Proxy Policy

A proxy policy indicates forwarding the request to another proxy server. Chute supports HTTP/HTTPS/SOCKS5/SOCKS5-TLS/SS/SSR/Trojan/VMess/VLESS/AnyTLS/TUIC/Hysteria2/WireGuard/ShadowTLS/MASQUE/SSH proxy protocols.

Section [Proxy] declares proxy policies. You can create multiple proxies for different rules.

Example:

[Proxy]
ProxyHTTP = http, 1.2.3.4, 443, username, password
ProxyHTTPS = https, 1.2.3.4, 443, username, password, sni=example.com
ProxySOCKS5 = socks5, 1.2.3.4, 443, username, password
ProxySOCKS5TLS = socks5-tls, 1.2.3.4, 443, username, password, sni=example.com
SS = ss, 1.2.3.4, 443, method, password, obfs=http
SSR = ssr, 1.2.3.4, 443, method, password, protocol=auth_chain_f, protocol_param=user:pass, obfs=http_post, obfs_param=example.com
Trojan = trojan, 1.2.3.4, 443, password=password, tls=true, sni=example.com, skip-cert-verify=false, ws=true
VMess = vmess, 1.2.3.4, 443, uuid=uuid, sni=example.com, tls=true, ws=true
VLESS = vless, 1.2.3.4, 443, uuid=uuid, sni=example.com, xtls=true
AnyTLS = anytls, 1.2.3.4, 443, password, sni=example.com
TUIC = tuic, 1.2.3.4, 443, uuid=uuid, password=password, sni=example.com
Hysteria2 = hysteria2, 1.2.3.4, 443, auth=password, sni=example.com, up=10, down=100
WireGuard = wireguard, private-key=base64key, peer-public-key=base64key, section-name=wg0, self-ip=10.0.0.2
ShadowTLS = shadowtls, 1.2.3.4, 443, password=password, sni=example.com, skip-cert-verify=false, fingerprint=chrome
ProxyMASQUE = masque, 1.2.3.4, 443, token=auth-token, mode=connect-udp, sni=example.com, alpn=h3, skip-cert-verify=false
SSH = ssh, 1.2.3.4, 22, root, password=pw
SCHEME = scheme, ssr://....

Notice: A Trojan policy needs an explicit tls=true — TLS is not implied.

Parameters

Parameter for proxy with TLS

tls: Optional.

tls=true

Enable TLS transportation.

skip-cert-verify: Optional

skip-cert-verify=true

If this option is enabled, Chute will not verify the server's certificate.

sni (Default: hostname)

sni=exmaple.com

You may customize Server Name Indication (SNI) during TLS handshake. By default Chute will send SNI with hostname like most browsers.

fingerprint: Optional.

fingerprint=chrome

Present a browser's TLS ClientHello instead of the system one, so the handshake does not stand out as belonging to a proxy client. Supported values are chrome, firefox, safari and ios, plus edge, 360, qq, android and random, which are all handled as Chrome.

This applies to Trojan, VMess and VLESS over TLS, including their WebSocket and gRPC transports. REALITY and ShadowTLS take the same option in their own sections. To set one fingerprint for every policy that does not name its own, use global-client-fingerprint.

Setting a fingerprint also turns on post-quantum key exchange: Chute then offers the X25519MLKEM768 hybrid group alongside X25519, so the session cannot be decrypted later by an attacker who records it today and gains a quantum computer tomorrow. A server that does not understand the group simply picks X25519, so nothing breaks. Without a fingerprint the connection uses the system TLS stack, which does not offer it — the same reason ECH needs a fingerprint.

Parameter for proxy with Shadowsocks

method: Required.

