Configuration

One JSON topology.

Unknown fields fail closed. Native carriers, mux, resume, reverse publish, and routing live in the same FileConfig.

Examples Generate pair Native protocol

Configuration

JSON topology, native, and REALITY.

Describe inbounds, outbounds, and security in one config. Start with native, then REALITY and protocol choice.

native carrier.mode=auto Resumable carrier.mode=quic Reverse publish REALITY Generate Compare

v0.5.0 · native + raw + reality

`native + raw + reality + carrier.mode=auto`

This is the recommended automatic stack in v0.5.0: one listen address, dual Reality carriers, QUIC preferred, TCP fallback, and optional resumable TCP streams. carrier.mode selects auto/tcp/quic while security.type stays reality. Without mux, Reality remains TCP-only.

Default pathQUIC-first carrier.mode=auto

Force TCP with carrier.mode=tcp, or force QUIC with carrier.mode=quic.

Protocolnative

Token auth, TCP/UDP tunnel semantics, reverse publish, and resumable logical streams.

Transportraw

Required base transport for automatic dual carriers. Do not stack ws / h2 / h3 in this mode.

Securityreality

Camouflage keys/SNI/dest. Pair with carrier.mode for auto, TCP-only, or QUIC-only selection.

Carriermode=auto

v0.5.0 generator path: Reality or TLS with carrier.mode=auto on one address; outbound carrier.prefer is adaptive by default.

Multiplexingmux.enabled

Mux enables dual-carrier and pooling. Optional mux.resume preserves eligible TCP flows across carrier replacement.

Automatic · v0.5.0

security.reality + carrier.mode="auto" + mux.enabled

Binds TCP and UDP on one address, prefers QUIC, falls back to Reality TCP with backoff, and probes to restore QUIC preference.

Forced TCP

carrier.mode="tcp"

Uses only the Reality TCP carrier (security.type stays reality). Choose this when UDP is intentionally unavailable.

Forced QUIC

carrier.mode="quic" + mux.enabled

Uses the dedicated QUIC pool without TCP fallback. The server listen port must be reachable over UDP.

Required stack

Automatic dual carriers need type=native, transport.type=raw, mux enabled, security.type=reality, and carrier.mode=auto (default for generators). Missing mux keeps ordinary TCP-only Reality.

carrier.mode

Set carrier.mode to auto (QUIC-first with TCP fallback), tcp, or quic. security.type remains reality in all three cases. quic and auto require mux.enabled.

One address, two sockets

The inbound binds TCP and UDP to the same host:port. Clients race the same address over both carriers without a second listen entry.

QUIC first, TCP fallback

Outbounds prefer the Reality QUIC carrier. When UDP is blocked or unhealthy, they fall back to Reality TCP with jittered exponential backoff, then probe to restore QUIC preference.

Shared camouflage

Both carriers share the same REALITY keys, short IDs, SNI, and dest. The camouflage destination should support HTTPS over TCP and HTTP/3 over UDP.

Scope of selection

TCP streams, UDP relay, and reverse carriers follow the same automatic carrier policy when carrier.mode=auto.

Escape hatches

carrier.mode=tcp forces Reality TCP only. carrier.mode=quic forces the dedicated QUIC pool without TCP fallback. security.type remains reality.

Generate the automatic pair

CLI and the browser generator emit this stack by default for native: security.type=reality, mux.enabled, and carrier.mode=auto. Enable resumable streams with mux.resume=true on both ends.

tcptun config native --server proxy.example.com --port 9443 --server-name example.com --dest example.com:443

Structure

Top-level fields include log, resources, inbounds, outbounds, route, and dns. Unknown fields are rejected; resources.resumable_buffer_budget controls the shared replay-buffer budget.

Address

inbound.address and outbound.address are both host:port arrays. Multiple addresses race as candidate entry points; use balance for independent nodes.

References

Components link through tags; via chains and balance members are checked for missing refs and cycles.

Startup

Load → Validate → Compile → Start. Listening begins only after validation succeeds.

Native

Low-overhead private tunnel

Supports TCP / UDP and mux, with transport options raw / ws / h2 / h3. Server users[].id and client token must match.

Server inboundusers[].id

Client outboundtoken

Auth

Server users[].id and client token must match.

Address

address is a host:port array. Multiple addresses race as candidate entry points for the same service; they are not balance.

v0.3.0 carrier.mode=auto

native + raw + mux + security.type=reality + carrier.mode=auto prefers QUIC, falls back to TCP, and shares one camouflage identity on both carriers.

Resumable TCP

mux.resume=true on both carrier.mode=auto peers can preserve an eligible TCP logical stream across carrier replacement (v0.3.0+).

Throughput

Prefer native + raw + mux. Forced TLS / REALITY / ws / h2 / h3 add flexibility but cost more.

Reverse publish

Server publish + client expose can hang NAT-side TCP/UDP services on edge listeners (requires mux).

Native QUIC

`native + raw + reality + carrier.mode=quic`

Forced QUIC is still the same layers: native is the tunnel protocol, raw is the transport, and security.type=reality stays REALITY. Select the dedicated QUIC pool with carrier.mode=quic and mux.enabled. There is no TCP fallback.

