{"stringValue":"This is a string.","numberValue":42,"boolValue":true,"arrayValue":["this","is","a","string","array"],"objectValue":{"another":"object"}}
================================================
FILE: chapter_02/protocols/dns.html
================================================
DNS · Project V 官方网站
DNS
名称: dns
类型: 出站协议
DNS 是一个出站协议,主要用于拦截和转发 DNS 查询。此出站协议只能接收 DNS 流量(包含基于 UDP 和 TCP 协议的查询),其它类型的流量会导致错误。
在处理 DNS 查询时,此出站协议会将 IP 查询(即 A 和 AAAA)转发给内置的 DNS 服务器。其它类型的查询流量将被转发至它们原本的目标地址。
DNS 出站协议在 V2Ray 4.15 中引入。
OutboundConfigurationObject
{"network":"tcp","address":"1.1.1.1","port":53}
network: "tcp" | "udp"
(V2Ray 4.16+) 修改 DNS 流量的传输层协议,可选的值有"tcp"和"udp"。当不指定时,保持来源的传输方式不变。
address: address
(V2Ray 4.16+) 修改 DNS 服务器地址。当不指定时,保持来源中指定的地址不变。
port: number
(V2Ray 4.16+) 修改 DNS 服务器端口。当不指定时,保持来源中指定的端口不变。
================================================
FILE: chapter_02/protocols/dokodemo.html
================================================
Dokodemo · Project V 官方网站
{"version":"1.1","method":"GET","path":["/"],"headers":{"Host":["www.baidu.com","www.bing.com"],"User-Agent":["Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36","Mozilla/5.0 (iPhone; CPU iPhone OS 10_0_2 like Mac OS X) AppleWebKit/601.1 (KHTML, like Gecko) CriOS/53.0.2785.109 Mobile/14A456 Safari/601.1.46"],"Accept-Encoding":["gzip, deflate"],"Connection":["keep-alive"],"Pragma":"no-cache"}}
客户端在收到动态端口指令时,服务器已开放新的端口用于通信,这时客户端可以将数据发往新的端口。在 T 分钟之后,这个端口将失效,客户端必须重新使用主端口进行通信。
注释
为确保向前兼容性,所有保留字段的值必须为 0。
================================================
FILE: en/awesome/ads.html
================================================
With Ads · Project V Official
Some Advertisement
The following online services may help you better use Project V. These services are provided by third party. They are not directly releated to Project V.
================================================
FILE: en/awesome/tools.html
================================================
Awesome V · Project V Official
Kitsunebi is an iOS app based on V2Ray. It provides full functionality as V2Ray. It also supports importing and exporting V2Ray compatible JSON configuration.
================================================
FILE: en/configuration/api.html
================================================
API · Project V Official
API
V2Ray provides some API for remote access. These APIs are based on gRPC.
When API is enabled, V2Ray creates an outbound proxy automatically, tagged as tag. User must route all gRPC connections to this outbound.
ApiObject
ApiObject is used as api field in top level configuration.
================================================
FILE: en/configuration/dns.html
================================================
DNS · Project V Official
DNS
V2Ray has an internal DNS server which provides DNS relay for other components.
Due to the complexity of DNS protocol, V2Ray for now only supports basic IP queries (A and AAAA). We recommend to use a professional DNS rely (such as CoreDNS) for V2Ray.
The DNS queries relayed by this DNS service will also be dispatched based on routing settings. No extra configuration is required.
DnsObject
DnsObject is used as dns field in top level configuration.
A list of static addresses, in the form of domain:address. Each entry has a domain name as key and IP or domain address as value. If a DNS query targets one of the domains in this list, the corresponding IP will be returned immediately and DNS query will not be relayed, or the corresponding domain address will be used for further DNS queries, instead of the previous one.
The format of domains is:
Plaintext: When the targeting domain is exactly the value, the rule takes effect. Example: rule "v2ray.com" matches "v2ray.com", but not "www.v2ray.com".
Regular expression: Begining with "regexp:", the rest is a regular expression. When the regexp matches targeting domain, this rule takes effect. Example: rule "regexp:\\.goo.*\\.com$" matches "www.google.com" and "fonts.googleapis.com", but not "google.com".
Subdomain (recommended): Begining with "domain:" and the rest is a domain. When the targeting domain is exactly the value, or is a subdomain of the value, this rule takes effect. Example: rule "domain:v2ray.com" matches "www.v2ray.com", "v2ray.com", but not "xv2ray.com".
Keyword: Begining with "keyword:" and the rest is a pattern. If this string matches any part of the targeting domain, this rule takes effet. Example: rule "keyword:sina.com" matches targeting domain "sina.com", "sina.com.cn" and "www.sina.com", but not "sina.cn".
Pre-defined domain list: Begining with "geosite:" and the rest is a name, such as geosite:google or geosite:cn. See Pre-defined domain list for more detail.
List of DNS servers. Each server may be specified in three formats: IP address, ServerObject, or "localhost".
When a server is an IP address, such as "8.8.8.8", V2Ray queries DNS on UDP port 53 on this address.
When a server is "localhost", V2Ray queries local host for DNS.
When "localhost" is used, out-going DNS traffic is not controlled by V2Ray. However, you may redirect DNS queries back to V2Ray with additional configuration.
clientIp: string
IP address of current machine. If specified, V2Ray uses this IP as EDNS-Client-Subnet. This IP can't be a private address.
tag: string
(V2Ray 4.13+) All traffic initiated from this DNS, except to localhost, will have this tag as inbound. It can be used for routing.
When a DNS server has the domain in its domain list, the domain will be queried in this server first, and then other servers. Otherwise DNS queries are sent to DNS servers in the order they appear in the config file.
================================================
FILE: en/configuration/env.html
================================================
Env Variables · Project V Official
Environment Variables
V2Ray reads the following environment variables.
Cache size per connection
Name: v2ray.ray.buffer.size or V2RAY_RAY_BUFFER_SIZE
Unit: MBytes
Default value: 2 on x86, amd64, arm64 and s390x. This cache is disabled on other platforms.
Special value: 0 for unlimited cache size
Deprecated. Use bufferSize in Policy.
For each connection, when there is a difference in speed between inbound and outbound traffic, V2Ray will cache some data for larger throughput. This setting controls the size of the cache. The larger the cache, the better the performance.