Current support:

rc4-md5
aes-128-cfb
aes-192-cfb
aes-256-cfb
aes-128-ctr
aes-192-ctr
aes-256-ctr
bf-cfb
camellia-128-cfb
camellia-192-cfb
camellia-256-cfb
salsa20
chacha20
chacha20-ietf
aes-128-gcm
aes-192-gcm
aes-256-gcm
chacha20-ietf-poly1305
xchacha20-ietf-poly1305

Shadowsocks 2022 Methods

Chute supports the Shadowsocks 2022 protocol, which uses BLAKE3-based key derivation and AEAD ciphers. The method name determines the cipher suite:

2022-blake3-aes-128-gcm
2022-blake3-aes-256-gcm
2022-blake3-chacha20-poly1305

Password format:

The password field for SS2022 consists of one or two base64-encoded keys, separated by : (colon).

Single-user mode (one key):

SS2022 = ss, 1.2.3.4, 443, 2022-blake3-aes-256-gcm, "base64-key"

Multi-user mode with identity headers (two keys):

For 2022-blake3-aes-128-gcm and 2022-blake3-aes-256-gcm, you can provide an identity header key and a user key, separated by ::

SS2022 = ss, 1.2.3.4, 443, 2022-blake3-aes-256-gcm, "header-base64-key:user-base64-key"

Each key is a base64-encoded string (supports both standard and URL-safe base64). The key lengths required:

Generate a key:

openssl rand -base64 32

Note: SS2022 methods do not support the obfs parameter. The 2022-blake3-chacha20-poly1305 method does not support multi-user mode.

Shadowsocks AEGIS Methods

Chute also supports the AEGIS family of AEAD ciphers. They are built on the AES round function and are markedly faster than AES-GCM or ChaCha20-Poly1305 on any processor with hardware AES, which includes every recent iPhone, iPad, Apple TV and Mac:

aegis-128l
aegis-256

They are configured like the classic AEAD methods above — the password is an ordinary passphrase, not a base64 key:

AEGIS = ss, 1.2.3.4, 443, aegis-128l, your-password

Everything else follows SIP004 unchanged: the salt is as long as the key, the session subkey is HKDF-SHA1(key, salt, "ss-subkey"), TCP payload is carried in length-prefixed AEAD chunks with the nonce incremented after each operation, and UDP uses an all-zero nonce.

You have to run the server yourself. AEGIS is not part of the Shadowsocks specification — no SIP defines it, and no mainstream Shadowsocks server implements it, including shadowsocks-rust, shadowsocks-libev, shadowsocks-go, sing-box and Xray. Choosing one of these methods only works against a server you operate that has been built to support them. If you are pointing Chute at a commercial or shared node, use one of the interoperable methods above instead.

obfs: Optional.

Current support:

tls
http

obfs_param: Optional.

obfs_param=example.com

Sets the Host used by the obfs layer. Defaults to cloudfront.net when unset.

Parameter for proxy with ShadowsocksR/ShadowsocksRR/ShadowsocksR-Akarin

method: Required.

Current support:

rc4
rc4-md5-6
rc4-md5
aes-128-cfb
aes-192-cfb
aes-256-cfb
aes-128-ctr
aes-192-ctr
aes-256-ctr
bf-cfb
camellia-128-cfb
camellia-192-cfb
camellia-256-cfb
cast5-cfb
des-cfb
idea-cfb
rc2-cfb
seed-cfb
salsa20
chacha20
chacha20-ietf

protocol: Optional.

Current support:

origin
auth_sha1
auth_sha1_v2
auth_sha1_v4
auth_aes128_md5
auth_aes128_sha1
auth_chain_a
auth_chain_b
auth_chain_c
auth_chain_d
auth_chain_e
auth_chain_f
auth_akarin_rand
auth_akarin_spec_a

protocol_param: Optional.

obfs: Optional.

Current support:

plain
http_simple
http_post
tls1.2_ticket_auth

obfs_param: Optional.

Parameter for proxy with WebSocket

ws: Optional.

ws=true

Enable WebSocket transportation.

ws-path: Optional.

ws-path=/exmaple

Change the path of the WebSocket HTTP request.

ws-headers: Optional.

ws-headers=Header1:Value1|Header2:Value2

Modify the HTTP header of WebSocket HTTP request.

