Clash Core configuration reference
Use this reference whenever you need to inspect mihomo YAML. A first configuration does not need to begin with 185 fields: start with the best-practice template, then return to the exact field when a specific need appears.
Keep the configuration understandable
A trusted configuration that contains only what you need is easier to verify and less likely to produce surprising behavior after an update.
EasyTier on macOS
EasyTier adds a virtual-network outbound to the macOS SDK. The protocol directory now lists 24 proxy and network outbound types. iOS, iPadOS, and tvOS retain 23 implementations; EasyTier nodes on those platforms are REJECT placeholders that refuse connections. See the protocol list and Apple platform differences.
Browse by topic
The sections below follow the upstream mihomo configuration reference. Each page describes usage and platform limitations in Clash Core.
Additional notes: Apple platforms · Security
Field support status
- Supported: available subject to the conditions in the field description.
- Managed / limited: affected by client settings, platform capabilities, or compatibility handling.
- Advanced: for advanced uses such as local services or custom trust certificates.
- Unsupported: removed or ineffective inside Apple Packet Tunnel.
- Not applicable: belongs to Android, Linux, or another environment.
Some TUN settings vary by version. TUN guide and version notes.
185 fields shown
| Field | Type | iOS | macOS | tvOS | Platform notes |
|---|---|---|---|---|---|
dns.cache-algorithm | String | Supported | Supported | Supported | Sets the DNS cache algorithm or size; use a valid algorithm name and value. |
dns.cache-max-size | Integer | Supported | Supported | Supported | Sets the DNS cache algorithm or size; use a valid algorithm name and value. |
dns.default-nameserver | List | Managed / limited | Managed / limited | Managed / limited | Sets DNS servers. system/dhcp sources use pre-connection system DNS addresses; unavailable entries are filtered or repaired. |
dns.direct-nameserver | List | Managed / limited | Managed / limited | Managed / limited | Sets direct or fallback resolvers; system/dhcp entries are replaced or filtered. Fallback is used according to its conditions. |
dns.direct-nameserver-follow-policy | Boolean | Supported | Supported | Supported | Controls whether direct DNS follows resolver policies. |
dns.enable | Boolean | Managed / limited | Managed / limited | Managed / limited | DNS stays enabled while Clash is connected; false does not disable it. |
dns.enhanced-mode | String | Supported | Supported | Supported | Selects the DNS enhancement mode; Fake IP settings apply when that mode is used. |
dns.fake-ip-filter | List | Supported | Supported | Supported | Controls which destinations use or bypass Fake IP; requires Fake IP mode. |
dns.fake-ip-filter-mode | String | Supported | Supported | Supported | Controls which destinations use or bypass Fake IP; requires Fake IP mode. |
dns.fake-ip-range | String | Supported | Supported | Supported | Sets a valid IPv4 Fake IP range; it may also supply the default tunnel IPv4 address. |
dns.fake-ip-range6 | String | Managed / limited | Managed / limited | Managed / limited | Sets the IPv6 Fake IP range; effective IPv6 settings must also enable it. |
dns.fake-ip-ttl | Integer | Supported | Supported | Supported | Sets the response TTL for Fake IP mode. |
dns.fallback | List | Managed / limited | Managed / limited | Managed / limited | Sets direct or fallback resolvers; system/dhcp entries are replaced or filtered. Fallback is used according to its conditions. |
dns.fallback-filter.domain | List | Supported | Supported | Supported | Sets fallback conditions; GeoIP/GeoSite conditions require their data resources. |
dns.fallback-filter.geoip | Boolean | Supported | Supported | Supported | Sets fallback conditions; GeoIP/GeoSite conditions require their data resources. |
dns.fallback-filter.geoip-code | String | Supported | Supported | Supported | Sets fallback conditions; GeoIP/GeoSite conditions require their data resources. |
dns.fallback-filter.geosite | List | Supported | Supported | Supported | Sets fallback conditions; GeoIP/GeoSite conditions require their data resources. |
dns.fallback-filter.ipcidr | List | Supported | Supported | Supported | Sets fallback conditions; GeoIP/GeoSite conditions require their data resources. |