Location of V2Ray asset
Name: v2ray.location.asset or V2RAY_LOCATION_ASSET
Default value: Same directory where v2ray is.
This variable specifies a directory where geoip.dat and geosite.dat files are.
Location of V2Ray config
Name: v2ray.location.config or V2RAY_LOCATION_CONFIG
Default value: Same directory where v2ray is.
This variable specifies a directory where config.json is.
Scatter Reading
Name: v2ray.buf.readv or V2RAY_BUF_READV
Default value: auto
V2Ray 3.37 uses Scatter/Gather IO. This feature will use less memory when connection speed is over 100 MByte/s. Possible values are: auto, enable and disable.
enable: Enable scatter reading.
disable: Disable scatter reading.
auto: Only enable on Windows, MacOS, Linux when CPU is x86, AMD64 or s390x.
When connection speed is less than 100 MByte/s, no matter whether this is enabled or not, there is no obvious difference in terms of memory usage.
================================================
FILE: en/configuration/index.html
================================================
Configuration · Project V Official
Configuration
V2Ray uses protobuf-based configuration. As protobuf format is less readable, V2Ray also supports configuration in JSON. Before V2Ray runs, it automatically converts JSON config into protobuf. That being said, other configuration formats may be introduced in the furture.
Here we introduce the JSON-based configuration.
JSON, or JavaScript Object Notation, in short is objects in Javascript. One JSON file contains one and only one JSON object, beginning with "{" and ending with "}".
A JSON object contains a list of key value pairs. A key is a string, and a value may be various of types, such as string, number, boolean, array or another object. A typical object is like below:
{"stringValue":"This is a string.","numberValue":42,"boolValue":true,"arrayValue":["this","is","a","string","array"],"objectValue":{"another":"object"}}
V2Ray supports comments in JSON,annotated by "//" or "/* */". In an editor that doesn't support comments, they may get displayed as errors, but comments actually work fine in V2Ray.
JSON Data Types
Here is a brief introduction of JSON data types. They will be referenced in the rest of docs.
boolean: true | false
Boolean value, has to be either true or false, without quotation mark.
number
Usually non-negative integers, without quotation mark.
string
Sequence of characters, surrounded by quotation mark.
array: []
Array of elements. The type of its elements is usually the same, e.g., [string] is an array of strings.
object: {}
Object. It comes with a list of key value pairs.
A key value pair usually ends with a comma ",", but must not ends with a comma if it is the last element of the object.
V2Ray Common Data Types
map: object {string, string}
An object whose keys and values have fixed types.
address: string
An IP or domain address in string form, such as "8.8.8.8" or "www.v2ray.com"
address_port: string
An address with port, such as "8.8.8.8:53" or "www.v2ray.com:80". In some usages, the address part can be omitted, like ":443".
================================================
FILE: en/configuration/mux.html
================================================
Mux · Project V Official
Multiplexing
Multiplexing, or Mux, is to use one physical TCP connections for multiple virtual TCP connections.
Mux is designed to reduce TCP handshake latency. It is NOT for high throughput. When used for downloading large files or speed measurement, Mux is usually slower than a normal TCP connection.
MuxObject
{"enabled":false,"concurrency":8}
enabled: true | false
Whether or not to enable Mux on an outbound.
concurrency: number
Max number of multiplexed connections that one physical connection can handle at a time. Max value 1024, min value 1, default 8.
================================================
FILE: en/configuration/overview.html
================================================
Overview · Project V Official
Configuration Overview
V2Ray shares a same structure of configuration between server side and client side shown as below. Server and client configurations are different in specific sections.
Below is the top level structure of the configuration. Each section has its own format.
Configuration for internal DNS server's configurations. If this section is omitted, V2Ray will use your system-wide DNS configuration. For details, see DNS Configurations.
An array of OutboundObject as configuration for outbound proxies. The first outbound in the array is the main one. It is the default outbound in routing decision.
Path to access log. If not empty, it must be a legal file path, such as "/tmp/v2ray/_access.log"(Linux), or "C:\\Temp\\v2ray\\_access.log"(Windows). If empty, V2Ray writes access log to stdout.
error: string
Path to error log. If not empty, it must be a legal file path. If empty, V2Ray writes error log to stdout.
Level of logs to be written. Different log levels indicate different content of logs. Default value is "warning".
Log levels:
"debug": Information for developers only. Also includes all "info" logs.
"info": Information for current state of V2Ray. Users don't have to take care of those. Also includes all "warning" logs.
"warning": Something wrong with the environment, usually outside of V2Ray, e.g., network breakage. V2Ray still runs, but users may experience some breakages. Also includes all "error" logs.
"error": Something severely wrong, that V2Ray can't run at all.
"none": All logging are disabled.
InboundObject
An InboundObject defines an inbound proxy. It handles incoming connections to V2Ray. Available proxies are listed here.
Port that the proxy is listening on. Acceptable formats are:
Integer: actual port number.
Environment variable: Beginning with "env:", an env variable specifies the port in string format, such as "env:PORT". V2Ray will decode the variable as string.
String: A numberic string value, such as "1234", or a range of ports, such as "5-10" for 6 ports in total.
The actual ports to open also depend on allocate setting. See below.
listen: address
The address to be listened on. Default value is "0.0.0.0" for incoming connections on all network interfaces. Otherwise the value has to be the address of an existing network interface.
protocol: string
Name of the inbound protocol. See each individual for available values.
settings: InboundConfigurationObject
Protocol-specific settings. See InboundConfigurationObject defined in each protocol.
An array of content type. If the content type of incoming traffic is specified in the list, the destination of the connection will be overwritten by sniffed value.
AllocateObject
{"strategy":"always","refresh":5,"concurrency":3}
strategy: "always" | "random"
Strategy of port allocation. When it is set to "always", all port in the port field will be allocated for listening. If "random" is set, V2Ray will listen on number of concurrency ports, and the list of ports are refereshed every refresh minutes.
refresh: number
Number of minutes to refresh the ports of listening. Min value is 2. This setting is only effective when strategy is set to "random".
concurrency: number
Number of ports to listen. Min value is 1. Max value is one third of entire port range.
