Interface, DNS & TUN

Import from clipboard

Use Ctrl+V outside text fields or the clipboard-import menu. The parser tries Base64 and plain text: HTTPS subscription addresses, standard protocol links, SIP008, WireGuard, internal links, multiple/single Xray or sing-box configurations, then Clash/Hysteria custom files.

Check completeness, prefix and format on failure. Copy the link itself rather than surrounding page text. Inside an input, Ctrl+V only pastes text.

Custom configurations and Socks ports

The client cannot reliably infer the Socks listener from every custom core configuration. Providing its Socks port adds an Xray/sing-box frontend that routes traffic before forwarding to that port.

When the file already controls inbounds and routing, as typical mihomo configurations do, omit the extra frontend. Then ensure system/app proxy ports match the custom file rather than assuming the client’s mixed port is used.

Subscription group fields

Groups can separate sources or merge compatible content. Save and update to apply filtering and request settings.

What an update does

Updates first check the group’s enabled flag, retrieve content, optionally convert/merge it, and parse profiles. The active profile is reprocessed if it belongs to the group; traffic records are handled and old latency/speed results are cleared.

Distinguish retrieval failure from parse failure. Check route/credentials for the former, format/filter/User Agent for the latter. Keep an independent working profile for recovery.

Mixed listener and related ports

The mixed listener accepts HTTP and SOCKS5. Changing its base also changes related ports; check conflicts and update manually configured apps.

Basic connection settings

routeOnly uses sniffed information for routing rather than replacing the connection destination; sing-box enforces it. REALITY/ECH may use names different from the real target, so consider the profile before changing it.

Client Mux support covers VLESS, VMess, Shadowsocks and Trojan; sing-box also needs a multiplexing protocol. Version 7.25.6 exposes Mux in core settings.

File logging saves core output to guiLogs; otherwise inspect the information panel. Fragmentation may not behave as expected with chains. Interface/source-address binding helps multi-interface setups, but dual-core TUN routing can affect source binding.

Startup, updates and certificate roots

If startup should also enable TUN, configure the permissions requested by the client. A tray profile count above the limit hides the switching list without deleting profiles.

UDP test targets

A UDP test measures connectivity to that test service, not every game or media service. An unavailable test server can also fail; compare with another reachable target.

System proxy exceptions

Addresses in the exception/bypass list skip system proxy; separate entries with commas. An empty value restores client defaults rather than creating an empty bypass list.

Windows advanced protocol selection serves special application requirements. Keep defaults for ordinary use and also check any app-specific proxy setting.

TUN: stack, MTU and exclusions

TUN receives traffic through a virtual interface and requires OS permissions and a working core. Verify ordinary proxy operation first and avoid multiple tools changing default routes simultaneously.

Stacks are system, gvisor and mixed. The Wiki records gvisor as default and suggests trying mixed when suitable; Xray only supports gvisor. The default MTU is 9000 on the virtual interface. Lower it if larger values cause trouble; it differs from physical-interface MTU.

With automatic routing, comma-separated CIDRs such as 192.168.1.0/24 exclude selected networks from TUN.

TUN ICMP policy

sing-box supports these policies. Xray replies locally to ICMP, so very low ping results need not reflect remote latency. In the documented behavior, only WireGuard forwards ICMP; other proxy protocols fall back to reply.

Certificate pinning and retrieval

Pinning restricts verification to specified certificates; confirm pins or chains through a trusted source. The Xray SHA-256 field separates multiple values with ~; sing-box ignores this specific UI field. A PEM chain can contain several certificates.

Certificate retrieval connects to the server and validates its chain. Reachability, self-signed certificates, unknown CAs or trust problems can cause failure. Check address, SNI, clock and expected certificates. Update pins through a trusted source when certificates rotate.

Policy groups and members

Xray supports most-stable, lowest-latency, load-balancing and random policies. sing-box supports lowest-latency and manual exit selection through Selector. Failover is implemented as lowest-latency with 5000ms tolerance, not sequential switching.

Member set one selects subscription groups by alias regex and follows updates. Set two uses manual selections and can nest groups; subscription members may disappear on update, so prefer stable non-subscription profiles there. Both sets combine, and all members must be compatible with the group’s core.

Chain order and core selection

Chain order follows traffic direction: first upstream, last landing. A profile’s explicit Core type overrides the global selection, so changing the global value does not change explicitly assigned profiles.

For unsupported-protocol errors, inspect every chain hop or group member.

Proxy-chain setup

Routing settings and imports

Defaults are created on first launch. Import default rules adds a new set without replacing existing rules, useful when release notes announce changes. Rules can also come from a file, clipboard or subscription URL.

Order matters. Use one of domain, IP or process matching per rule, combined with port/protocol/inbound/network constraints. Verify resolution strategy changes in logs. Windows supports a rule-set PNG tray icon that overrides the system-proxy icon.