dns.fallback-lazy-query | Boolean | Supported | Supported | Supported | Controls fallback DNS query scheduling; separate from lazy node health checks. |
dns.ipv6 | Boolean | Managed / limited | Managed / limited | Managed / limited | Affected by the app’s IP Stack settings; DNS IPv6 also requires global IPv6. Tunnel IPv6 capture is a separate setting. |
dns.ipv6-timeout | Integer | Supported | Supported | Supported | Controls IPv6 waiting in relevant DNS queries, not the overall VPN connection timeout. |
dns.listen | String | Advanced | Advanced | Advanced | Creates a TCP/UDP DNS listener. Proxy authentication, allow-lan, and controller secret do not provide shared access protection for it. |
dns.listen-routing-mark | Integer | Unsupported | Unsupported | Unsupported | No effect; this routing mark is not used on Apple platforms. |
dns.nameserver | List | Managed / limited | Managed / limited | Managed / limited | Sets DNS servers. system/dhcp sources use pre-connection system DNS addresses; unavailable entries are filtered or repaired. |
dns.nameserver-policy | Mapping | Managed / limited | Managed / limited | Managed / limited | Selects resolvers by domain. Addresses are also filtered; if none remain, that policy may return name-not-found. |
dns.prefer-h3 | Boolean | Supported | Supported | Supported | Prefers HTTP/3 for DNS connections that support it. |
dns.proxy-server-nameserver | List | Managed / limited | Managed / limited | Managed / limited | Sets DNS servers. system/dhcp sources use pre-connection system DNS addresses; unavailable entries are filtered or repaired. |
dns.proxy-server-nameserver-policy | Mapping | Managed / limited | Managed / limited | Managed / limited | Selects resolvers by domain. Addresses are also filtered; if none remain, that policy may return name-not-found. |
dns.respect-rules | Boolean | Supported | Supported | Supported | Routes relevant DNS requests by rules; proxy-server-nameserver does not recursively apply this setting. |
dns.use-hosts | Boolean | Supported | Supported | Supported | Uses mappings from top-level hosts for DNS queries. |
dns.use-system-hosts | Boolean | Supported | Supported | Supported | Uses system hosts readable by Clash; does not enable editing system hosts on iOS/tvOS. |
experimental.dialer-ip4p-convert | Boolean | Advanced | Advanced | Advanced | Enables IP4P address conversion when needed. |
experimental.fingerprints | List | Unsupported | Unsupported | Unsupported | The legacy field is accepted but has no fingerprint effect. |
experimental.quic-go-disable-ecn | Boolean | Advanced | Advanced | Advanced | Disables the relevant quic-go feature. Setting false does not clear a flag already set in the current process; neither hot reload nor reconnect guarantees immediate restoration. Separate from TUN GSO. |
experimental.quic-go-disable-gso | Boolean | Advanced | Advanced | Advanced | Disables the relevant quic-go feature. Setting false does not clear a flag already set in the current process; neither hot reload nor reconnect guarantees immediate restoration. Separate from TUN GSO. |
clash-for-android.append-system-dns | Boolean | Not applicable | Not applicable | Not applicable | Android-specific; not used on Apple platforms. |
clash-for-android.ui-subtitle-pattern | String | Not applicable | Not applicable | Not applicable | Android-specific; not used on Apple platforms. |
disable-keep-alive | Boolean | Supported | Supported | Supported | Controls connection keep-alive behavior; verify changes with new connections. |
etag-support | Boolean | Supported | Supported | Supported | Controls ETag use for relevant HTTP resource requests. |
external-controller | String | Advanced | Advanced | Advanced | Creates an HTTP/HTTPS controller. Prefer loopback binding and a secret; some desktop control APIs are unavailable. |
external-controller-cors.allow-origins | List | Advanced | Advanced | Advanced | Controls browser cross-origin access; does not replace authentication. |
external-controller-cors.allow-private-network | Boolean | Advanced | Advanced | Advanced | Controls browser cross-origin access; does not replace authentication. |
external-controller-pipe | String | Not applicable | Not applicable | Not applicable | Windows named-pipe setting; not used on Apple platforms. |
external-controller-routing-mark | Integer | Not applicable | Not applicable | Not applicable | Linux routing mark; not used on Apple platforms. |
