Snell — mihomo

Snell is Surge's lightweight proxy protocol. mihomo implements both a Snell outbound (to connect to a Snell server) and, more recently, a Snell inbound listener (to act as one). Both sides support the simple-obfs obfuscation layer with http or tls modes.

Outbound

Entry under proxies: with type: snell. Embeds BasicOption (common outbound fields).

Field	Type	Default	Allowed values	Description
name	string	(required)	<string>	Unique proxy name.
server	string	(required)	<host>	Upstream server hostname or IP.
port	int	(required)	<port>	Upstream server port.
psk	string	(required)	<string>	Pre-shared key (password).
udp	bool	false	true | false	Enable UDP relaying (Snell v2+).
version	int	(server default)	1 | 2 | 3	Snell protocol version.
reuse	bool	false	true | false	Reuse underlying connections.
obfs-opts	map[string]any	(disabled)	{ mode, host }	Obfuscation options, e.g. `{ mode: http|tls, host: <host> }`.

Source: adapter/outbound/snell.go:26-36 · pinned at v1.19.27 (5184081)

Inbound

Entry under listeners: with type: snell. Embeds BaseOption (listen, port).

Field	Type	Default	Allowed values	Description
psk	string	(required)	<string>	Pre-shared key (password).
version	int	(server default)	1 | 2 | 3	Snell protocol version.
udp	bool	false	true | false	Enable UDP relaying (Snell v2+).
obfs-opts	SnellObfsOption	(disabled)	SnellObfsOption	Obfuscation options.

Source: listener/inbound/snell.go:12-18 · pinned at v1.19.27 (5184081)

obfs-opts

Field	Type	Default	Allowed values	Description
mode	string	(unset)	http | tls	Obfuscation mode.
host	string	(unset)	<host>	Obfuscation host header.

Source: listener/inbound/snell.go:24-27 · pinned at v1.19.27 (5184081)

Examples

Outbound — plain Snell:

proxies:
  - name: snell-srv
    type: snell
    server: example.com
    port: 44046
    psk: <pre-shared-key>
    version: 3
    udp: true

Outbound — Snell with HTTP obfuscation:

proxies:
  - name: snell-obfs
    type: snell
    server: example.com
    port: 44046
    psk: <pre-shared-key>
    version: 3
    obfs-opts:
      mode: http
      host: bing.com

Inbound under listeners:

listeners:
  - name: snell-in
    type: snell
    listen: 0.0.0.0
    port: 44046
    psk: <pre-shared-key>
    version: 3
    udp: true
    obfs-opts:
      mode: tls
      host: bing.com

Notes

• psk is the shared secret; the outbound and inbound must use the same value.
• UDP relaying requires Snell v2 or newer — enabling udp on a v1 peer is rejected.
• reuse (outbound only) reuses the underlying connection. It is implied for Snell v2; for v4 it is opt-in via this field.
• obfs-opts.mode selects the simple-obfs transport: http wraps the stream in a fake HTTP request, tls in a fake TLS record. The host sets the obfuscation host header. Leave obfs-opts unset for no obfuscation. Both sides must agree on the mode and host.

Cross-core notes

• Snell is Surge-specific. Neither Xray-core nor sing-box supports it — there is no equivalent outbound or inbound in either core.

Source: adapter/outbound/snell.go:26-36 · v1.19.27 (5184081)