\n \n Transport Settings
\nTransport is for how V2Ray sends and receives data from its peers. The responsibility of a transport is to reliably transfer data to a peer. Usually a connection has matching transports on both endpoints. For example, if a V2Ray outbound uses WebSocket as its transport, the inbound it talks to also has to use WebSocket, otherwise a connection can't be established.
\nThe transport settings devides into two parts: global settings and per proxy settings. Per-proxy settings specifies how each individual proxy handles its data, while global settings is for all proxies. Usually the inbound and outbound proxies between the connecting peer must have the same transport settings. When a proxy has no transport settings, the global settings applies.
\nTransportObject
\nTransportObject is used as transport field in top level configuration.
\n{\n "tcpSettings": {},\n "kcpSettings": {},\n "wsSettings": {},\n "httpSettings": {},\n "dsSettings": {},\n "quicSettings": {}\n}\n
\n\ntcpSettings: TcpObject
\n
\nSettings for TCP transport.
\n\nkcpSettings: KcpObject
\n
\nSettings for mKCP transport.
\n\nwsSettings: WebSocketObject
\n
\nSettings for WebSocket transport.
\n\nhttpSettings: HttpObject
\n
\nSettings for HTTP/2 transport.
\n\ndsSettings: DomainSocketObject
\n
\nSettings for Domain Socket transport.
\n\nquicSettings: QUICObject
\n
\n(V2Ray 4.7+) Settings for QUIC transport.
\nStreamSettingsObject
\nEach inbound and outbound proxy may has its own transport settings, as specified in streamSettings field in top level configuration.
\n{\n "network": "tcp",\n "security": "none",\n "tlsSettings": {},\n "tcpSettings": {},\n "kcpSettings": {},\n "wsSettings": {},\n "httpSettings": {},\n "dsSettings": {},\n "quicSettings": {},\n "sockopt": {\n "mark": 0,\n "tcpFastOpen": false,\n "tproxy": "off"\n }\n}\n
\n\nnetwork: "tcp" | "kcp" | "ws" | "http" | "domainsocket" | "quic"
\n
\nNetwork type of the stream transport. Default value "tcp".
\n\nsecurity: "none" | "tls"
\n
\nType of security. Choices are "none" (default) for no extra security, or "tls" for using TLS.
\n\ntlsSettings: TLSObject
\n
\nTLS settings. TLS is provided by Golang. Support up to TLS 1.2. DTLS is not supported.
\n\ntcpSettings: TcpObject
\n
\nTCP transport configuration for current proxy. Effective only when the proxy uses TCP transport. Configuration is the same as it is in global configuration.
\n\nkcpSettings: KcpObject
\n
\nmKCP transport configuration for current proxy. Effective only when the proxy uses mKCP transport. Configuration is the same as it is in global configuration.
\n\nwsSettings: WebSocketObject
\n
\nWebSocket transport configuration for current proxy. Effective only when the proxy uses WebSocket transport. Configuration is the same as it is in global configuration.
\n\nhttpSettings: HttpObject
\n
\nHTTP/2 transport configuration for current proxy. Effective only when the proxy uses HTTP/2 transport. Configuration is the same as it is in global configuration.
\n\ndsSettings: DomainSocketObject
\n
\nDomain socket transport configuration for current proxy. Effective only when the proxy uses domain socket transport. Configuration is the same as it is in global configuration.
\n\nquicSettings: QUICObject
\n
\n(V2Ray 4.7+) QUIC transport configuration for current proxy. Effective only when the proxy uses QUIC transport. Configuration is the same as it is in global configuration.
\n\nsockopt: SockoptObject
\n
\nSocket options for incoming and out-going connections.
\nTLSObject
\n{\n "serverName": "v2ray.com",\n "allowInsecure": false,\n "alpn": ["http/1.1"],\n "certificates": [],\n "disableSystemRoot": false\n}\n
\n\nserverName: string
\n
\nServer name (usually domain) used for TLS authentication. Typically this is used when corressponding inbound/outbound uses IP for communication.