Parameter for proxy with gRPC

gRPC transport is available for Trojan, VMess, and VLESS protocols. It uses HTTP/2-based gRPC framing over TLS, which can help bypass certain network restrictions.

grpc: Optional.

grpc=true

Enable gRPC transportation. Requires TLS to be enabled.

grpc-service-name: Required when grpc=true.

grpc-service-name=MyService

Specify the gRPC service name/path for multiplexing. It must match the service name configured on the server; there is no default.

grpc-multi-mode: Optional.

grpc-multi-mode=true

Enable multi-mode for gRPC, which allows multiple streams to share a single gRPC connection for better performance.

Example with VMess and gRPC:

VMess = vmess, 1.2.3.4, 443, uuid=uuid, tls=true, grpc=true, grpc-service-name=GunService, sni=example.com

Parameter for proxy with XHTTP

XHTTP transport is available for Trojan, VMess, and VLESS protocols. Instead of holding one connection open, it carries the tunnel inside ordinary HTTP requests: the download arrives as one long-lived response, and the upload goes out either as a series of POSTs or as one long-lived POST. That makes it usable through a CDN, which is the main reason to choose it over WebSocket or gRPC.

The HTTP version is not configured directly. Without TLS it is HTTP/1.1; with TLS it is HTTP/2, unless alpn says exactly http/1.1 (HTTP/1.1) or exactly h3 (HTTP/3). REALITY always uses HTTP/2.

xhttp: Optional.

xhttp=true

Enable XHTTP transportation.

xhttp-mode: Optional.

xhttp-mode=packet-up

How the upload is carried. auto (the default) means packet-up, or stream-one when REALITY is in use.

• packet-up — the upload is a series of numbered POSTs. The most compatible choice, and the one CDNs handle best.
• stream-up — the upload is one long-lived POST, with the download on a separate request.
• stream-one — one request carries both directions. Needs a server and any middlebox in between to support full-duplex HTTP.

The server usually pins a mode; a mismatch is answered with 400.

xhttp-path: Optional.

xhttp-path=/yourpath

The request path. Defaults to /. It must match the path the server serves XHTTP on.

xhttp-host: Optional.

xhttp-host=example.com

The authority used in the Host header and the request URL. Defaults to sni, and to the server address when that is unset.

xhttp-headers: Optional.

xhttp-headers=Header1:Value1|Header2:Value2

Extra HTTP headers, in the same format as ws-headers.

xhttp-padding: Optional.

xhttp-padding=100-1000

Length range of the padding every request carries, as MIN-MAX or a single number. Defaults to 100-1000. The server requires padding and validates its length, so this has to stay inside the range the server accepts — a request with none, or with the wrong amount, is answered 400.

xhttp-max-post-bytes: Optional.

xhttp-max-post-bytes=1000000

Largest upload POST, in bytes. Defaults to 1000000. Larger writes are split across several POSTs.

xhttp-min-post-interval: Optional.

xhttp-min-post-interval=30

Minimum gap between consecutive upload POSTs, in milliseconds. Defaults to 30.

xhttp-xmux-max-concurrency, xhttp-xmux-max-connections, xhttp-xmux-max-reuse-times, xhttp-xmux-max-lifetime: Optional.

xhttp-xmux-max-concurrency=4

XMUX pools the underlying HTTP/2 connections so several tunnels share one, which looks like an ordinary browser session rather than a connection per tunnel. All four default to 0, which leaves pooling off.

• xhttp-xmux-max-concurrency — tunnels allowed to share one connection.
• xhttp-xmux-max-connections — connections allowed per server.
• xhttp-xmux-max-reuse-times — tunnels a connection serves before it stops taking new ones.
• xhttp-xmux-max-lifetime — seconds after which a connection stops taking new tunnels.

