Misc Options

[General]
ipv6 = true
loglevel = notify

skip-proxy = 127.0.0.1, 192.168.0.0/16, 10.0.0.0/8, 172.16.0.0/12, 100.64.0.0/10, localhost, *.local

tun-excluded-routes = 192.168.0.0/16, 10.0.0.0/8, 172.16.0.0/12
tun-included-routes = 192.168.1.12/32

Common Options

Enable full IPv6 support (Default: true)

ipv6 = true

loglevel (Default: warning)

loglevel = notify

One of none, fatal, warning, notify, info or verbose. It's not recommended to enable verbose in daily use because this will slow down the performance significantly.

skip-proxy

skip-proxy = 127.0.0.1, 192.168.0.0/16, 10.0.0.0/8, 172.16.0.0/12, 100.64.0.0/10, localhost, *.local

In iOS version, this option forces connections to these domain/IP ranges to be handled by Chute TUN, instead of Chute proxy. In macOS version, these settings will be applied to system when "Set as System Proxy" is enabled. This option is used to fix compatibility problems with some apps.

• To specify a single domain, enter the domain name - for example, apple.com.
• To specify all websites on a domain, use an asterisk before the domain name - for example, *apple.com.
• To specify a specific part of a domain, specify each part - for example, store.apple.com.
• To specify hosts or networks by IP addresses, enter a specific IP address such as 192.168.2.11 or an address range, such as 192.168.2.* or 192.168.2.0/24.

Notice: If you enter an IP address or address range, you will only be able to bypass the proxy when you connect to that host using that address, not when you connect to the host by a domain name that resolves to that address.

Proxy Server Listening

interface = 127.0.0.1
port = 8118
socks-interface = 127.0.0.1
socks-port = 8119

interface / port control the listening address and port of the HTTP proxy server (default 127.0.0.1:8118). socks-interface / socks-port control the SOCKS5 proxy server (default 127.0.0.1:8119).

Inbound Proxy Authentication

http-auth = username:password

Requires clients to authenticate before using Chute's HTTP and SOCKS5 proxy servers. The line may be repeated to allow multiple credentials.

Bypass System Requests

bypass-system = true

When enabled, requests sent by system processes bypass Chute processing.

Default: true.

Always Real IP

always-real-ip = *.example.com, tracker.example.org

When Chute serves fake IP addresses for hijacked DNS queries (see hijack-dns), hostnames matching this comma-separated list are always answered with their real resolved IP addresses instead. Wildcards are supported.

Interrupt Existing Connections

interrupt-exist-connections = true

When enabled, changing the selected policy in any policy group (via URL Test, Fallback, Load Balance, SSID, or manual selection) will gracefully tear down existing connections that were using the old policy. This ensures connections use the newly selected proxy immediately rather than lingering on the old one.

Each affected connection is closed gracefully with a 3-second timeout before being force-closed.

Default: false. This is a global setting — it affects all policy groups.

Network Framework (macOS / tvOS)

network-framework = true

Enable Apple Network.framework for outbound connections. Using Network.framework can provide better performance and modern TLS stack integration on supported platforms.

Default: true on macOS, false on iOS and tvOS.

Exclude Simple Hostnames

exclude-simple-hostnames = true

When enabled, requests to simple hostnames (single-label names without a dot, e.g. localhost) bypass proxy rules and are resolved locally. This helps avoid unnecessary DNS lookups for local network names.

Default: false.

Disable Database Record

disable-db-record = true

When enabled, Chute stops writing traffic records to the local database. This can improve performance and reduce storage usage, but traffic history will not be available in Chute Dashboard.

Default: false.

Menu Bar Speed Display (Mac Only)

menu-bar-show-speed = true

When enabled, Chute Mac shows the current upload and download speed in the menu bar.

Default: false.

Hijack Other DNS Servers

hijack-dns = 8.8.8.8:53

By default, Chute only returns fake IP addresses for DNS queries sent to Chute DNS address (198.18.0.2). Queries which are sent to standard DNS will be simply forwarded.

Some devices or softwares always use a hardcode DNS server. (For example, Google Speakers always use 8.8.8.8). You may use this option to hijack the query to get a fake address.

You may usehijack-dns = *:53to hijack all DNS queries.

Excluded Routes

tun-excluded-routes = 192.168.0.0/16, 10.0.0.0/8, 172.16.0.0/12

Chute VIF can only process TCP and UDP protocols. Use this option to bypass specific IP ranges to allow all traffic to pass through.

Notice: This option only works for the VIF (utun) type of Enhanced Mode — it has no effect when using the PacketTunnel VPN type. Requests handled by Chute Proxy Server will not be affected. Combine 'skip-proxy' and 'tun-excluded-routes' to make sure that certain HTTP traffic bypasses Chute.

This option might cause a system error ENOMEM (Cannot allocate memory). It seems a bug in iOS system. Please do not use this option if possible.

Included Routes

tun-included-routes = 192.168.1.12/32

By default, the Chute VIF interface will declare itself as the default route. But since the Wi-Fi interface has a smaller route, some traffic may not go through the Chute VIF interface. Use this option to add a smaller route.