OutboundObject
An OutboundObject defines an outbound proxy for handling out-going connections. Available protocols are listed here.
An IP address for sending traffic out. The default value, "0.0.0.0" is for randomly choosing an IP available on the host. Otherwise the value has to be an IP address from existing network interfaces.
protocol: string
The protocol name of this outbound. See Protocols for all available values.
settings: OutboundConfigurationObject
Protocol-specific settings. See OutboundConfigurationObject in each individual protocols.
tag: string
The tag of this outbound. If not empty, it must be unique among all outbounds.
When tag is set to the tag of another outbound, the out-going traffic of current outbound will be delegated to the specified one.
================================================
FILE: en/configuration/policy.html
================================================
Policy · Project V Official
Local Policy
Local policy manages policy settings of current V2Ray instance, such as connection timeouts. The policys can be applied to each user level, or the whole system.
PolicyObject
PolicyObject is used as policy field in top level configuration.
Timeout for establishing a connection, in seconds. Default value 4. At the handshake stage of an inbound proxy dealing with a new connection, say VMess reading request header, if it takes longer than handshake time, V2Ray aborts the connection.
connIdle: number
Timeout for idle connections, in seconds. Default value 300. If there is no data passed through the connection in connIdle time, V2Ray aborts the conneciton.
uplinkOnly: number
Time for keeping connections open after the uplink of the connection is closed, in seconds. Default value 2. After remote (server) closes the downlink of the connection, V2Ray aborts the connection after uplinkOnly times.
downlinkOnly: number
Time for keeping connections open after the downlink of the connection is closed, in seconds. Default value 5. After client (browser) closes the uplink of the connection, V2Ray aborts the connection after downlinkOnly time.
In a simple webpage browser scenario, it is safe to set uplinkOnly and downlinkOnly both to 0, for better performance.
statsUserUplink: true | false
When set to true, V2Ray enables stat counter to uplink traffic for all users in this level.
statsUserDownlink: true | false
When set to true, V2Ray enables stat counter to downlink traffic for all users in this level.
bufferSize: number
Size of internal buffer per connection, in kilo-bytes. Default value is 10240. When it is set to 0, the internal buffer is disabled.
Default value (V2Ray 4.4+):
0 on ARM, MIPS and MIPSLE.
4 on ARM64, MIPS64 and MIPS64LE.
512 on other platforms.
Default value (V2Ray 4.3-):
16 on ARM, ARM64, MIPS, MIPS64, MIPSLE and MIPS64LE.
2048 on other platforms.
bufferSize overrides v2ray.ray.buffer.size settings in env variables.
When set to true, V2Ray enables stat counter for all uplink traffic in all inbound proxies.
statsInboundDownlink: true | false
When set to true, V2Ray enables stat counter for all downlink traffic in all inbound proxies.
================================================
FILE: en/configuration/protocols/blackhole.html
================================================
Blackhole · Project V Official
Blackhole
Name: blackhole
Type: Outbound
Blackhole is a protocol for outbound connections. It blocks all connections with pre-defined responses. Combined with Routing, this can be used for blocking access to some websites.
Pre-defined response. Blockhole will send (if any) pre-defined data immediately for any connection passed to it and close the connection.
ResponseObject
{"type":"none"}
type: "none" | "http"
Type of the response, available options are:
"none": Default value. Empty response.
"http": A valid HTTP 403 response.
================================================
FILE: en/configuration/protocols/dns.html
================================================
DNS · Project V Official
DNS
Name: dns
Type: Outbound
DNS is an outbound proxy. It is mainly used for intercept and proxy DNS queries and responses. This outbound proxy can only accept DNS traffic, including both TCP and UDP based DNS queries. Other type of traffic will result in errors.
When proxying DNS queries, DNS outbound will redirect IP queries (A and AAAA) to internal DNS server. It will send other type of queries directly to its original destination.
DNS outbound proxy is introduced in V2Ray 4.15.
OutboundConfigurationObject
{"network":"tcp","address":"1.1.1.1","port":53}
network: "tcp" | "udp"
(V2Ray 4.16+) Modify the transport protocol of the DNS traffic. The value may be either "tcp" or "udp". If it is not specified, the original protocol remains unchanged.
address: address
(V2Ray 4.16+) Modify the DNS server address in the request. If it is not specified, the original DNS server address remain unchanged.
port: number
(V2Ray 4.16+) Modify the DNS server port in the request. If it is not specified, the original DNS server port remain unchanged.
================================================
FILE: en/configuration/protocols/dokodemo.html
================================================
Dokodemo · Project V Official
Dokodemo-door
Name: dokodemo-door
Type: Inbound
Dokodemo-door is a protocol for inbound connections. It take any connections and passes them to the specified destination.
Dokodemo-door can also (if configured) work as a transparent proxy.
# Create new chain
iptables -t nat -N V2RAY
iptables -t mangle -N V2RAY
iptables -t mangle -N V2RAY_MARK
# Ignore your V2Ray server's addresses# It's very IMPORTANT, just be careful.
iptables -t nat -A V2RAY -d 123.123.123.123 -j RETURN
# Ignore LANs and any other addresses you'd like to bypass the proxy# See Wikipedia and RFC5735 for full list of reserved networks.
iptables -t nat -A V2RAY -d 0.0.0.0/8 -j RETURN
iptables -t nat -A V2RAY -d 10.0.0.0/8 -j RETURN
iptables -t nat -A V2RAY -d 127.0.0.0/8 -j RETURN
iptables -t nat -A V2RAY -d 169.254.0.0/16 -j RETURN
iptables -t nat -A V2RAY -d 172.16.0.0/12 -j RETURN
iptables -t nat -A V2RAY -d 192.168.0.0/16 -j RETURN
iptables -t nat -A V2RAY -d 224.0.0.0/4 -j RETURN
iptables -t nat -A V2RAY -d 240.0.0.0/4 -j RETURN
# Anything else should be redirected to Dokodemo-door's local port
iptables -t nat -A V2RAY -p tcp -j REDIRECT --to-ports 12345# Add any UDP rulesip route addlocal default dev lo table 100ip rule add fwmark 1 lookup 100
iptables -t mangle -A V2RAY -p udp --dport 53 -j TPROXY --on-port 12345 --tproxy-mark 0x01/0x01
iptables -t mangle -A V2RAY_MARK -p udp --dport 53 -j MARK --set-mark 1# Apply the rules
iptables -t nat -A OUTPUT -p tcp -j V2RAY
iptables -t mangle -A PREROUTING -j V2RAY
iptables -t mangle -A OUTPUT -j V2RAY_MARK
================================================
FILE: en/configuration/protocols/freedom.html
================================================
Freedom · Project V Official
Freedom
Name: freedom
Type: Outbound
Freedom is a protocol for outbound connections. It passes all TCP or UDP connection to their destinations. This outbound is used when you want to send traffic to its real destination.
