Which logs are useful?

Use guiLogs in storage for client imports, updates and tests; inspect the information panel for core connections, or core files when file logging is enabled.

Record OS, client/core versions, time and minimal reproduction steps. Share only the relevant interval after redacting credentials and private addresses. Mark the time before retrying to distinguish new output.

Can multiple instances run together?

Separate portable folders can keep independent configurations. Use distinct mixed ports and avoid conflicts across related offsets +1, +2, +3, +4, +5 and +21.

Avoid multiple instances competing for system proxy or TUN routes. Assign app proxy ports explicitly and choose one system-settings owner.

Which package for 32-bit Windows?

The included 7.25.6 release has windows-86 ZIPs, labeled x86 on the download page. Earlier FAQ notes about building 32-bit packages are historical.

Check OS and core compatibility too. A 32-bit system cannot execute a 64-bit binary; changing only the GUI does not fix a mismatched core.

Windows downloads

Does the current package support Windows 7?

Current packages require Windows 10 or later; Windows 7 is not supported by this download path. Compatibility involves .NET, UI frameworks and Go-based cores, not just one runtime.

Use a matching package on a supported OS. If maintaining a legacy environment, assess its client/core pair together rather than mixing in the newest core.

Troubleshoot Windows ARM64 launch

Confirm ARM64 in system information and extract the full matching package. If the GUI opens but the core fails, check the core binary architecture and protocol support.

Historical device discussions do not guarantee every ARM device works. Record OS build, processor and exact error to separate emulation, architecture and configuration issues.

Why does Windows show an HTTP proxy?

The Windows system proxy interface primarily configures HTTP proxy settings. The client’s mixed listener can accept both HTTP and SOCKS5 without both appearing there.

Apps requiring SOCKS5 can use 127.0.0.1 and the actual mixed port in their own settings. HTTPS through an HTTP proxy normally uses CONNECT; this does not turn HTTPS content into plaintext.

macOS automatic proxy fails

Verify core startup and inspect guiLogs for proxy-script errors. macOS settings are per network service; Wi-Fi and Ethernet can differ, especially after switching networks.

Check System Settings → Network → active service → Details → Proxies. For manual settings, use 127.0.0.1 and the actual mixed port, then disable those manual entries when finished. Custom profiles may use their own listener port.

Share the proxy on a local network

A hotspot alone does not proxy other devices. Enable LAN access, check the actual LAN listener and allow trusted local devices through the host firewall.

On another device, use the computer’s LAN IP—not 127.0.0.1—and the LAN port. Guest-network/AP isolation can block access. Limit exposure to a controlled network and disable unused listeners.

Route Steam downloads directly

A community recipe adds direct domain rules for geosite:steam@cn and domain:steamserver.net before the proxy catch-all, with matching GEO data installed.

This does not guarantee coverage of every region/CDN. Restart the download and inspect actual destinations/outbounds. Add observed download domains where necessary and distinguish store/community traffic from downloads. Results can differ by core and dataset.

Diagnose along the connection path

Check ordinary networking, profile validity, core startup and whether the app reaches the local listener, then routing and DNS. With Debug enabled, reproduce once and identify the first relevant error.

  1. Connection refused: verify a service listens at the local/remote port.
  2. Timeout: compare direct access and known working profiles.
  3. Certificate/TLS: check clock, SNI, trust chain and pins.
  4. Unknown field/unsupported: check client/core versions and templates.
  5. No core request log: check app proxy or TUN entry before changing outbound rules.

Why do PAC and automatic mode differ?

PAC runs in the application; DIRECT requests bypass core routing and logs. Automatic proxy usually sends requests into the core first.

Check which entry mode the app actually uses, PAC caching and bypass entries before inspecting core routing.

System proxy modes

DNS still fails after configuration

Check node, resolver and destination hostnames separately. A hostname-based resolver needs reachable IP-based bootstrap to avoid circular dependencies.

Browser-managed encrypted DNS, caches, Hosts and FakeIP can influence results. Establish a baseline with default DNS and enable custom options individually. Xray routing resolution differs from outbound resolution.

DNS reference

Only Bing or a particular site fails

Record the exact hostname, browser error and time, then compare direct and proxy behavior. Inspect early direct/block rules, bypass entries and DNS answers.

Sites may restrict exit IPs, regions or accounts. A known working profile provides a useful comparison, but there is no universal Bing fix. Preserve certificate checks and unrelated rules.

UWP loopback utility errors

Record the error, check utility permissions and confirm the UWP app is installed. Reduced/LTSC installations may differ in application components, so verify that the target can be enumerated.

Do not replace loopback authorization with disabling the firewall. Compare with an ordinary browser to isolate app sandboxing from core/proxy failures.

Failures after Windows 11 24H2

Project discussions include congestion-control cases as well as port conflicts and clock issues. The OS version alone does not identify the cause. Check updates, time, logs and ports, then compare system proxy with TUN.

The read-only command below displays current TCP settings. Change a specific network-stack option only after isolating it and recording its previous value.

Windows · PowerShell · read-onlyCopy
Get-NetTCPSetting | Select-Object SettingName,CongestionProvider

No connectivity with TUN

Turn TUN off and verify the same profile through ordinary system proxy. Fix profile/core failures first. For TUN-only issues, check permissions, interface creation, routes, DNS and competing VPN/virtual adapters.

Try defaults, an appropriate stack and a smaller MTU one change at a time. Check exclusion CIDRs for local resources. A local ICMP reply does not prove remote proxy connectivity.

TUN settings

Core fails during a connection test

This is a failure starting the test configuration, not proof every server is unreachable. Inspect the first Debug error, binary architecture/execution permissions, supported fields and listener/test-port conflicts.

Tests use the base port +21 and large batches consume resources. Windows virtualization can reserve port ranges. Compare one profile, smaller batches and a nonconflicting base port; do not delete system reservations indiscriminately.

Can it proxy or accelerate games?

Support depends on the game’s traffic, TCP/UDP, core and server. Many games ignore system HTTP proxy and need app-specific settings or TUN.

A proxy does not guarantee lower latency; distance, loss and extra hops may worsen it. Compare the same game scenario rather than relying on browser speed tests.

Customize tray icons

On Windows, NotifyIcon1.ico through NotifyIcon4.ico in storage provide tray icons for system proxy states. Back up existing files, supply valid ICOs and restart to inspect.

A rule-set PNG icon overrides these state icons, so an unchanged icon does not necessarily mean the proxy mode failed to change.

Proxy remains after shutdown

Shutdown may not allow cleanup to finish. On the next boot, a stale localhost proxy can prevent applications from connecting while the client is stopped.

Reopen and clear system proxy, or remove stale manual/PAC settings through the OS. Clearing before quitting reduces leftovers.

Can paths include spaces or non-Latin text?

Such paths can work, but external cores, scripts, permissions or sync tools may impose restrictions. Compare using the complete portable folder in a short, writable local path.

Quote paths with spaces in commands. Keep companion files and distinguish permission failures from encoding issues.

How final configuration is generated

The client assembles inbounds, logs, routing and outbounds, then applies default/custom DNS, Hosts and node resolution. A full template integrates generated proxy outbounds and can override ordinary settings elsewhere.

The core runs that final result. If a UI setting appears ineffective, inspect full templates, custom files and explicit Core assignments rather than repeatedly changing the same switch.