external-controller-tls | String | Advanced | Advanced | Advanced | Creates an HTTP/HTTPS controller. Prefer loopback binding and a secret; some desktop control APIs are unavailable. |
external-controller-unix | String | Unsupported | Unsupported | Unsupported | The user-supplied Unix controller path is not used on any of the three platforms. |
external-doh-server | String | Advanced | Advanced | Advanced | Sets a DoH path on the controller; controller secret does not protect this path. |
external-ui | String | Advanced | Advanced | Advanced | Sets the dashboard directory, name, or download URL. The name must be a local relative path; static pages are outside secret authentication, while APIs authenticate separately. |
external-ui-name | String | Advanced | Advanced | Advanced | Sets the dashboard directory, name, or download URL. The name must be a local relative path; static pages are outside secret authentication, while APIs authenticate separately. |
external-ui-url | String | Advanced | Advanced | Advanced | Sets the dashboard directory, name, or download URL. The name must be a local relative path; static pages are outside secret authentication, while APIs authenticate separately. |
find-process-mode | String | Unsupported | Supported | Unsupported | macOS can query process name, path, and UID per connection; always off on iOS/tvOS. Some connections may lack process information. |
geo-auto-update | Boolean | Managed / limited | Managed / limited | Managed / limited | Always off at runtime; Clash manages resource preparation. |
geo-update-interval | Integer | Unsupported | Unsupported | Unsupported | Automatic updates are off; this interval does not enable scheduled updates. |
geodata-loader | String | Managed / limited | Supported | Managed / limited | iOS/tvOS use memconservative; macOS keeps the selection. Precompiled resources bypass source-data loading. |
geodata-mode | Boolean | Managed / limited | Managed / limited | Managed / limited | Selects the GeoIP data mode and requires matching resources; does not bypass platform precompilation requirements. |
geosite-matcher | String | Managed / limited | Managed / limited | Managed / limited | Precompiled GeoSite uses a fixed matcher. iOS/tvOS use precompiled resources; macOS may apply this choice when falling back to source data. |
geox-url.asn | String | Managed / limited | Managed / limited | Managed / limited | Does not trigger automatic downloads in the tunnel; prepare data through Clash resource management. |
geox-url.geoip | String | Managed / limited | Managed / limited | Managed / limited | Does not trigger automatic downloads in the tunnel; prepare data through Clash resource management. |
geox-url.geosite | String | Managed / limited | Managed / limited | Managed / limited | Does not trigger automatic downloads in the tunnel; prepare data through Clash resource management. |
geox-url.mmdb | String | Managed / limited | Managed / limited | Managed / limited | Does not trigger automatic downloads in the tunnel; prepare data through Clash resource management. |
global-client-fingerprint | String | Unsupported | Unsupported | Unsupported | No longer sets a global fingerprint; use client-fingerprint on a supported outbound protocol. |
global-ua | String | Supported | Supported | Supported | Sets the default User-Agent for relevant HTTP requests. |
hosts | Mapping | Supported | Supported | Supported | Sets static domain-to-address mappings. |
ipv6 | Boolean | Managed / limited | Managed / limited | Managed / limited | Affected by the app’s IP Stack settings; DNS IPv6 also requires global IPv6. Tunnel IPv6 capture is a separate setting. |
keep-alive-idle | Integer | Supported | Supported | Supported | Controls connection keep-alive behavior; verify changes with new connections. |
keep-alive-interval | Integer | Supported | Supported | Supported | Controls connection keep-alive behavior; verify changes with new connections. |
log-level | String | Supported | Supported | Supported | Sets logging level. debug also enables controller debugging endpoints; restore a normal level after troubleshooting. |
mode | String | Supported | Supported | Supported | Selects rule, global, or direct outbound mode. |
secret | String | Advanced | Advanced | Advanced | Protects authenticated controller APIs; an empty value requires no password. Does not protect static UI, External DoH, or independent services. |
