Endpoints

endpoints hold protocol stacks that are inbound and outbound at once: a WireGuard or Tailscale instance both accepts connections arriving through the tunnel and originates connections into it. The entry shape is the same flat envelope as inbounds and outbounds — type / tag plus the selected type's own fields at the same level.

Envelope

Field	Type	Default	Allowed values	Description
type	string	—	wireguard | tailscale	Endpoint type. Selects which option struct the rest of the object is decoded into.
tag	string	—	—	Unique name for this endpoint. Usable wherever an outbound tag is expected, and matchable by route rules on the inbound side.

Source: option/endpoint.go:16-20 · pinned at v1.13.15 (3708fa1)

Per-type fields are documented on WireGuard and Tailscale.

Minimal example

{
  "endpoints": [
    {
      "type": "wireguard",
      "tag": "wg-ep",
      "address": ["10.0.0.2/32"],
      "private_key": "<base64-private-key>",
      "peers": [
        {
          "address": "wg.example.com",
          "port": 51820,
          "public_key": "<base64-public-key>",
          "allowed_ips": ["0.0.0.0/0"]
        }
      ]
    }
  ],
  "route": { "final": "wg-ep" }
}

Notes

• Endpoints replaced the removed wireguard outbound in 1.13.0 — the same struct now covers both directions of the tunnel.
• wireguard requires a build with the with_wireguard tag, tailscale one with with_tailscale (official release binaries include both).
• Route rules can match traffic coming out of an endpoint the same way they match an inbound tag.

Cross-core notes

• Xray-core keeps WireGuard as a normal inbound or outbound protocol (protocol: "wireguard" with IsClient decided by position). See Xray WireGuard.
• mihomo models WireGuard as a proxy (outbound) only. See mihomo WireGuard.

Source: option/endpoint.go:16-20 · v1.13.15 (3708fa1)