"AsIs": Default value. Resolve domain name by system.
"UseIP": Use internal DNS for domain name resolution.
"UseIPv4": Use IPv4 address only, after resolved by internal DNS.
"UseIPv6": Use IPv6 address only, after resolved by internal DNS.
(V2Ray 4.6+) In UseIP mode, when sendThrough is specified in OutboundObject, Freedom will automatically choose between IPv4 and IPv6 address for destination based on sendThrough settings.
(V2Ray 4.7+) If sendThrough address conflicts with "UseIPv4" or "UseIPv6", Freedom will fail to dial out-going connections.
redirect: address_port
Redirect all connections to this address, in form like "127.0.0.1:80" or ":1234".
When address is empty, e.g. ":443", Freedom will use the original destination address.
When port is 0, e.g. "v2ray.com:0", Freedom will use the original port.
userLevel: number
User level. All connections share this level.
================================================
FILE: en/configuration/protocols/http.html
================================================
HTTP · Project V Official
HTTP
Name: http
Type: Inbound
HTTP is a protocol for inbound connections. It is compatible with HTTP/1.1.
An array in which each entry is an account. It is empty by default. If not empty, HTTP Basic Authentication is required for incoming requests.
allowTransparent: true | false
If set to true, all HTTP request sent to this inbound will be proxied, including non-proxy request.
userLevel: number
User level. All connections share this level.
AccountObject
{"user":"my-username","pass":"my-password"}
user: string
Username for HTTP authentication.
pass: string
password for HTTP authentication.
Use the following settings in Linux to use HTTP proxy in current session.
export http_proxy=http://127.0.0.1:8080/ (URL has to change according to your config)
export https_proxy=$http_proxy
================================================
FILE: en/configuration/protocols/mtproto.html
================================================
MTProto · Project V Official
MTProto
Name: mtproto
Type: Inbound / Outbound
MTProto proxy is a special procol for Telegram. It consists of a pair of inbound and outboud proxies in V2Ray. They are usually used together for building a proxy for Telegram
For now V2Ray only supports IPv4 address of Telegram server.
User email. Used for tracking purposes. See Stats.
level: number
User level.
secret: string
User secret. In Telegram, user secret must be 32 characters long, and only contains characters between 0 to 9, and ato f.
You may use the following command to generate MTProto secret: openssl rand -hex 16
Outbound configuration
{}
Sample
MTProto can only be used for Telegram traffic. You may need a routing rule to combine the corresponding inbound and outbound. Here is an incomplete sample.
The configure your Telegram app to connect to 443 port on this machine.
================================================
FILE: en/configuration/protocols/shadowsocks.html
================================================
Shadowsocks · Project V Official
Shadowsocks
Name: shadowsocks
Type: Inbound / Outbound
Shadowsocks protocol, for both inbound and outbound connections.
Compatibility with official version:
Supports both TCP and UDP connections, where UDP can be optional turned off.
Required. Password in Shadowsocks protocol. Can be any string.
ota: true | false
Whether or not to use OTA. Default value is false.
When AEAD encryption is used, this field has no effect.
level: number
User level.
Encryption methods
"aes-256-cfb"
"aes-128-cfb"
"chacha20"
"chacha20-ietf"
"aes-256-gcm"
"aes-128-gcm"
"chacha20-poly1305" or "chacha20-ietf-poly1305"
================================================
FILE: en/configuration/protocols/socks.html
================================================
SOCKS · Project V Official
Socks
Name: socks
Type: Inbound / Outbound
Socks is an implementation of standard SOCKS protocol, compatible with Socks 4, Socks 4a and Socks 5.
Socks configuration consists of two parts, InboundConfigurationObject and OutboundConfigurationObject, for inbound and outbound respectively.
OutboundConfigurationObject
OutboundConfigurationObject is used as settings field in OutboundObject in top level configuration.
An array of users. Each element in the array is an user. If the list is not empty. Socks inbound will force user authentication. Otherwise, anonymous user is allowed.
UserObject
{"user":"test user","pass":"test pass","level":0}
user: string
Username as in Socks protocol
pass: string
Password as in Socks protocol
level: number
User level for tracking and policy purpose. Default value is 0.
Socks autentication method. "noauth" is for anonymous authentication, and "password" for authentication with username and password. Default value is "noauth".
An array of user accounts, for authenication purpose. Only take effect when auth is set to "password".
udp: true | false
Whether or not to enable UDP. Default value is false.
ip: address
When UDP is enabled, V2Ray needs to know the IP address of current host. Default value is "127.0.0.1". This must be set to the public IP address of the host, if you want to allow public UDP traffic.
userLevel: number
User level. All incoming connections share this user level.
AccountObject
{"user":"my-username","pass":"my-password"}
user: string
Username as in Socks protocol
pass: string
Password as in Socks protocol
================================================
FILE: en/configuration/protocols/vmess.html
================================================
VMess · Project V Official
VMess
Name: vmess
Type: Inbound / Outbound
VMess is a protocol for encrypted communications. It includes both inbound and outbound proxy.
VMess depends on system time. Please ensure that your system time is in sync with UTC time. Timezone doesn't matter. One may install ntp service on Linux to automatically adjust system time.
Number of alternative IDs. The alternative IDs will be generated in a deterministic way. Default to 0. Maximum 65535. Recommend 4. Its value must be not larger than the one in corresponding Inbound.
Method for encrypting payload. This setting is only available at outbound. The VMess inbound will automatically recognize this setting and decrypt payload accordingly. Options are:
"aes-128-gcm": Recommended for PC.
"chacha20-poly1305": Recommended for mobile.
