Outbounds

outbounds is the array of upstream targets. Each entry is a flat object: the type / tag envelope plus the selected type's own fields at the same level. There is no "first outbound is default" rule — unmatched traffic goes to route.final.

Envelope

Field	Type	Default	Allowed values	Description
type	string	—	direct | block | selector | urltest | socks | http | shadowsocks | vmess | trojan | naive | tor | ssh | shadowtls | vless | anytls | hysteria | tuic | hysteria2	Outbound type. Selects which option struct the rest of the object is decoded into. An unregistered value fails at startup with "unknown outbound type".
tag	string	—	—	Unique name for this outbound. Referenced by route rules, route.final, group outbounds and dialer detour.

Source: option/outbound.go:19-23 · pinned at v1.13.15 (3708fa1)

Per-type fields are documented on the protocol pages: Direct, HTTP & SOCKS, Shadowsocks, VMess, Trojan, Naive, Tor, SSH, VLESS, AnyTLS, Hysteria2, TUIC. selector and urltest are group outbounds that pick among other tags.

Shared dial fields (DialerOptions)

Every dialing outbound embeds DialerOptions; the fields appear at the same flat level as the envelope.

Field	Type	Default	Allowed values	Description
detour	string	—	—	Dial through another outbound, addressed by its tag.
bind_interface	string	—	—	Network interface to bind outgoing connections to.
inet4_bind_address	*badoption.Addr	—	—	IPv4 source address to bind.
inet6_bind_address	*badoption.Addr	—	—	IPv6 source address to bind.
bind_address_no_port	bool	false	true | false	Set IP_BIND_ADDRESS_NO_PORT when binding — delays port allocation until connect. Linux only.
protect_path	string	—	—	Unix socket path of an Android VpnService protect daemon; each socket fd is sent there before dialing.
routing_mark	FwMark	—	—	SO_MARK (fwmark) to set on outgoing sockets. Linux only.
reuse_addr	bool	false	true | false	Set SO_REUSEADDR on outgoing sockets.
netns	string	—	—	Network namespace to dial from (name or path). Linux only.
connect_timeout	badoption.Duration	—	—	TCP connect timeout. Duration string, e.g. "5s".
tcp_fast_open	bool	false	true | false	Enable TCP Fast Open for outgoing connections.
tcp_multi_path	bool	false	true | false	Enable Multipath TCP for outgoing connections.
disable_tcp_keep_alive	bool	false	true | false	Turn TCP keep-alive off for outgoing connections.
tcp_keep_alive	badoption.Duration	—	—	Keep-alive idle period before probes start. Duration string.
tcp_keep_alive_interval	badoption.Duration	—	—	Interval between keep-alive probes. Duration string.
udp_fragment	*bool	false	true | false	Allow fragmenting UDP packets larger than the MTU instead of dropping them.
domain_resolver	*DomainResolveOptions	—	—	Which DNS server (by tag) resolves the server address, either a plain tag string or an object with per-dial overrides.
network_strategy	*NetworkStrategy	—	—	Strategy for picking among available networks (e.g. default / hybrid / fallback). Platform builds with network awareness only.
network_type	badoption.Listable[InterfaceType]	—	—	Preferred network types (wifi, cellular, ethernet, other) when network_strategy is used.
fallback_network_type	badoption.Listable[InterfaceType]	—	—	Network types to fall back to when the preferred ones are unavailable.
fallback_delay	badoption.Duration	—	—	Wait before starting the fallback dial (Happy-Eyeballs style). Duration string, e.g. "300ms".
domain_strategy	DomainStrategy	—	prefer_ipv4 | prefer_ipv6 | ipv4_only | ipv6_only	Address-family strategy when resolving the server domain.

Source: option/outbound.go:67-93 · pinned at v1.13.15 (3708fa1)

Shared server fields (ServerOptions)

Protocol outbounds that connect to a fixed server embed ServerOptions.

Field	Type	Default	Allowed values	Description
server	string	—	—	Server host name or IP.
server_port	uint16	—	—	Server port.

Source: option/outbound.go:148-151 · pinned at v1.13.15 (3708fa1)

Minimal example

{
  "outbounds": [
    {
      "type": "shadowsocks",
      "tag": "proxy",
      "server": "example.com",
      "server_port": 8388,
      "method": "2022-blake3-aes-128-gcm",
      "password": "<base64-key>"
    },
    { "type": "direct", "tag": "direct" }
  ],
  "route": { "final": "proxy" }
}

Notes

• The dns outbound was deprecated in 1.11.0 and removed in 1.13.0 — configuring one is an error; DNS hijacking is now a rule action. The wireguard outbound is likewise removed: use a WireGuard endpoint instead.
• shadowsocksr is registered only as a stub that errors (removed in 1.6.0). hysteria, tuic, hysteria2 and the naive outbound require a with_quic build (official release binaries include it).
• detour chains outbounds by tag; a chain that reaches itself is a startup error.
• When server is a domain, resolution follows domain_resolver / domain_strategy; without them the route's default DNS applies.

Cross-core notes

• Xray-core nests protocol fields in settings, chains with proxySettings, and treats the first array entry as the default route target. See Xray Outbounds.
• mihomo calls these proxies, with group types (select, url-test, fallback, load-balance) as separate proxy groups rather than outbound types.

Source: option/outbound.go:19-23 · v1.13.15 (3708fa1)