tcp-concurrent | Boolean | Supported | Supported | Supported | Controls concurrent TCP dialing; verify changes with new connections. |
unified-delay | Boolean | Managed / limited | Managed / limited | Managed / limited | Defaults to true when omitted; an explicit false is preserved. |
allow-lan | Boolean | Managed / limited | Managed / limited | Managed / limited | YAML true is kept only when the app permits LAN sharing; this does not control DNS or controller access globally. |
authentication | List | Advanced | Advanced | Advanced | Sets credentials for applicable local proxy listeners, not DNS or controller credentials. |
bind-address | String | Advanced | Advanced | Advanced | Sets binding or source restrictions for applicable local proxy listeners, not all other services. |
inbound-mptcp | Boolean | Advanced | Advanced | Advanced | Requests the feature for inbound connections; actual use depends on the system and connection negotiation. |
inbound-tfo | Boolean | Advanced | Advanced | Advanced | Requests the feature for inbound connections; actual use depends on the system and connection negotiation. |
interface-name | String | Unsupported | Unsupported | Unsupported | The requested interface is not used; Clash manages the physical outbound interface. |
iptables.bypass | List | Not applicable | Not applicable | Not applicable | Linux iptables setting; no effect on Apple platforms. |
iptables.dns-redirect | Boolean | Not applicable | Not applicable | Not applicable | Linux iptables setting; no effect on Apple platforms. |
iptables.enable | Boolean | Not applicable | Not applicable | Not applicable | Linux iptables setting; no effect on Apple platforms. |
iptables.inbound-interface | String | Not applicable | Not applicable | Not applicable | Linux iptables setting; no effect on Apple platforms. |
lan-allowed-ips | List | Advanced | Advanced | Advanced | Sets binding or source restrictions for applicable local proxy listeners, not all other services. |
lan-disallowed-ips | List | Advanced | Advanced | Advanced | Sets binding or source restrictions for applicable local proxy listeners, not all other services. |
listeners | List | Advanced | Advanced | Advanced | Configures custom listeners or forwarding; use protocol-specific binding and authentication. Availability also depends on system constraints. |
mixed-port | Integer | Advanced | Advanced | Advanced | Sets a local proxy port; access depends on binding, sharing permission, and listener authentication. |
port | Integer | Advanced | Advanced | Advanced | Sets a local proxy port; access depends on binding, sharing permission, and listener authentication. |
redir-port | Integer | Unsupported | Unsupported | Unsupported | No effect; this top-level listening port is not created. |
routing-mark | Integer | Unsupported | Unsupported | Unsupported | No effect; this routing mark is not used on Apple platforms. |
skip-auth-prefixes | List | Advanced | Advanced | Advanced | Skips authentication for the specified source ranges on applicable proxy listeners. |
socks-port | Integer | Advanced | Advanced | Advanced | Sets a local proxy port; access depends on binding, sharing permission, and listener authentication. |
ss-config | String | Advanced | Advanced | Advanced | Configures custom listeners or forwarding; use protocol-specific binding and authentication. Availability also depends on system constraints. |
tproxy-port | Integer | Unsupported | Unsupported | Unsupported | No effect; this top-level listening port is not created. |
tuic-server.alpn | List | Advanced | Advanced | Advanced | Sets TUIC server TLS; certificates/keys may be valid content or readable files. These are not outbound-node settings. |
tuic-server.authentication-timeout | Integer | Advanced | Advanced | Advanced | Sets the relevant TUIC server timeout in milliseconds; zero uses default handling. |
tuic-server.certificate | String | Advanced | Advanced | Advanced | Sets TUIC server TLS; certificates/keys may be valid content or readable files. These are not outbound-node settings. |
tuic-server.congestion-controller | String | Advanced | Advanced | Advanced | Sets TUIC server parameters; effective values depend on defaults, bounds, and negotiation. |
tuic-server.cwnd | Integer | Advanced | Advanced | Advanced | Sets TUIC server parameters; effective values depend on defaults, bounds, and negotiation. |
tuic-server.enable | Boolean | Advanced | Advanced | Advanced | Enables the TUIC server or sets its UDP address, subject to system port and permission constraints. |