"auto": Default value. Use aes-128-gcm on AMD64, ARM64 and S390x, or chacha20-poly1305 otherwise.
"none": Traffic is not encrypted at all.
Use "auto" wherever possible for better compatibility.
Optional default client configuration. Usually used with detour.
disableInsecureEncryption: true | false
Forbids client for using insecure encryption methods. When set to true, connections will be terminated immediately if the following encryption is used. Default value false.
The tag of an inbound proxy. See Overview. If configured, VMess will suggest its client to use the detour for further connections.
DefaultObject
{"level":0,"alterId":4}
level: number
User level.
alterId: number
Number of alternative IDs. Default value 64. Recommend 4.
================================================
FILE: en/configuration/protocols.html
================================================
Protocols · Project V Official
Protocols
V2Ray supports the following protocols. Each protocol may be an inbound protocol, or an outbound protocol, or both.
================================================
FILE: en/configuration/reverse.html
================================================
Reverse · Project V Official
Reverse Proxy
Reverse proxy is an optional feature in V2Ray. It redirects traffic from a server to a client. Thus is so called "Reverse" proxying.
Reverse proxy is available in V2Ray 4.0+. It is now in beta, and may be improved in near future.
Reverse proxy works in the following way:
Suppose there is a device A that runs a web server. Device A has no public IP address, and can't be accessed from internet. There is another device B, say a cloud server, which can be access from internet. We need to use B as portal, to redirect traffice to A.
Now we install a V2Ray on device A, named bridge. And then install a V2Ray on device B, named portal.
bridge will open connections to portal. Their target can be customized for routing purpose. portal will receive these connections, as well as connections from other uses in the internet. portal will "connect" these two kind of connections. Then the interent traffic will be tunneled to bridge.
After bridge receives traffic from internet through portal, it will send these traffic to the web server on localhost. You may configure routing for these traffic as well.
bridge will control load balance based of the amount of traffic.
Reverse proxy has already leveraged Mux. It is not necessary to configure Mux again on its outbound.
ReverseObject
ReverseObject is used as reverse field in top level configuration.
An array of portals. Each portal is a PortalObject.
BridgeObject
{"tag":"bridge","domain":"test.v2ray.com"}
tag: string
A tag. All traffic initiated by this bridge will have this tag. It can be used for routing, identified as inboundTag.
domain: string
A domain. All connections initiated by bridge towards portal will use this domain as target. This domain is only used for communication between bridge and portal. It is not necessary to be actually registered.
PortalObject
tag: string
A Tag. You need to redirect all traffic to this portal, by targeting outboundTag to this tag. The traffic includes the connections from bridge, as well as internet traffic.
domain: string
A domain. When a connection targeting this domain, portal considers it is a connection from bridge, otherwise it is an internet connection.
Like other usages, a V2Ray instance can be used as a bridge, or a portal, or both as the same time.
Example configuration
bridge usually needs two outbounds. One for connecting portal, and another for connecting local web server.
{"tag":"out""protocol":"freedom","settings":{"redirect":"127.0.0.1:80"// Send traffic to local web server}},{"protocol":"vmess","settings":{"vnext":[{"address":"portal的IP地址","port":1024,"users":[{"id":"27848739-7e62-4138-9fd3-098a63964b6b"}]}]},"tag":"interconn"}
portal usually needs two inbounds. One for connections from bridge, and another for internet connections.
Reverse:
{"portals":[{"tag":"portal","domain":"test.v2ray.com"// Must be the same as in bridge}]}
Inbound:
{"tag":"external","port":80,// Open port 80 for internet HTTP traffic"protocol":"dokodemo-door","settings":{"address":"127.0.0.1","port":80,"network":"tcp"}},{"port":1024,// For bridge connections"tag":"interconn","protocol":"vmess","settings":{"clients":[{"id":"27848739-7e62-4138-9fd3-098a63964b6b"}]}}
In practice, you may want to run bridge first and then portal.
================================================
FILE: en/configuration/routing.html
================================================
Routing · Project V Official
Routing
V2Ray has an internal routing mechanism. It routes inbound connections to various outbound based on rules. A common scenario is to split traffic by country. V2Ray can detect target country (by Geo IP) of a connection, and sends then connection to corresponding outbound proxy.
RoutingObject
RoutingObject is used as routing in top level configuration.
An array of rules. For each inbound connection, V2Ray tries these rules from top down one by one. If a rule takes effect, the connection will be routed to the outboundTag (or balancerTag, V2Ray 4.4+) of the rule.
(V2Ray 4.4+) An array of load balancers. When a routing rule points to a load balancer, the balancer will select an outbound based on configuration. Then traffic will be sent to that outbound.
When multiple fields are specified, these fields have to be all satisfied, in order to make the rule effective. If you need both domain and ip rules, it is highly likely you need put them into separate rules.
type: "field"
The only valid value for now is "field".
domain: [ string ]
An array of domains. Available formats are:
Plaintext: If this string matches any part of the targeting domain, this rule takes effet. Example: rule "sina.com" matches targeting domain "sina.com", "sina.com.cn" and "www.sina.com", but not "sina.cn".
Regular expression: Begining with "regexp:", the rest is a regular expression. When the regexp matches targeting domain, this rule takes effect. Example: rule "regexp:\\.goo.*\\.com$" matches "www.google.com" and "fonts.googleapis.com", but not "google.com".
Subdomain (recommended): Begining with "domain:" and the rest is a domain. When the targeting domain is exactly the value, or is a subdomain of the value, this rule takes effect. Example: rule "domain:v2ray.com" matches "www.v2ray.com", "v2ray.com", but not "xv2ray.com".
Full domain: Begining with "full:" and the rest is a domain. When the targeting domain is exactly the value, the rule takes effect. Example: rule "domain:v2ray.com" matches "v2ray.com", but not "www.v2ray.com".
Pre-defined domain list: Begining with "geosite:" and the rest is a name, such as geosite:google or geosite:cn. See Pre-defined domain list for more detail.
Domains from file: Such as "ext:file:tag". The value must begin with ext: (lowercase), and followed by filename and tag. The file is placed in resource directory, and has the same format of geosite.dat. The tag must exist in the file.
ip: [string]
An array of IP ranges. When the targeting IP is in one of the ranges, this rule takes effect. Available formats:
GeoIP: such as "geoip:cn". It begins with geoip: (lower case) and followed by two letter of country code.
