Outbound proxies

The proxies list defines nodes. Each entry supplies a protocol and server parameters, referenced by name from groups or rules.

Complete configuration

This complete structure includes DNS, a Trojan node, a selection group, and routing rules. Replace the endpoint and password before importing; example addresses and credentials cannot connect.

mode: rule
log-level: info
dns:
  enable: true
  enhanced-mode: fake-ip
  nameserver:
    - https://1.1.1.1/dns-query
proxies:
  - name: Node
    type: trojan
    server: proxy.example.com
    port: 443
    password: YOUR_PASSWORD
    sni: proxy.example.com
    udp: true
proxy-groups:
  - name: Proxy
    type: select
    proxies: [Node, DIRECT]
rules:
  - MATCH,Proxy

After importing and connecting, select Node in the Proxy group. Append additional nodes to the same proxies list and add their names to the group. Do not create duplicate top-level proxies keys.

Configure by protocol

Each protocol page includes a node example and field explanations. Examples share the name Node; assign unique names when combining them.

The snapshot 7ea70d1 protocol list contains 24 types. EasyTier is available in the macOS SDK; on iOS, iPadOS, and tvOS it is a REJECT placeholder, so importing its YAML does not make it usable.

Protocol	YAML type
HTTP / HTTPS	http
SOCKS5	socks5
Shadowsocks	ss
ShadowsocksR	ssr
Snell	snell
VMess	vmess
VLESS	vless
Trojan	trojan
AnyTLS	anytls
Mieru	mieru
Sudoku	sudoku
Hysteria	hysteria
Hysteria2	hysteria2
TUIC	tuic
ShadowQUIC	shadowquic
GOST Relay	gost-relay
WireGuard	wireguard
Tailscale	tailscale
ZeroTier	zerotier
EasyTier (macOS)	easytier
SSH	ssh
MASQUE	masque
TrustTunnel	trusttunnel
OpenVPN	openvpn

Common fields

Field	Usage
name	Unique node name, referenced exactly by groups and rules
type	Lowercase value from the table, not the display name
server / port	Remote endpoint; Tailscale, ZeroTier, and EasyTier use network-specific settings and multi-peer WireGuard has a separate structure
udp	Enable UDP where supported; HTTP and SSH do not gain UDP support from this flag
ip-version	dual, ipv4, ipv6, ipv4-prefer, or ipv6-prefer for resolved node addresses
dialer-proxy	Node or group used to connect to this node; see chaining
tfo / mptcp	Request TCP Fast Open or multipath TCP, subject to system and connection support
smux	Configure only for services supporting sing-mux; normally leave disabled

Authentication, TLS, and transport options are protocol-specific. Apple versions manage physical egress automatically; node interface-name and routing-mark are not applied.

TLS, transports, and multiplexing

• TLS and certificates: SNI, servername, verification, REALITY, and ECH.
• Transports: WebSocket, gRPC, HTTP/2, XHTTP, and other fragments.
• Chaining: connect one node through another.
• Built-ins: DIRECT, DNS, REJECT, and rematch.

For a service supporting sing-mux, add this node-level fragment with a matching protocol:

smux:
  enabled: true
  protocol: h2mux
  max-connections: 4
  min-streams: 4

Protocol accepts h2mux, smux, or yamux. max-streams is an alternative to max-connections / min-streams; do not configure both approaches. Enable padding only when required. only-tcp: true leaves UDP outside this multiplexing layer.

Check after configuring

Confirm the node connects, the group selects it, and rules reference the correct group. For TLS errors, check certificate names; for timeouts, check the endpoint and transport; for UDP failures, check support on the node and intermediate outbounds.

Providers load nodes, groups choose outbounds, and rules select which connections use them.

1 fields shown

Field	Type	iOS	macOS	tvOS	Platform notes
proxies	List	Supported	Supported	Supported	Defines outbounds; consult each protocol for its parameters. Interface names and routing marks are subject to Apple-platform handling.

Reference: mihomo.