\nWhen domain name is specified from inbound proxy, or get sniffed from the connection, it will be automatically used for connection. It is not necessary to set serverName in such case.
\n\nalpn: [ string ]
\n
\nAn array of strings, to specifiy the ALPN value in TLS handshake. Default value is ["http/1.1"].
\n\nallowInsecure: true | false
\n
\nIf true, V2Ray allowss insecure connection at TLS client, e.g., TLS server uses unverifiable certificates.
\n\nallowInsecureCiphers: true | false
\n
\nWhehter or not to allow insecure cipher suites. By default TLS only uses cipher suites from TLS 1.3 spec. Turn on this option to allow cipher suites with static RSA keys.
\n\ndisableSystemRoot: true | false
\n
\n(V2Ray 4.18+) Whether or not to disable system root CAs for TLS handshake. Default value is false. If set to true, V2Ray will use only certificates for TLS handshake.
\n\ncertificates: [ CertificateObject ]
\n
\nList of TLS certificates. Each entry is one certificate.
\nCertificateObject
\n{\n "usage": "encipherment",\n\n "certificateFile": "/path/to/certificate.crt",\n "keyFile": "/path/to/key.key",\n\n "certificate": [\n "-----BEGIN CERTIFICATE-----",\n "MIICwDCCAaigAwIBAgIRAO16JMdESAuHidFYJAR/7kAwDQYJKoZIhvcNAQELBQAw",\n "ADAeFw0xODA0MTAxMzU1MTdaFw0xODA0MTAxNTU1MTdaMAAwggEiMA0GCSqGSIb3",\n "DQEBAQUAA4IBDwAwggEKAoIBAQCs2PX0fFSCjOemmdm9UbOvcLctF94Ox4BpSfJ+",\n "3lJHwZbvnOFuo56WhQJWrclKoImp/c9veL1J4Bbtam3sW3APkZVEK9UxRQ57HQuw",\n "OzhV0FD20/0YELou85TwnkTw5l9GVCXT02NG+pGlYsFrxesUHpojdl8tIcn113M5",\n "pypgDPVmPeeORRf7nseMC6GhvXYM4txJPyenohwegl8DZ6OE5FkSVR5wFQtAhbON",\n "OAkIVVmw002K2J6pitPuJGOka9PxcCVWhko/W+JCGapcC7O74palwBUuXE1iH+Jp",\n "noPjGp4qE2ognW3WH/sgQ+rvo20eXb9Um1steaYY8xlxgBsXAgMBAAGjNTAzMA4G",\n "A1UdDwEB/wQEAwIFoDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAA",\n "MA0GCSqGSIb3DQEBCwUAA4IBAQBUd9sGKYemzwPnxtw/vzkV8Q32NILEMlPVqeJU",\n "7UxVgIODBV6A1b3tOUoktuhmgSSaQxjhYbFAVTD+LUglMUCxNbj56luBRlLLQWo+",\n "9BUhC/ow393tLmqKcB59qNcwbZER6XT5POYwcaKM75QVqhCJVHJNb1zSEE7Co7iO",\n "6wIan3lFyjBfYlBEz5vyRWQNIwKfdh5cK1yAu13xGENwmtlSTHiwbjBLXfk+0A/8",\n "r/2s+sCYUkGZHhj8xY7bJ1zg0FRalP5LrqY+r6BckT1QPDIQKYy615j1LpOtwZe/",\n "d4q7MD/dkzRDsch7t2cIjM/PYeMuzh87admSyL6hdtK0Nm/Q",\n "-----END CERTIFICATE-----"\n ],\n "key": [\n "-----BEGIN