Special value "geoip:private": for all private addresses such as 127.0.0.1.
IPs from file: Such as "ext:file:tag". The value must begin with ext: (lowercase), and followed by filename and tag. The file is placed in resource directory, and has the same format of geoip.dat. The tag must exist in the file.
"ext:geoip.dat:cn" is equivalent to "geoip:cn".
port:number | string
Port range. Formats are:
"a-b": Both a and b are positive integers and less than 65536. When the targeting port is in [a, b), this rule takes effect.
a: a is a positive integer, and less than 65536. When the targeting port is a, this rule takes effect.
Mix of the two above, separated by ",". Such as "53,443,1000-2000".
network: "tcp" | "udp" | "tcp,udp"
When the connection has in the chosen network, this rule take effect.
source: [string]
An array of IP ranges. Same format as ip. When the source IP of the connection is in the IP range, this rule takes effect.
user: [string]
An array of email address. When the inbound connection uses an user account of the email address, this rule takes effect. For now Shadowsocks and VMess support user with email.
inboundTag: [string]
An array of string as inbound proxy tags. When the connection comes from one of the specified inbound proxy, this rule takes effect.
protocol: [ "http" | "tls" | "bittorrent" ]
An array of string as protocol types. When the connection uses one of the protocols, this rule takes effect. To recognize the protocol of a connection, one must enable sniffing option in inbound proxy.
attrs: string
(V2Ray 4.18+) A Starlark script, used for detecting traffic attributes. When this script returns true, this rule takes effect.
Starlark is a subset of Python. The script takes a global varible named attrs. It contains all attributes of the traffic.
Tag of the outbound that the connection will be sent to, if this rule take effect.
balancerTag: string
Tag of an load balancer. Then this rule takes effect, V2Ray will use the balancer to select an outbound. Either outboundTag or balancerTag must be specified. When both are specified, outboundTag takes priority.
BalancerObject
Configuration for a load balancer. When a load balancer takes effective, it selects one outbound from matching outbounds. This outbound will be used for send out-going traffic.
{"tag":"balancer","selector":[]}
tag: string
Tag of this BalancerObject, to be matched from balancerTag in RuleObject.
selector: [ string ]
An array of strings. These strings are used to select outbounds with prefix matching. For example, with the following outbound tags: [ "a", "ab", "c", "ba" ],selector ["a"] matches [ "a", "ab" ].
When multiple outbounds are selected, load balancer for now picks one final outbound at random.
Pre-defined domain lists
This is a domain lists maintained by domain-list-community project. It provides a file named geosite.dat for some predefined domain lists. Notably:
category-ads: Common ads domains.
category-ads-all: Common ads domains and ads providers' domains.
cn: Equivalent to an union of geolocation-cn and tld-cn.
google: All Google domains.
facebook: All Facebook domains.
geolocation-cn: Common domains that serve in China.
geolocation-!cn: Common domains that don't serve in China
speedtest: All domains used by Speedtest.
tld-cn: All .cn and .中国 domains.
================================================
FILE: en/configuration/stats.html
================================================
Statistics · Project V Official
Statistics
V2Ray provides some information about its internals.
StatsObject
StatsObject is used as stats field in top level configuration.
{}
At the moment there is no parameter in stats settings. Stats is enabled automatically when the StatsObject is set in top level configuration. You need also enable the corresponding settings in Policy, in order to keep track of user or system stats.
All stats counters are listed below:
User Traffic
If an user doesn't has email address set in protocol settings, the traffic stats will not be enabled.
user>>>[email]>>>traffic>>>uplink
Accumulated uplink traffic of specific user, in bytes.
user>>>[email]>>>traffic>>>downlink
Accumulated downlink traffic of specific user, in bytes.
Global Traffic
inbound>>>[tag]>>>traffic>>>uplink
Accumulated uplink traffic of specific inbound, in bytes.
inbound>>>[tag]>>>traffic>>>downlink
Accumulated downlink traffic of specific inbound, in bytes.
================================================
FILE: en/configuration/transport/domainsocket.html
================================================
DomainSocket · Project V Official
Domain Socket Transport
Domain Socket uses standard Unix domain socket to transport data. Domain socket is system interal tranfer channel. It doesn't jam network buffer and may be a bit faster than trasnferring through local loopback network.
Domain socket can only be used on platforms that supports Unix domain socket, such as macOS and Linux. It is not available on Windows.
When domain socket is used, IP and port specified on the inbound/outbound proxy will be ignored. All traffic is tunneled through the domain socket.
DomainSocketObject
DomainSocketObject is used in dsSettings field in TransportObject and StreamSettingsObject.
{"path":"/path/to/ds/file"}
path: string
An valid absolute file path. Before running V2Ray, the file on this path must not exist.
================================================
FILE: en/configuration/transport/h2.html
================================================
HTTP/2 · Project V Official
HTTP/2 Transport
HTTP/2 transport is added in V2Ray 3.17. It is based on standard HTTP/2, and can be proxies through other HTTP server, such as Nginx.
Due to HTTP/2 recommandation, the corressponding inbound and outbound must enable TLS to use this transport.
HttpObject
DomainSocketObject is used in httpSettings field in TransportObject and StreamSettingsObject.
{"host":["v2ray.com"],"path":"/random/path"}
host: [ string ]
A string array. Each element is a domain. Client picks up a domain at random for each request. Server checks whether the domain in incoming request is in the list.
path: string
HTTP path. Client and server must have the same value.
================================================
FILE: en/configuration/transport/mkcp.html
================================================
mKCP · Project V Official
mKCP Transport
mKCP is a reliable stream transport. It is an UDP based protocol. mKCP sends more traffic for lower latency. To transfer the same amount of data, mKCP usually requires more throughput than TCP does.
