overview

These templates show mode selection after you have filled the identity and endpoint fields from the quick start. Replace all placeholders with your own configuration. They are not complete credentials and must not be copied into a public issue with real values. Server and client use the same binary; you do not need two client instances simply to choose a different outer transport for UDP.

Details

For encrypted TCP multiplexing, set transport=tcp and mux=true. New alpha clients use adaptive mux by default. For dedicated TCP/Vision, use transport=tcp and mux=false. Eligible inner TLS 1.3 traffic can splice after the authenticated boundary exchange; other traffic remains encrypted. No separate vision flag is required.

TCP mux

transport = "tcp"
mux = true

Dedicated TCP / Vision

transport = "tcp"
mux = false

TCP / Vision + QUIC UDP

transport = "tcp"
udp_transport = "quic"
mux = false
socks_listen = "127.0.0.1:1080"

Server template

listen = "0.0.0.0:443"
udp_listen = "0.0.0.0:443"

Native QUIC

transport = "quic"

Clash SOCKS5 node

proxies:
  - name: Umbra
    type: socks5
    server: 127.0.0.1
    port: 1080
    udp: true

Verify

For one instance with TCP/Vision and QUIC UDP, add udp_transport=quic and enable both listen and udp_listen on the server. For native QUIC on all supported request paths, select transport=quic and omit udp_transport so it inherits quic. The fallback destination must support real QUIC/HTTP3. A Clash node with udp: true allows UDP ASSOCIATE while ordinary TCP still follows transport. Validate one change at a time; padding and evasion defaults are a sound starting point until a measured compatibility issue justifies adjustment.