Note that mux=true is refused for an XHTTP policy: XHTTP brings its own multiplexing, and stacking the generic one on top would double it.

xhttp-download-server, xhttp-download-port: Optional.

xhttp-download-server=cdn.example.com

Route the download through a different address — a CDN in front of the same server, typically — while the upload keeps using the main one. Both must reach the same server: the session is server-side state, so a second route is fine but a second server is not.

Example with VLESS and XHTTP:

VLESS = vless, 1.2.3.4, 443, uuid=uuid, tls=true, xhttp=true, xhttp-mode=packet-up, xhttp-path=/yourpath, sni=example.com

Parameter for proxy with XTLS

xtls: Optional.

xtls=true

Enable XTLS transportation with the xtls-rprx-direct flow. For XTLS Vision, use the flow parameter instead.

flow: Optional.

flow = xtls-rprx-vision

Select the XTLS flow control. The only supported value is xtls-rprx-vision, which enables Vision framing; the flow value is sent to the server in the VLESS addons.

skip-cert-verify: Optional

skip-cert-verify=true

Same as TLS.

sni (Default: hostname)

sni=exmaple.com

Same as TLS.

Parameter for proxy with REALITY

REALITY is a TLS-based obfuscation technique that makes proxy traffic indistinguishable from regular TLS traffic to a real website. It can be used with the VLESS protocol.

reality: Optional.

reality=true

Enable REALITY obfuscation. Requires a target server that will act as the camouflage destination.

public-key: Required.

public-key=BASE64KEY

The server's X25519 public key (base64). The REALITY handshake cannot be constructed without it.

short-id: Optional.

short-id=abcd1234

A short identifier used for REALITY authentication. Typically a hex string.

server-name: Optional.

server-name=www.microsoft.com

The SNI (Server Name Indication) to present during the TLS handshake. This should be a real, commonly-accessed website for best camouflage effect. The target server's certificate must match this name.

fingerprint: Optional.

fingerprint=chrome

TLS client fingerprint to mimic. Supported values include chrome, firefox, safari, ios, edge, 360, qq, android, random. Using a common browser fingerprint helps avoid detection. Note that android and random are not distinct here — they are treated as chrome (with a warning logged).

spiderx: Optional.

spiderx=/path

Custom path for REALITY spider camouflage.

Example with VLESS:

VLESS = vless, 1.2.3.4, 443, uuid=uuid, reality=true, public-key=BASE64KEY, server-name=www.microsoft.com, short-id=abcd, fingerprint=chrome

Note: REALITY does not use a traditional certificate. The connection uses the camouflage server's real certificate.

Parameter for proxy with ECH

Encrypted Client Hello hides the server name from anyone watching the connection. The real name travels encrypted inside the handshake, while the name on the wire is the public_name published by the server's ECHConfig.

ECH is built on the same stack as the client fingerprint, so a policy must set fingerprint as well — without one, ech=true does nothing and the real name is sent in the clear. It applies to Trojan, VMess and VLESS over plain TLS, including their WebSocket transports.

Notice: The gRPC transport does not support ECH. With grpc=true, ech=true is silently ignored and the real server name is sent in the clear. (The client fingerprint and post-quantum key exchange do apply to gRPC.)

ech: Optional.

ech=true

Enable ECH. Unless ech-config is set, Chute looks the ECHConfig up in the server name's DNS HTTPS record, the same way a browser does.

ech-config: Optional.

ech-config=AEX+DQBBAAAgACD...

A base64 ECHConfigList, used instead of the DNS lookup. Set this when the server publishes no HTTPS record, or to pin a specific config.

ech-public-name: Optional.

ech-public-name=cover.example.com

Overrides the cover name sent in the clear. By default it is the public_name inside the ECHConfig, which is what the server expects; only set this for a deployment that fronts the config with a different host.

Example with Trojan:

Trojan = trojan, 1.2.3.4, 443, password=pw, tls=true, sni=secret.example.com, fingerprint=chrome, ech=true

If the server rejects ECH — most often because the config went stale — it answers under the cover name and presents that name's certificate, so the connection fails to authenticate rather than quietly continuing. Refresh ech-config, or remove it to go back to the DNS lookup.