Maximum transmission unit. It indicates the maxium number bytes that an UDP packet can carry. Recommended value is between 576 and 1460. Default value 1350.
tti: number
Transmission time interval, in milli-second. mKCP sends data in this interval. Recommended value is between 10 and 100. Default value 50.
uplinkCapacity: number
Uplink bandwidth, in MB/s. The maximum bandwidth for the V2Ray instance to upload data to a remote one. Default value is 5. Please note it is byte (in MB/s), not bit. One may use value 0 for a small bandwidth.
downlinkCapacity: number
Downlink bandwidth, in MB/s. The maximum bandwidth for the V2Ray instance to download data. Default value is 20. Please note it is byte (in MB/s), not bit. One may use value 0 for a small bandwidth.
uplinkCapacity and downlinkCapacity determine the speed of mKCP. On client side, uplinkCapacity specifies the speed for client sending data to server. On sever side, downlinkCapacity specifies the speed of server receiving data. The minimum of this pair is effective in an actual connection.
congestion: true | false
Whether or not to enable congestion control. Default value is false. When congestion control is enabled, V2Ray will detect network quality. It will send less packets when packet loss is severe, or more data when network is not fully filled.
readBufferSize: number
Read buffer size for a single connection, in MB. Default value is 2.
writeBufferSize: number
Write buffer size for a single connection, in MB. Default value is 2.
Type of obfuscation. Corresponding inbound and outbound proxy must have the same settings. Choices are:
"none": Default value. No obfuscation is used.
"srtp": Obfuscated as SRTP traffic. It may be recognized as video calls such as Facetime.
"utp": Obfuscated as uTP traffic. It may be recognized as Bittorrent traffic.
"wechat-video": Obfuscated to WeChat traffic.
"dtls": Obfuscated as DTLS 1.2 packets.
"wireguard": Obfuscated as WireGuard packets. (NOT true WireGuard protocol)
Credits
@skywind3000 invented the original KCP protocol and implemented in C.
@xtaci re-implement KCP protocol in Go.
@xiaokangwang integrated KCP into V2Ray.
================================================
FILE: en/configuration/transport/quic.html
================================================
QUIC · Project V Official
QUIC
QUIC, or Quick UDP Internet Connection, is a multiplexing transport based on UDP, initially designed, implemented, and deployed by Google.
QUIC has the following advantages:
Reduced number of roundtrips in handshake phase. (1-RTT or 0-RTT)
Multiplexing without head of line blocking as in TCP
Connection migration, especially for clients. For example, connections don't break when device moves from Wi-Fi to 4G.
QUIC is now an experiment in V2Ray. It implements IETF specification. As the spec is still being standardized, compatibility can't be guaranteed.
Update History
V2Ray 4.7:
Initial version to support QUIC.
Default settings:
12 byte Connection ID
Connection timeout in 30 seconds if no data traffic. (May have impact on some long HTTP connections)
QuicObject
QUIC is used as quicSettings in transport settings. The configuration must be exactly the same between connecting peers.
QUIC requires TLS. If TLS is not enabled in transport settings, V2Ray will automatically issue a TLS certificate for it. When QUIC transport is used, encryption in VMess can be turned off.
Extra encryption over entire QUIC packet, include the frame head part. Default value is "none" for no encryption. After being encrypted, QUIC packets can't be sniff'ed.
key: string
Key for the encryption above. Can be any string. Only effective when security is not "none".
Type of obfuscation. Corresponding inbound and outbound proxy must have the same settings. Choices are:
"none": Default value. No obfuscation is used.
"srtp": Obfuscated as SRTP traffic. It may be recognized as video calls such as Facetime.
"utp": Obfuscated as uTP traffic. It may be recognized as Bittorrent traffic.
"wechat-video": Obfuscated to WeChat traffic.
"dtls": Obfuscated as DTLS 1.2 packets.
"wireguard": Obfuscated as WireGuard packets. (NOT true WireGuard protocol)
When neither encryption nor obfuscation is enabled, QUIC transport is compatible with other QUIC tools. However it is recommended to enable either or both for better undetectable communication.
================================================
FILE: en/configuration/transport/tcp.html
================================================
TCP · Project V Official
TCP Transport
TcpObject
{"header":{"type":"none"}}
header: NoneHeaderObject | HttpHeaderobject
Header obfuscation. Default value is NoneHeaderObject.
NoneHeaderObject
No header obfuscation.
{"type":"none"}
type: "none"
Disable header obfuscation.
HttpHeaderObject
HTTP header obfuscation. The configuration must be the same between connecting inbound and outbound.
{"version":"1.1","method":"GET","path":["/"],"headers":{"Host":["www.baidu.com","www.bing.com"],"User-Agent":["Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36","Mozilla/5.0 (iPhone; CPU iPhone OS 10_0_2 like Mac OS X) AppleWebKit/601.1 (KHTML, like Gecko) CriOS/53.0.2785.109 Mobile/14A456 Safari/601.1.46"],"Accept-Encoding":["gzip, deflate"],"Connection":["keep-alive"],"Pragma":"no-cache"}}
version: string
HTTP version. Default value is "1.1".
method: string
HTTP method. Default value is "GET"。
path: [ string ]
HTTP path. An array is string. The path will be chosen randomly for every connection.
headers: map{string, [ string ] }
HTTP header. The key of each entry is the key of HTTP header. The value of each entry is a list of strings. The actual HTTP header value will be chosen randomly from the list for each connection. Default value is the values in the example above.
In a connection, all keys in the specified map will be set to the HTTP header.
HTTP header. The key of each entry is the key of HTTP header. The value of each entry is a list of strings. The actual HTTP header value will be chosen randomly from the list for each connection. Default value is the values in the example above.
In a connection, all keys in the specified map will be set to the HTTP header.
================================================
FILE: en/configuration/transport/websocket.html
================================================
WebSocket · Project V Official
WebSocket
Use standard WebSocket to transport data. Websocket connections can be proxied by HTTP server such as Nginx.
WebSocketObject
WebSocketObject is used as wsSettings in TransportObject or StreamSettingsObject.
Websocket recognizes HTTP header X-Forwarded-For, and uses it as inbound source address.
{"path":"/","headers":{"Host":"v2ray.com"}}
path: string
Path used for WebSocket. Default to root, as "/".
headers: map{string, string}
Custom HTTP header. An array where each entry is a key value pair in string, for header and value in HTTP header. Default is empty.
================================================
FILE: en/configuration/transport.html
================================================
Transport · Project V Official
Transport Settings
Transport is for how V2Ray sends and receives data from its peers. The responsibility of a transport is to reliably transfer data to a peer. Usually a connection has matching transports on both endpoints. For example, if a V2Ray outbound uses WebSocket as its transport, the inbound it talks to also has to use WebSocket, otherwise a connection can't be established.