RSA PRIVATE KEY-----",\n "MIIEowIBAAKCAQEArNj19HxUgoznppnZvVGzr3C3LRfeDseAaUnyft5SR8GW75zh",\n "bqOeloUCVq3JSqCJqf3Pb3i9SeAW7Wpt7FtwD5GVRCvVMUUOex0LsDs4VdBQ9tP9",\n "GBC6LvOU8J5E8OZfRlQl09NjRvqRpWLBa8XrFB6aI3ZfLSHJ9ddzOacqYAz1Zj3n",\n "jkUX+57HjAuhob12DOLcST8np6IcHoJfA2ejhORZElUecBULQIWzjTgJCFVZsNNN",\n "itieqYrT7iRjpGvT8XAlVoZKP1viQhmqXAuzu+KWpcAVLlxNYh/iaZ6D4xqeKhNq",\n "IJ1t1h/7IEPq76NtHl2/VJtbLXmmGPMZcYAbFwIDAQABAoIBAFCgG4phfGIxK9Uw",\n "qrp+o9xQLYGhQnmOYb27OpwnRCYojSlT+mvLcqwvevnHsr9WxyA+PkZ3AYS2PLue",\n "C4xW0pzQgdn8wENtPOX8lHkuBocw1rNsCwDwvIguIuliSjI8o3CAy+xVDFgNhWap",\n "/CMzfQYziB7GlnrM6hH838iiy0dlv4I/HKk+3/YlSYQEvnFokTf7HxbDDmznkJTM",\n "aPKZ5qbnV+4AcQfcLYJ8QE0ViJ8dVZ7RLwIf7+SG0b0bqloti4+oQXqGtiESUwEW",\n "/Wzi7oyCbFJoPsFWp1P5+wD7jAGpAd9lPIwPahdr1wl6VwIx9W0XYjoZn71AEaw4",\n "bK4xUXECgYEA3g2o9WqyrhYSax3pGEdvV2qN0VQhw7Xe+jyy98CELOO2DNbB9QNJ",\n "8cSSU/PjkxQlgbOJc8DEprdMldN5xI/srlsbQWCj72wXxXnVnh991bI2clwt7oYi",\n "pcGZwzCrJyFL+QaZmYzLxkxYl1tCiiuqLm+EkjxCWKTX/kKEFb6rtnMCgYEAx0WR",\n "L8Uue3lXxhXRdBS5QRTBNklkSxtU+2yyXRpvFa7Qam+GghJs5RKfJ9lTvjfM/PxG",\n "3vhuBliWQOKQbm1ZGLbgGBM505EOP7DikUmH/kzKxIeRo4l64mioKdDwK/4CZtS7",\n "az0Lq3eS6bq11qL4mEdE6Gn/Y+sqB83GHZYju80CgYABFm4KbbBcW+1RKv9WSBtK",\n "gVIagV/89moWLa/uuLmtApyEqZSfn5mAHqdc0+f8c2/Pl9KHh50u99zfKv8AsHfH",\n "TtjuVAvZg10GcZdTQ/I41ruficYL0gpfZ3haVWWxNl+J47di4iapXPxeGWtVA+u8",\n "eH1cvgDRMFWCgE7nUFzE8wKBgGndUomfZtdgGrp4ouLZk6W4ogD2MpsYNSixkXyW",\n "64cIbV7uSvZVVZbJMtaXxb6bpIKOgBQ6xTEH5SMpenPAEgJoPVts816rhHdfwK5Q",\n "8zetklegckYAZtFbqmM0xjOI6bu5rqwFLWr1xo33jF0wDYPQ8RHMJkruB1FIB8V2",\n "GxvNAoGBAM4g2z8NTPMqX+8IBGkGgqmcYuRQxd3cs7LOSEjF9hPy1it2ZFe/yUKq",\n "ePa2E8osffK5LBkFzhyQb0WrGC9ijM9E6rv10gyuNjlwXdFJcdqVamxwPUBtxRJR",\n "cYTY2HRkJXDdtT0Bkc3josE6UUDvwMpO0CfAETQPto1tjNEDhQhT",\n "-----END RSA PRIVATE KEY-----"\n ]\n}\n
\n\nusage: "encipherment" | "verify" | "issue"
\n
\nPurpose of the certificate. Default value "encipherment". Choices are:
\n\n"encipherment": Certificate is used for TLS authentication and encryption."verify": Certificate is used for validating TLS certificates from remote peer. In this case, the certificate has to be a CA certificate."issue": Certificate is used for issuing other certificates. In this case, the certificate has to be a CA certificate.