tuic-server.listen | String | Advanced | Advanced | Advanced | Enables the TUIC server or sets its UDP address, subject to system port and permission constraints. |
tuic-server.max-idle-time | Integer | Advanced | Advanced | Advanced | Sets the relevant TUIC server timeout in milliseconds; zero uses default handling. |
tuic-server.max-udp-relay-packet-size | Integer | Advanced | Advanced | Advanced | Sets TUIC server parameters; effective values depend on defaults, bounds, and negotiation. |
tuic-server.private-key | String | Advanced | Advanced | Advanced | Sets TUIC server TLS; certificates/keys may be valid content or readable files. These are not outbound-node settings. |
tuic-server.token | List | Advanced | Advanced | Advanced | Sets TUIC server credentials separately from top-level authentication. |
tuic-server.users | Mapping | Advanced | Advanced | Advanced | Sets TUIC server credentials separately from top-level authentication. |
vmess-config | String | Advanced | Advanced | Advanced | Configures custom listeners or forwarding; use protocol-specific binding and authentication. Availability also depends on system constraints. |
ntp.dialer-proxy | String | Managed / limited | Managed / limited | Managed / limited | Configures time synchronization for protocol time offsets; does not change the device clock. |
ntp.enable | Boolean | Managed / limited | Managed / limited | Managed / limited | Configures time synchronization for protocol time offsets; does not change the device clock. |
ntp.interval | Integer | Managed / limited | Managed / limited | Managed / limited | Time synchronization interval in minutes. |
ntp.port | Integer | Managed / limited | Managed / limited | Managed / limited | Configures time synchronization for protocol time offsets; does not change the device clock. |
ntp.server | String | Managed / limited | Managed / limited | Managed / limited | Configures time synchronization for protocol time offsets; does not change the device clock. |
ntp.write-to-system | Boolean | Unsupported | Unsupported | Unsupported | Always false; does not change the device clock. |
profile.store-fake-ip | Boolean | Supported | Supported | Managed / limited | Controls Fake IP cache persistence; defaults to true, false disables it. Requires persistent storage; tvOS cache loss may discard previous mappings. |
profile.store-selected | Boolean | Supported | Supported | Managed / limited | Controls core policy-selection persistence; defaults to true, false disables it. Does not save Profiles; tvOS cache loss may discard previous selections. |
proxies | List | Supported | Supported | Supported | Defines outbounds; consult each protocol for its parameters. Interface names and routing marks are subject to Apple-platform handling. |
proxy-groups | List | Supported | Supported | Supported | Supports select, url-test, fallback, and load-balance. Fallback chooses healthy entries in order; checks depend on lazy settings and system runtime conditions. |
proxy-providers | Mapping | Managed / limited | Managed / limited | Managed / limited | Inline content loads directly; remote resources may be prepared by the app or loaded by the core after startup. Precompiled rule updates may take effect at the next activation. |
rule-providers | Mapping | Managed / limited | Managed / limited | Managed / limited | Inline content loads directly; remote resources may be prepared by the app or loaded by the core after startup. Precompiled rule updates may take effect at the next activation. |
rules | List | Managed / limited | Managed / limited | Managed / limited | Routes traffic by rules. macOS supports process/UID matching; iOS/tvOS cannot reliably identify apps, process patterns may match empty identities, and UID rules have separate removal handling. |
tls.certificate | String | Advanced | Advanced | Advanced | Configures external TLS controller certificates, client authentication, or ECH; used when that service is enabled. |
tls.client-auth-cert | String | Advanced | Advanced | Advanced | Configures external TLS controller certificates, client authentication, or ECH; used when that service is enabled. |
tls.client-auth-type | String | Advanced | Advanced | Advanced | Configures external TLS controller certificates, client authentication, or ECH; used when that service is enabled. |