The transport settings devides into two parts: global settings and per proxy settings. Per-proxy settings specifies how each individual proxy handles its data, while global settings is for all proxies. Usually the inbound and outbound proxies between the connecting peer must have the same transport settings. When a proxy has no transport settings, the global settings applies.
TransportObject
TransportObject is used as transport field in top level configuration.
TCP transport configuration for current proxy. Effective only when the proxy uses TCP transport. Configuration is the same as it is in global configuration.
kcpSettings: KcpObject
mKCP transport configuration for current proxy. Effective only when the proxy uses mKCP transport. Configuration is the same as it is in global configuration.
wsSettings: WebSocketObject
WebSocket transport configuration for current proxy. Effective only when the proxy uses WebSocket transport. Configuration is the same as it is in global configuration.
httpSettings: HttpObject
HTTP/2 transport configuration for current proxy. Effective only when the proxy uses HTTP/2 transport. Configuration is the same as it is in global configuration.
dsSettings: DomainSocketObject
Domain socket transport configuration for current proxy. Effective only when the proxy uses domain socket transport. Configuration is the same as it is in global configuration.
quicSettings: QUICObject
(V2Ray 4.7+) QUIC transport configuration for current proxy. Effective only when the proxy uses QUIC transport. Configuration is the same as it is in global configuration.
sockopt: SockoptObject
Socket options for incoming and out-going connections.
Server name (usually domain) used for TLS authentication. Typically this is used when corressponding inbound/outbound uses IP for communication.
When domain name is specified from inbound proxy, or get sniffed from the connection, it will be automatically used for connection. It is not necessary to set serverName in such case.
alpn: [ string ]
An array of strings, to specifiy the ALPN value in TLS handshake. Default value is ["http/1.1"].
allowInsecure: true | false
If true, V2Ray allowss insecure connection at TLS client, e.g., TLS server uses unverifiable certificates.
allowInsecureCiphers: true | false
Whehter or not to allow insecure cipher suites. By default TLS only uses cipher suites from TLS 1.3 spec. Turn on this option to allow cipher suites with static RSA keys.
disableSystemRoot: true | false
(V2Ray 4.18+) Whether or not to disable system root CAs for TLS handshake. Default value is false. If set to true, V2Ray will use only certificates for TLS handshake.
Purpose of the certificate. Default value "encipherment". Choices are:
"encipherment": Certificate is used for TLS authentication and encryption.
"verify": Certificate is used for validating TLS certificates from remote peer. In this case, the certificate has to be a CA certificate.
"issue": Certificate is used for issuing other certificates. In this case, the certificate has to be a CA certificate.
On Windows, you have to install your CA certificate to system, in order to verify cerificates issued from the CA.
When there is a new client request, say for serverName = "v2ray.com", V2Ray will find a certificate for "v2ray.com" first. If not found, V2Ray will try to issue a new certificate using any existing certificate whose usage is "issue" for "v2ray.com". The new certificate expires in one hour, and will be added to certificate pool for later reuse.
certificateFile: string
File path to the certificate. If the certificate is generated by OpenSSL, the path ends with ".crt".
Use v2ctl cert -ca command to generate a new CA certificate.
certificate: [ string ]
List of strings as content of the certificate. See the example above. Either certificate or certificateFile must not be empty.
keyFile: string
File path to the private key. If generated by OpenSSL, the file usually ends with ".key". Key file with password is not supported.
key: [ string ]
List of strings as content of the private key. See the example above. Either key or keyFile must not be empty.
When certificateFile and certificate are both filled in. V2Ray uses certificateFile. Same for keyFile and key.
When usage is "verify", both keyFile and key can be empty.
SockoptObject
{"mark":0,"tcpFastOpen":false,"tproxy":"off"}
mark: number
An integer. If non-zero, the value will be set to out-going connections via socket option SO_MARK. This mechanism only applies on Linux and requires CAP_NET_ADMIN permission.
tcpFastOpen: true | false
Whether or not to enable TCP Fast Open. When set to true, V2Ray enables TFO for current connection. When set to false, V2Ray disables TFO. If this entry doesn't exist, V2Ray uses default settings from operating system.
Only apply on the following operating systems:
Windows 10 (1604) or later
Mac OS 10.11 / iOS 9 or later
Linux 3.16 or later: Enabled by system default.
Applicable for both inbound and outbound connections.
tproxy: "redirect" | "tproxy" | "off"
Whether or not to enable transparent proxy on Linux. Choices are:
"off": Default value. Not enable TProxy at all.
"redirect": Enable TProxy with Redirect mode. Supports TCP/IPv4 and UDP traffic.
"tproxy": Enable TProxy with TProxy mode. Supports TCP and UDP traffic.
Transparent proxy requires Root or CAP_NET_ADMIN permission.
If TProxy is not set, and allowRedirect is set in dokodemo-door, the value of TProxy will be set to "redirect" automatically.
================================================
FILE: en/developer/tools.html
================================================
Tools · Project V Official
Project V is a set of tools to help you build your own privacy network over internet. The core of Project V, named V2Ray, is responsible for network protocols and communications. It can work alone, as well as combine with other tools.
This website is mainly a manual for V2Ray, with some additional information regarding the whole project.
Features
Multiple inbound/outbound proxies: one V2Ray instance supports in parallel multiple inbound and outbound protocols. Each protocol works independently.
Customizable routing: incoming traffic can be sent to different outbounds based on routing configuration. It is easy to route traffic by target region or domain.
Multiple protocols: V2Ray supports multiple protocols, including Socks, HTTP, Shadowsocks, VMess etc. Each protocol may have its own transport, such as TCP, mKCP, WebSocket etc.
Obfuscation: V2Ray has built in obfuscation to hide traffic in TLS, and can run in parallel with web servers.
Reverse proxy: General support of reverse proxy. Can be used to build tunnels to localhost.
Multiple platforms: V2Ray runs natively on Windows, Mac OS, Linux, etc. There is also third party support on mobile.
Sponsors
This site is generated by GitBook, and host on GitHub. If you'd like to modify its content, please send pull request to this repo.