\n
On Windows, you have to install your CA certificate to system, in order to verify cerificates issued from the CA.
\n
When there is a new client request, say for serverName = "v2ray.com", V2Ray will find a certificate for "v2ray.com" first. If not found, V2Ray will try to issue a new certificate using any existing certificate whose usage is "issue" for "v2ray.com". The new certificate expires in one hour, and will be added to certificate pool for later reuse.
\n
\ncertificateFile: string
\n
\nFile path to the certificate. If the certificate is generated by OpenSSL, the path ends with ".crt".
\n
Use v2ctl cert -ca command to generate a new CA certificate.
\n
\ncertificate: [ string ]
\n
\nList of strings as content of the certificate. See the example above. Either certificate or certificateFile must not be empty.
\n\nkeyFile: string
\n
\nFile path to the private key. If generated by OpenSSL, the file usually ends with ".key". Key file with password is not supported.
\n\nkey: [ string ]
\n
\nList of strings as content of the private key. See the example above. Either key or keyFile must not be empty.
\nWhen certificateFile and certificate are both filled in. V2Ray uses certificateFile. Same for keyFile and key.
\n
When usage is "verify", both keyFile and key can be empty.
\n
SockoptObject
\n{\n "mark": 0,\n "tcpFastOpen": false,\n "tproxy": "off"\n}\n
\n\nmark: number
\n
\nAn integer. If non-zero, the value will be set to out-going connections via socket option SO_MARK. This mechanism only applies on Linux and requires CAP_NET_ADMIN permission.
\n\ntcpFastOpen: true | false
\n
\nWhether or not to enable TCP Fast Open. When set to true, V2Ray enables TFO for current connection. When set to false, V2Ray disables TFO. If this entry doesn't exist, V2Ray uses default settings from operating system.
\n\n- Only apply on the following operating systems:
\n- Windows 10 (1604) or later
\n- Mac OS 10.11 / iOS 9 or later
\n- Linux 3.16 or later: Enabled by system default.
\n
\n \n- Applicable for both inbound and outbound connections.
\n
\n\ntproxy: "redirect" | "tproxy" | "off"
\n
\nWhether or not to enable transparent proxy on Linux. Choices are:
\n\n"off": Default value. Not enable TProxy at all."redirect": Enable TProxy with Redirect mode. Supports TCP/IPv4 and UDP traffic."tproxy": Enable TProxy with TProxy mode. Supports TCP and UDP traffic.
\nTransparent proxy requires Root or CAP_NET_ADMIN permission.
\n
If TProxy is not set, and allowRedirect is set in dokodemo-door, the value of TProxy will be set to "redirect" automatically.
\n
![\"Chinese\"](\"/resources/flag_cn.svg\")
\n ![\"English\"](\"/resources/flag_en.svg\")
\n ![\"Russian\"](\"/resources/flag_ru.svg\")
\n ![\"Korean\"](\"/resources/flag_ko.svg\")
\n ![\"Persian\"](\"/resources/flag_fa.svg\")
\n ![\"Vietnamese\"](\"/resources/flag_vi.svg\")
\n ![\"Translate\"](\"/resources/translate.png\")
\n ![](\"../resources/win.svg\")
![](\"../resources/apple.svg\")
![](\"../resources/linux.svg\")
![](\"../resources/ios.svg\")
![](\"../resources/android.svg\")
![\"\"](\"../resources/dns_flowchart.svg\")
![\"Architecture\"](\"../../resources/arch.svg\")
![](\"resources/v2ray_1024.png\")
![\"v2net\"](\"resources/v2net.png\")