TCP Fast Open (Experimental)

tfo: Optional

tfo=true

More information of TCP fast open could be read in Wikipedia. Enable TCP fast open may could unexpected connection fail.

Common Parameters

udp-relay: Optional (Default: true)

udp-relay=false

Marks the policy TCP-only. UDP relay is on by default where the protocol supports it; set udp-relay=false to exclude the policy from relaying UDP traffic.

mux: Optional

mux=true

Enable connection reuse / multiplexing. Aliases multiplex and reuse are also accepted. Supported by Trojan, VMess, VLESS, Hysteria2, Shadowsocks(R), ShadowTLS and MASQUE.

cert-fingerprint-sha256: Optional

cert-fingerprint-sha256=<hex>

Pin the server certificate by its SHA-256 fingerprint. The alias cert-fp is also accepted. Currently only effective for MASQUE.

encrypt-method (VMess): Optional (Default: auto)

encrypt-method=aes-128-gcm

VMess payload encryption. Supported values: aes-128-gcm, chacha20-poly1305, aes-128-cfb (alias legacy), none.

alpn: Optional

alpn=h2|http/1.1

Multiple ALPN values are separated with |.

underlying-proxy: Optional.

underlying-proxy=OtherProxy

Proxy chaining: the value names another policy that should carry this policy's traffic. Parsed and preserved when the configuration is saved, but not effective in the current kernel — a warning is logged and the policy still connects directly to its own server.

Notice: Importing a Clash/mihomo profile generates this option from dialer-proxy, so a policy may look chained after an import while its traffic is not.

test-url: Optional.

test-url=http://www.gstatic.com/generate_204

A per-policy latency test URL. Accepted and preserved when the configuration is saved, but never read: benchmarking always uses the url of the policy group that contains the policy. Unlike an unknown option, it produces no warning, since it is on the list of recognized options.

Parameter for proxy with AnyTLS

AnyTLS is a TLS-based proxy protocol with padding obfuscation.

AnyTLS = anytls, 1.2.3.4, 443, password, sni=example.com, skip-cert-verify=false

password: Required.

The password/passphrase used for authentication.

sni (Default: hostname)

sni=exmaple.com

Same as TLS.

skip-cert-verify: Optional

skip-cert-verify=true

Same as TLS.

Padding scheme: Optional

Padding is configured with stop=N plus numeric per-packet keys:

AnyTLS = anytls, 1.2.3.4, 443, password, sni=example.com, stop=2, 0=30-30, 1=100-400+c

Each scheme is a list of segments joined by + (or ,), where a segment is either c (check) or a min-max byte range (max 16384), e.g. stop=2, 0=30-30, 1=100-400+c.

Parameter for proxy with TUIC

TUIC is a QUIC-based proxy protocol offering multiplexed TCP and UDP relay.

TUIC = tuic, 1.2.3.4, 443, uuid=uuid, password=password, sni=example.com, skip-cert-verify=false, alpn=h3

uuid: Required.

The UUID for authentication.

password: Required.

The password for authentication.

sni (Default: hostname)

sni=exmaple.com

Same as TLS.

skip-cert-verify: Optional

skip-cert-verify=true

Same as TLS.

alpn: Optional

alpn=h3

Specify the ALPN string for QUIC connection.

Parameter for proxy with Hysteria2

Hysteria2 is a QUIC-based proxy protocol with Brutal congestion control for high-throughput scenarios.

Hysteria2 = hysteria2, 1.2.3.4, 443, auth=password, sni=example.com, skip-cert-verify=false, up=10, down=100, alpn=h3

auth: Required.