Routing reference

Custom sing-box rule sets

JSON rule-set settings can combine local and remote rules. Tags must match routing references, local files must exist and remote URLs must be reachable. Custom sources in the active set take precedence, followed by local resources, user-selected sources and defaults.

Replace the example path with your actual SRS file location. Escape backslashes in Windows JSON paths.

JSON · local rule-set exampleCopy

[
  {
    "tag": "example-rules",
    "type": "local",
    "format": "binary",
    "path": "/path/to/example-rules.srs"
  }
]

Basic DNS settings

Distinguish resolution for IP-based routing from resolution of an actual outbound destination. Xray’s default direct/remote DNS primarily serves routing; sing-box also uses them for node or destination resolution. Separate multiple server addresses with commas.

Hosts, FakeIP and DNS validation

System hosts imports Windows hosts and hosts.ics. Common DNS Hosts adds known resolver mappings as bootstrap redundancy. Manual Hosts entries map a domain to one or more IPs and take precedence over ordinary lookup.

FakeIP works only with sing-box TUN and maps names to synthetic addresses. Blocking SVCB/HTTPS queries is also limited to this mode and affects ECH/HTTP/3 discovery. Regional IP validation checks results against expected GEO ranges; mismatched data/rules can cause resolution failures.

Hosts · documentation addressesCopy

example.com 192.0.2.10 192.0.2.11
example.org 198.51.100.20
# A matching keyword can return NOERROR
keyword:blocked.example #0

Custom DNS configuration

Xray and sing-box use different DNS schemas. Import the selected core’s defaults before making focused changes.

System hosts controls host-map merging; Outbound resolution address resolves node hostnames locally and Outbound strategy selects IPv4/IPv6 behavior. A hostname-based resolver needs bootstrap resolution that does not depend on the unavailable connection it is meant to establish.

Test node, direct-target and proxy-target names separately, reverting to the saved defaults if necessary.

Full configuration templates

The client generates configuration, then applies the full template while preserving its design. With templates enabled, UI inbound/routing/DNS settings may no longer determine the final file; inspect the generated result.

If non-proxy outbounds are excluded, define direct/block equivalents in the template. An upstream tag is assigned to profiles lacking an upstream, but the corresponding outbound must exist in your template. Missing tags can cause failure.

Windows UWP loopback

Some sandboxed UWP apps cannot access localhost and therefore cannot reach a proxy on 127.0.0.1. The loopback utility enables access for selected applications.

It requires appropriate system permissions. On failure, check Windows version, app installation and permission prompts, and retain the exact error. Use application-specific configuration rather than disabling the entire firewall.

Clear traffic statistics

This clears recorded upload/download traffic, not latency or speed-test results. It does not reset usage accounting at a provider.

Record old values before clearing if you need a comparison; subscription replacements may also affect how local statistics appear.

Regional presets and sources

Default GEO, rule-set and routing sources target common usage in China. Other regions can change presets or custom sources before updating resources.

After changing sources, verify that category names still match existing rules. Adjust rules if the new dataset does not contain an old category.

Backup and restore

Backups include guiConfigs: settings, profile database and custom configurations. Save a ZIP through Backup and restore; explicitly use a zip extension on non-Windows systems, where the restore picker accepts ZIP files.

Restore replaces relevant data and restarts the client, so back up the current state first. Reopen manually if restart fails. Backups contain credentials; keep them in controlled storage and check local paths/core binaries after migration.

Locate application storage

Portable data usually lives with the extracted app; installed editions may use a separate user-data directory. The open-storage command locates the actual data for backups, guiLogs and configuration.

Quit before editing guiNConfig.json so shutdown writes do not overwrite your changes. Do not edit guiNDB.db as text.

Files and parameters

Check for updates

Updates cover client, cores and rule resources. Version 7.25.6 adds an option to check through a proxy; verify source reachability when it fails. Repeated checks can hit GitHub API rate limits.

Closing the update window may leave the task running. Self-update uses another process, so allow it to finish before reopening. The Wiki flags historical self-update issues in 6.10–7.23.2; for those versions, use a verified current release package and migrate your backup.

Download verificationRelease notes

Closing versus quitting

Some Windows close actions hide the window in the tray while the core continues. Non-Windows window-close behavior is configurable, including hiding or minimizing; an explicit quit stops the app and cores.

Use tray/process and network state to distinguish hiding from quitting. Clear system proxy before stopping use.

Profile list and information filtering

Click a column to sort; invalid latency/speed values stay last. Drag columns to change order/width and quit normally to save layout. Profile filtering is a fuzzy text search, not regex.

Information-panel filters accept regex but only affect new output after the filter is set. Copy relevant excerpts for deeper analysis and redact credentials before sharing.