Inbound

An inbound accepts connections: it listens on an address, runs a transport stack and speaks a proxy protocol.

Structure

{
  "inbounds": [
    {
      "tag": "vless-in",
      "listen": "0.0.0.0",
      "port": 443,
      "network": "tcp",
      "transport": [{ "type": "tcp" }],
      "protocol": {
        "type": "vless",
        "settings": {
          "users": [
            { "name": "alice", "uuid": "b831381d-6324-4d53-ad4f-8cda48b30811" }
          ]
        }
      },
      "fallback": { "server": "127.0.0.1", "server_port": 8080 },
      "muxcool": {},
      "tcp_idle_timeout": "5m",
      "udp_session_idle_timeout": "5m",
      "udp_max_datagram_size": 8192,
      "udp_routing_cache_entry_idle_timeout": "1m",
      "udp_routing_cache_max_entries_per_session": 1024,
      "max_tcp_connections": 10000,
      "max_udp_sessions": 2000
    }
  ]
}

Protocols

Type	Format	Carries
socks5	SOCKS5	TCP, and UDP through UDP ASSOCIATE
http	HTTP	TCP
trojan	Trojan	TCP, and UDP framed in the stream
vless	VLESS	TCP, and UDP framed in the stream

Built in, made by core rather than a module:

Type	Format	Carries
mixed	Mixed	SOCKS5 and HTTP on one port

Fields

tag

stringRequired

A name unique among inbounds, used in logs, routing and statistics.

listen

IP addressRequired

The address to listen on, such as 127.0.0.1 or ::. There is no default, so nothing is exposed by accident.

port

integerRequired

The port to listen on.

network

stringDefault: tcp

Only tcp is built. udp is refused until a datagram proxy protocol exists.

transport

list of transportsRequired

The transport stack: a base transport, then overlays.

protocol

objectRequired

type and settings of one of the protocols.

fallback

objecttrojan, vless

Where a request the protocol refuses goes, usually a local web server, so a probe sees an ordinary site. It is replayed from its first byte over plain TCP, as decrypted by the overlays. Connections that fail an overlay handshake are closed.

muxcool

objectvless

What the server accepts of Mux.Cool. See Mux.Cool.

tcp_idle_timeout

durationDefault: 5m

Closes a TCP connection silent both ways for this long. Negative disables it.

udp_session_idle_timeout

durationDefault: 5m

Ends a UDP session silent for this long.

udp_max_datagram_size

integer, bytesDefault: 8192

The largest UDP datagram carried either way; a larger one is dropped and counted, never cut. At most 65,507. Keep it equal to SOCKS5's udp_max_datagram_size and freedom's nat.max_datagram_size.

udp_routing_cache_entry_idle_timeout

durationDefault: 1m

A UDP session routes each destination once and remembers the decision. After this much silence toward a destination, the decision is forgotten and made again.

udp_routing_cache_max_entries_per_session

integerDefault: 1024

How many routing decisions one UDP session remembers. The oldest is forgotten first and simply routed again.

max_tcp_connections

integerDefault: no limit

TCP connections held at once. One more is closed before any handshake.

max_udp_sessions

integerDefault: no limit

UDP sessions held at once. Each also holds a TCP connection, and costs about 48 KB. Set it on a server open to people you do not trust.