The authentication password/token.

sni (Default: hostname)

sni=exmaple.com

Same as TLS.

skip-cert-verify: Optional

skip-cert-verify=true

Same as TLS.

up: Optional (Mbps)

up=10

Upload bandwidth in Mbps.

down: Optional (Mbps)

down=100

Download bandwidth in Mbps.

alpn: Optional

alpn=h3

Specify the ALPN string for QUIC connection.

obfs: Optional

obfs=salamander

Enable Salamander obfuscation for the QUIC traffic. Salamander uses BLAKE2b-256 XOR to obfuscate QUIC packets, making them resistant to DPI (Deep Packet Inspection).

obfs-password: Optional

obfs-password=your-obfuscation-key

The password/key used for Salamander obfuscation. Required when obfs=salamander is set.

Parameter for proxy with WireGuard

WireGuard is a modern VPN protocol. Chute supports WireGuard as an outbound proxy policy, either inline or by referencing a named [WireGuard] section.

Inline configuration:

WireGuard = wireguard, private-key=base64key, peer-public-key=base64key, self-ip=10.0.0.2, server=1.2.3.4, port=51820

Section reference (recommended):

WireGuard = wireguard, section-name=wg0

See WireGuard Configuration for [WireGuard] section syntax.

private-key: Required (inline only).

Base64-encoded WireGuard private key.

peer-public-key: Required (inline only).

Base64-encoded WireGuard peer public key.

self-ip: Optional (inline).

Local IP address assigned to the WireGuard interface (e.g. 10.0.0.2).

self-ip-v6: Optional (inline).

Local IPv6 address assigned to the WireGuard interface.

server: Required.

Remote WireGuard server address (may come from the referenced [WireGuard] section instead of the policy line).

port: Required.

Remote WireGuard server port (may come from the referenced [WireGuard] section instead of the policy line).

preshared-key: Optional.

Base64-encoded pre-shared key for post-quantum resistance.

keepalive: Optional (seconds).

keepalive=25

Persistent keepalive interval for NAT traversal.

mtu: Optional.

mtu=1420

MTU for the WireGuard interface.

reserved: Optional.

reserved=0,1,2

Reserved bytes for the WireGuard packet header. Parsed but not effective in the current kernel — the value is unsupported by the BoringTun FFI and is ignored with a warning logged.

Parameter for proxy with ShadowTLS

ShadowTLS is a TLS-based proxy protocol that encapsulates traffic within a standard TLS 1.3 session. It uses a password-based handshake after the TLS handshake to authenticate and establish the proxy connection.

ShadowTLS = shadowtls, 1.2.3.4, 443, password=password, sni=example.com, skip-cert-verify=false, fingerprint=chrome

password: Required.

The password used for the ShadowTLS handshake authentication.

sni (Default: hostname)

sni=example.com

Same as TLS.

skip-cert-verify: Optional

skip-cert-verify=true

Same as TLS.

fingerprint: Optional

fingerprint=chrome

TLS client fingerprint to mimic. Supported values include chrome, firefox, safari, ios, edge, 360, qq, android, random. Using a common browser fingerprint helps avoid detection. Note that android and random are not distinct here — they are treated as chrome (with a warning logged).

Parameter for proxy with MASQUE

MASQUE is an HTTP/3-based proxy protocol that tunnels traffic over QUIC. A MASQUE policy requires type, host, and port. An authentication token is optional.

ProxyMASQUE = masque, 1.2.3.4, 443, token=auth-token, mode=connect-udp, sni=example.com, alpn=h3, skip-cert-verify=false, mux=true

token: Optional

token=auth-token

Optional Bearer authentication token for the MASQUE server. The alias masque-token= is also accepted.

mode: Optional

mode=connect-udp

Accepted for compatibility but does not change tunneling behavior: TCP flows always use a plain CONNECT tunnel and UDP flows always use connect-udp. The alias masque-mode= is also accepted.

mux: Optional

mux=true

Enable multiplexing over a shared QUIC connection (gated on the connection pool setting).

sni / alpn / skip-cert-verify: Optional

Same as TLS. Since MASQUE runs over QUIC, alpn=h3 is typically used.

Parameter for proxy with SSH

See SSH Proxy for full documentation.