Note: This option only works for the VIF (utun) type of Enhanced Mode — it has no effect when using the PacketTunnel VPN type.

Protocol Sniffing

sniffing-enabled = true
sniffing-timeout = 100

Chute can detect the actual protocol of a connection by inspecting the initial bytes. This enables rules like PROTOCOL,TLS,Proxy to work correctly even for non-HTTP inbound connections.

sniffing-enabled (Default: false)

sniffing-enabled = true

Enable protocol detection for TCP connections.

sniffing-timeout (Default: 100ms)

sniffing-timeout = 200

Maximum time in milliseconds to wait for the initial data to determine the protocol. Increase this value if protocol detection fails on slow connections.

Block QUIC

block-quic = auto

Controls whether Chute rejects detected QUIC traffic, including HTTP/3. QUIC runs over UDP and cannot be decrypted by Chute's HTTP MITM. Rejecting QUIC can prompt compatible clients to retry over TCP, allowing TCP-based proxy handling and, when configured, HTTPS decryption to apply.

For traffic entering through TUN, Chute replies to a rejected QUIC flow with an ICMP/ICMPv6 Port Unreachable message so compatible clients can fall back without waiting for a QUIC timeout.

QUIC detection for block-quic is automatic and does not require sniffing-enabled; sniffing-enabled controls TCP protocol sniffing. Use a PROTOCOL,QUIC,... rule when you need rule-based handling of individual QUIC flows.

Bypass TUN

bypass-tun = 192.168.0.0/16, 10.0.0.0/8

Similar to skip-proxy, but works at the TUN/VIF routing level. Connections to these IP ranges will bypass the TUN interface entirely and go through the system network stack directly.

Note: This option only works for the VIF (utun) type of Enhanced Mode. It has no effect when using the PacketTunnel VPN type.

Show Error Page for Reject

show-error-page-for-reject = true

When enabled, Chute returns a user-friendly error page for rejected requests instead of simply dropping the connection.

Optimistic DNS

optimistic-dns = false

When enabled, Chute returns the cached DNS result immediately while refreshing the record in the background. This reduces connection latency at the cost of possibly returning stale DNS records.

Default: true. Set optimistic-dns = false to disable.

Allow Wi-Fi Access

allow-wifi-access = true

Intended to allow other devices on the same Wi-Fi network to access Chute's HTTP/SOCKS5 proxy ports. The switch is shown in the Chute apps and the value is preserved in the configuration.

Notice: The kernel currently stores this flag but does not enforce it yet.

Managed Configuration

Chute supports remotely managed configuration through the #!MANAGED-CONFIG header at the top of the configuration file:

#!MANAGED-CONFIG https://example.com/config.conf interval=86400 strict=false

Chute will periodically re-fetch the configuration from the specified URL and apply it. See Managed Configuration for details.

Replica / Traffic Recording

The [Replica] section controls traffic recording behavior and filtering:

[Replica]
hide-apple-request = true
hide-udp = true
hide-crashlytics-request = true
use-keyword-filter = false
keyword-filter = example

The replica key in [General] (replica = true) enables traffic recording. Use the [Replica] section to filter what gets recorded.

External Controller Access (Chute Dashboard)

external-controller-access = [email protected]:6155

Starts the remote control server used by Chute Dashboard. The value is password@host:port; a username may optionally precede the password (user:password@host:port). A companion USB channel is opened on port + 1.

HTTP Control API and Web UI

[General]
external-http-controller = 127.0.0.1:9090
external-http-secret = your-secret-token
external-http-ui = true
external-http-cors = false

Chute provides an embedded HTTP control API and web-based management UI, similar to Clash and Surge dashboards. The API exposes kernel status, traffic, connections, DNS, policy controls, and configuration management through REST endpoints.

external-http-controller (Default: disabled)

external-http-controller = 127.0.0.1:9090

The address and port for the HTTP control server. Use 127.0.0.1 for local-only access. Binding to 0.0.0.0 or a non-loopback address enables remote access and requires a non-empty external-http-secret.

external-http-secret (Default: empty)

external-http-secret = your-secret-token

The Bearer token used for API authentication. Requests must include the header Authorization: Bearer <secret>. Required when the controller is bound to a non-loopback address or when remote access is desired.

external-http-ui (Default: true)

external-http-ui = true

When enabled, Chute serves an embedded Web UI at the controller address. The Web UI provides an overview dashboard, connection management, DNS inspection, traffic monitoring, policy controls, and configuration editing. Set to false to keep the API enabled while disabling the UI.

external-http-cors (Default: false)

external-http-cors = true

Enable CORS (Cross-Origin Resource Sharing) headers on API responses. Useful when the Web UI or third-party tools need to access the API from a different origin.

API Endpoints:

Note: This feature is disabled by default. The API uses JSON responses with the format {"ok": true, "data": {...}} for success and {"ok": false, "error": {"code": "...", "message": "..."}} for errors.