Best fortcptun on both ends

Carry TCP streams and UDP DATAGRAMs together without managing TLS certificates.

Protocolnative

Handles token auth, TCP / UDP tunnel semantics, and reverse publish.

Transportraw

Required base transport for QUIC mode; do not stack ws / h2 / h3.

Securityreality

Protects the handshake with REALITY keys and site parameters; no cert deploy needed.

Carriermode=quic

Uses a dedicated QUIC pool for streams and UDP DATAGRAMs. Requires mux.enabled.

Both ends must match

token, REALITY key pair, server name, and short ID must correspond. Plain security.type=reality with carrier.mode=auto and mux enables automatic dual carriers; force a single path with carrier.mode=tcp or carrier.mode=quic.

tcptun config native --quic --server proxy.example.com --port 9443

{
  "log": { "level": "info" },
  "inbounds": [
    {
      "tag": "server",
      "type": "native",
      "address": ["0.0.0.0:9443"],
      "network": ["tcp", "udp"],
      "users": [{ "id": "change-me" }],
      "transport": { "type": "raw" },
      "mux": { "enabled": true }
    }
  ],
  "outbounds": [
    { "tag": "direct", "type": "direct" }
  ],
  "route": { "default_outbound": "direct", "rules": [] },
  "dns": {}
}

Minimal topology

The server exposes a native inbound; the client forwards a local mixed inbound to a native outbound. Replace the sample credentials and addresses to run.

Fields

Common field overview.

Common fields

tagboth: Unique identifier referenced by routes.
typeboth: "native".
addressboth: host:port string array; outbounds may list multiple candidate entry points.
networkboth: tcp / udp, combinable.
transportboth: Only type / path (raw / ws / h2 / h3).
securityboth: tls or reality. Carrier path is carrier.mode=auto|tcp|quic; all security parameters live here.
muxboth: mux.enabled is required and must be true when mux is present; omit mux to disable. Pool parameters are mainly on the client.

Server

addressserver: Listen address list, e.g. ["0.0.0.0:9443"].
users[].idserver: Auth credential matching the client token.
publishserver: Reverse publish: service + address, optional network=tcp|udp.
security.cert/keyserver: Required for TLS inbounds; REALITY uses key fields instead of cert/key.

Client

addressclient: Remote entry points; multiple candidate host:port values are allowed.
tokenclient: Required; matches server users[].id.
security.server_nameclient: SNI for TLS/QUIC.
exposeclient: Reverse publish: service + target, optional network=tcp|udp.
carrier.modeboth: auto / tcp / quic. auto and quic require mux.enabled.
carrier.preferclient: auto only: adaptive / quic / tcp. Official auto examples use quic.
carrier.udp_modeclient: auto and quic: reliable / auto / datagram.
carrier.*_receive_windowboth: QUIC receive windows; stream max 16 MiB, connection max 64 MiB.
mux.max_sessionsclient: Connection pool cap, 1–32, default 4.
mux.max_streams_per_sessionclient: Per-connection stream cap, 1–4096.
mux.warm_sparesclient: Warm idle connections; must be less than max_sessions.
mux.resumeboth: v0.3.0: preserve eligible native TCP logical streams across carrier replacement when carrier.mode=auto.
mux.resume_timeoutboth: Recovery window: default 15s; explicit 100ms–5m.
mux.resume_buffer_sizeboth: Per-direction replay buffer: default 4 MiB; explicit 64 KiB–64 MiB.

Mux / QUIC

Enable mux for short-connection workloads. Prefer native + raw + mux for peak throughput.

How to enable

Set mux.enabled=true. enabled is required and must be true; omit the mux field to disable it.

TCP mux

Reuses physical connections. Unreachable targets are not reported as success to the local proxy early.

Automatic carriers

native + raw + mux + security.type=reality + carrier.mode=auto prefers QUIC, falls back to Reality TCP with bounded backoff, then probes to restore QUIC preference.

Resumable streams

mux.resume keeps eligible native TCP logical streams alive while an automatic Reality carrier is replaced. Enable matching settings on both peers.

QUIC

carrier.mode=quic uses a UDP/QUIC connection pool and requires native + raw + mux.enabled; security.type may be tls or reality.

UDP

reliable uses streams; auto prefers DATAGRAM with fallback; datagram does not degrade. DATAGRAM supports fragmentation, recovery, and adaptive FEC.

mux snippet

"mux": {
  "enabled": true,
  "max_sessions": 4,
  "max_streams_per_session": 128,
  "warm_spares": 1
}

v0.3.0 continuity

Resumable TCP logical streams

Add resume to matching carrier.mode=auto mux blocks to preserve an eligible TCP logical stream while its physical QUIC or TCP attachment is replaced.

Exact scope

native + raw + security.type=reality + carrier.mode=auto + mux only. UDP, reverse publish, and forced tcp/quic-only modes are not resumable.

Both peers

Set mux.resume=true on both endpoints running v0.3.0+. There is no silent downgrade when only one peer enables it.

Bounded recovery

resume_timeout defaults to 15s (100ms–5m). resume_buffer_size defaults to 4 MiB (64 KiB–64 MiB).