tls.custom-certifactes | List | Advanced | Advanced | Advanced | Adds certificate content to outbound trust, not a file path. Add only trusted certificates and keep this field’s spelling. |
tls.ech-key | String | Advanced | Advanced | Advanced | Configures external TLS controller certificates, client authentication, or ECH; used when that service is enabled. |
tls.private-key | String | Advanced | Advanced | Advanced | Configures external TLS controller certificates, client authentication, or ECH; used when that service is enabled. |
sniffer.enable | Boolean | Supported | Supported | Supported | Controls sniffing and inclusion/exclusion conditions; use depends on protocol, port, and domain conditions. Does not decrypt all encrypted traffic. |
sniffer.force-dns-mapping | Boolean | Supported | Supported | Supported | Controls sniffing and inclusion/exclusion conditions; use depends on protocol, port, and domain conditions. Does not decrypt all encrypted traffic. |
sniffer.force-domain | List | Supported | Supported | Supported | Controls sniffing and inclusion/exclusion conditions; use depends on protocol, port, and domain conditions. Does not decrypt all encrypted traffic. |
sniffer.override-destination | Boolean | Supported | Supported | Supported | Sets default destination overriding; an explicit per-protocol value in sniff takes precedence. |
sniffer.parse-pure-ip | Boolean | Supported | Supported | Supported | Controls sniffing and inclusion/exclusion conditions; use depends on protocol, port, and domain conditions. Does not decrypt all encrypted traffic. |
sniffer.port-whitelist | List | Managed / limited | Managed / limited | Managed / limited | Legacy syntax, used only when sniff is empty; prefer sniff in new configurations. |
sniffer.skip-domain | List | Supported | Supported | Supported | Controls sniffing and inclusion/exclusion conditions; use depends on protocol, port, and domain conditions. Does not decrypt all encrypted traffic. |
sniffer.skip-dst-address | List | Supported | Supported | Supported | Controls sniffing and inclusion/exclusion conditions; use depends on protocol, port, and domain conditions. Does not decrypt all encrypted traffic. |
sniffer.skip-src-address | List | Supported | Supported | Supported | Controls sniffing and inclusion/exclusion conditions; use depends on protocol, port, and domain conditions. Does not decrypt all encrypted traffic. |
sniffer.sniff | Mapping | Supported | Supported | Supported | Configures ports and destination overriding per protocol; takes precedence over legacy sniffing/port-whitelist. |
sniffer.sniffing | List | Managed / limited | Managed / limited | Managed / limited | Legacy syntax, used only when sniff is empty; prefer sniff in new configurations. |
sub-rules | Mapping | Managed / limited | Managed / limited | Managed / limited | Routes traffic by rules. macOS supports process/UID matching; iOS/tvOS cannot reliably identify apps, process patterns may match empty identities, and UID rules have separate removal handling. |
tun.auto-detect-interface | Boolean | Managed / limited | Managed / limited | Managed / limited | See TUN field guide |
tun.auto-redirect | Boolean | Not applicable | Not applicable | Not applicable | See TUN field guide |
tun.auto-redirect-input-mark | Integer | Not applicable | Not applicable | Not applicable | See TUN field guide |
tun.auto-redirect-iproute2-fallback-rule-index | Integer | Not applicable | Not applicable | Not applicable | See TUN field guide |
tun.auto-redirect-output-mark | Integer | Not applicable | Not applicable | Not applicable | See TUN field guide |
tun.auto-route | Boolean | Managed / limited | Managed / limited | Managed / limited | See TUN field guide |
tun.device | String | Managed / limited | Managed / limited | Managed / limited | See TUN field guide |
tun.disable-icmp-forwarding | Boolean | Managed / limited | Managed / limited | Managed / limited | See TUN field guide |
tun.dns-hijack | List | Managed / limited | Managed / limited | Managed / limited | See TUN field guide |
tun.enable | Boolean | Managed / limited | Managed / limited | Managed / limited | See TUN field guide |
tun.endpoint-independent-nat | Boolean | Unsupported | Unsupported | Unsupported | See TUN field guide |
tun.exclude-dst-port | List | Unsupported | Unsupported | Unsupported | See TUN field guide |
tun.exclude-dst-port-range | List | Unsupported | Unsupported | Unsupported | See TUN field guide |
