Upstream proxy

An upstream proxy comes before the active profile. For example, a local HTTP/SOCKS proxy can carry the connection to the active server. The subscription group’s upstream alias must name an existing, uniquely labeled profile.

  1. App
  2. Upstream
  3. Active profile
  4. Destination

Landing proxy

A landing proxy follows the active profile and becomes the final exit to the destination. Keep upstream/landing profiles in a separate stable group to avoid replacement during subscription updates.

With both enabled, traffic follows app → upstream → active profile → landing → destination. Validate each hop individually before chaining.

  1. App
  2. Active profile
  3. Landing
  4. Destination

Setup steps

These fields expect profile aliases, not subscription URLs or server hostnames.

  1. Import and test upstream, active and landing profiles separately.
  2. Give the referenced profiles unique labels across groups.
  3. Edit the active profile’s subscription group, set the required aliases and save.
  4. Reactivate the main profile to regenerate the chain.
  5. Check logs for missing aliases, unsupported protocols or generation errors.

Compatibility and troubleshooting

Xray and sing-box support this feature, but every hop must be compatible with the selected core. Xray upstream/landing profiles do not support protocols such as TUIC or AnyTLS. Missing aliases or unsupported protocols may cause the setting to be skipped with a notice; successful browsing alone does not prove the chain was applied.

To isolate a failure, remove extra hops, verify the main profile and restore them one at a time. Chains inside groups also follow traffic order. Fragmentation may behave differently when combined with chaining.