One server process

The registry is process-local. Use one unique outbound address whose TCP and UDP paths reach the same server process.

matching endpoint mux block

"carrier": { "mode": "auto" },
"mux": {
  "enabled": true,
  "resume": true,
  "resume_timeout": "15s",
  "resume_buffer_size": 4194304
}

Reverse publish

Hang NAT-side TCP/UDP services on tunnel server listen ports. Configure publish on the server and expose on the client.

Protocol scope

Only native + raw, and mux must be enabled.

Pairing rules

Server publish and client expose service names must match, and network must match as well (default tcp).

Security boundary

The client local target is not sent to the server; the server can only open allowlisted services.

QUIC requirements

QUIC reverse publish needs matching TLS or REALITY plus carrier.mode=quic (or auto) on both ends; TLS servers need cert/key.

Workflow

Generate → validate → start.

generate01

Generate a pair

Writes server.json and client.json.

tcptun config native --server proxy.example.com --port 9443

check02

Validate

Does not listen; useful after editing a config.

tcptun config check --config server.json

quic03

Generate a QUIC pair

Writes matching REALITY configs with carrier.mode=quic and mux enabled.

tcptun config native --quic --server proxy.example.com --port 9443

run04

Start

Start the server first, then the client.

tcptun --config server.json
tcptun --config client.json

uri05

Export URI

Exports URIs from tunnel outbounds; multiple addresses become multiple URIs.

tcptun uri export --config client.json --output client.uri

REALITY

REALITY and REALITY QUIC

Configured under security for native + raw. Pair with carrier.mode for auto, TCP-only, or QUIC-only.

rawX25519

raw only

transport must be raw and cannot be combined with ws / h2 / h3.

No stacked TLS

Plain reality cannot stack with security.type=tls; choose exactly one security type.

Supported endpoints

Works with native tunnel endpoints. mixed and socks5 are unsupported for URI export.

Key pairing

Server private_key pairs with client public_key; short_id must match on both ends.

native auto (v0.3.0)

On native + raw + mux + security.type=reality + carrier.mode=auto, dual carriers enable QUIC-first with TCP fallback. Without mux, Reality stays TCP-only.

Forced modes

carrier.mode=tcp forces Reality TCP only. carrier.mode=quic forces the dedicated QUIC pool (no TCP fallback).

Server

type: "reality".
private_key: X25519 private key (base64url).
server_names: Allowed SNI list.
short_ids: Allowed short ids (hex).
dest: Camouflage target, e.g. example.com:443.
max_time_diff: Optional clock skew, default 30s.

Client

type: "reality".
public_key: Server public key.
server_name: SNI; must be in server_names.
short_id: A single short id.
spider_x: Optional path, default /.

{
  "log": { "level": "info" },
  "inbounds": [
    {
      "tag": "server",
      "type": "native",
      "address": ["0.0.0.0:9443"],
      "network": ["tcp", "udp"],
      "users": [{ "id": "change-me" }],
      "transport": { "type": "raw" },
      "security": {
        "type": "reality",
        "private_key": "REPLACE_WITH_SERVER_PRIVATE_KEY",
        "server_names": ["example.com"],
        "short_ids": ["abcd1234"],
        "dest": "example.com:443",
        "max_time_diff": "30s"
      },
      "carrier": { "mode": "auto" },
      "mux": { "enabled": true }
    }
  ],
  "outbounds": [
    { "tag": "direct", "type": "direct", "network": ["tcp", "udp"] }
  ],
  "route": { "default_outbound": "direct", "rules": [] },
  "dns": {}
}

Generate a REALITY pair

Writes paired server.json and client.json; run tcptun uri export if you need URIs.

tcptun config native --server proxy.example.com --port 9443 --server-name example.com --dest example.com:443

native + REALITY

Generates matching REALITY configs for native on both ends.

tcptun config native --server proxy.example.com --port 9443 --server-name example.com --dest example.com:443

native + REALITY QUIC

Generates matching REALITY configs with carrier.mode=quic and mux enabled.

tcptun config native --quic --server proxy.example.com --port 9443 --server-name example.com --dest example.com:443

Validate and start

Validate keys and fields first, then start.

tcptun config check --config server.json && tcptun --config server.json

Note

Native + raw + mux + security.type=reality with carrier.mode=auto is automatic QUIC-first with TCP fallback. Force a single carrier with carrier.mode=tcp or carrier.mode=quic. tcptun config native --quic generates the latter. Legacy security.type=reality-quic / mux.mode=quic aliases are not the current scheme.

Compare

Native tunnel protocol

Tunnel endpoints are native. mixed and socks5 remain for local proxy hops.

Protocol	Credential	Interop	Default security	Mux	Best for
`native`	token ↔ users[].id	tcptun only	raw + REALITY	Private mux, recommended	Throughput / reverse publish

{
  "tag": "proxy",
  "type": "native",
  "address": ["proxy.example.com:9443"],
  "token": "change-me",
  "transport": { "type": "raw" },
  "mux": { "enabled": true }
}

tcptun config native --server … --port …