tun.exclude-interface | List | Unsupported | Unsupported | Unsupported | See TUN field guide |
tun.exclude-mac-address | List | Unsupported | Unsupported | Unsupported | See TUN field guide |
tun.exclude-package | List | Not applicable | Not applicable | Not applicable | See TUN field guide |
tun.exclude-src-port | List | Unsupported | Unsupported | Unsupported | See TUN field guide |
tun.exclude-src-port-range | List | Unsupported | Unsupported | Unsupported | See TUN field guide |
tun.exclude-uid | List | Unsupported | Unsupported | Unsupported | See TUN field guide |
tun.exclude-uid-range | List | Unsupported | Unsupported | Unsupported | See TUN field guide |
tun.file-descriptor | Integer | Managed / limited | Managed / limited | Managed / limited | See TUN field guide |
tun.gso | Boolean | Unsupported | Unsupported | Unsupported | See TUN field guide |
tun.gso-max-size | Integer | Unsupported | Unsupported | Unsupported | See TUN field guide |
tun.icmp-timeout | Integer | Managed / limited | Managed / limited | Managed / limited | See TUN field guide |
tun.include-android-user | List | Not applicable | Not applicable | Not applicable | See TUN field guide |
tun.include-interface | List | Unsupported | Unsupported | Unsupported | See TUN field guide |
tun.include-mac-address | List | Unsupported | Unsupported | Unsupported | See TUN field guide |
tun.include-package | List | Not applicable | Not applicable | Not applicable | See TUN field guide |
tun.include-uid | List | Unsupported | Unsupported | Unsupported | See TUN field guide |
tun.include-uid-range | List | Unsupported | Unsupported | Unsupported | See TUN field guide |
tun.inet4-route-address | List | Managed / limited | Managed / limited | Managed / limited | See TUN field guide |
tun.inet4-route-exclude-address | List | Managed / limited | Managed / limited | Managed / limited | See TUN field guide |
tun.inet6-address | List | Managed / limited | Managed / limited | Managed / limited | See TUN field guide |
tun.inet6-route-address | List | Managed / limited | Managed / limited | Managed / limited | See TUN field guide |
tun.inet6-route-exclude-address | List | Managed / limited | Managed / limited | Managed / limited | See TUN field guide |
tun.iproute2-rule-index | Integer | Not applicable | Not applicable | Not applicable | See TUN field guide |
tun.iproute2-table-index | Integer | Not applicable | Not applicable | Not applicable | See TUN field guide |
tun.loopback-address | List | Managed / limited | Managed / limited | Managed / limited | See TUN field guide |
tun.mtu | Integer | Managed / limited | Managed / limited | Managed / limited | See TUN field guide |
tun.recvmsgx | Boolean | Unsupported | Unsupported | Unsupported | See TUN field guide |
tun.route-address | List | Managed / limited | Managed / limited | Managed / limited | See TUN field guide |
tun.route-address-set | List | Unsupported | Unsupported | Unsupported | See TUN field guide |
tun.route-exclude-address | List | Managed / limited | Managed / limited | Managed / limited | See TUN field guide |
tun.route-exclude-address-set | List | Unsupported | Unsupported | Unsupported | See TUN field guide |
tun.sendmsgx | Boolean | Unsupported | Unsupported | Unsupported | See TUN field guide |
tun.stack | String | Managed / limited | Managed / limited | Managed / limited | See TUN field guide |
tun.strict-route | Boolean | Managed / limited | Managed / limited | Managed / limited | See TUN field guide |
tun.udp-timeout | Integer | Supported | Supported | Supported | See TUN field guide |
tunnels | List | Advanced | Advanced | Advanced | Configures custom listeners or forwarding; use protocol-specific binding and authentication. Availability also depends on system constraints. |
Version notes
This index contains 185 entries. For nested protocol parameters under entries such as proxies and listeners, consult the relevant guide. Some behavior changes between versions; use the features available in your installed version.
Documentation reference version
The 185-entry field matrix was reviewed on 2026-09-14 against Clash Core 5bca0bcb73cd6dcb2d276be31f3a149211388c6d.
The outbound type list and EasyTier guide were checked on 2026-09-24 against snapshot 7ea70d1, revision 7ea70d15bf8b67257928efe45c12f16d4ffc9f61. This protocol update does not re-audit every field in the matrix. Store app versions may include a different SDK; use the features available in your installed version.