Inbounds

inbounds is the array of listening services. Each entry is one InboundDetourConfig: a protocol name, where to listen, a protocol-specific settings object, and optional transport (streamSettings) and traffic detection (sniffing) blocks. The settings payload is kept as raw JSON and decoded by whichever handler protocol selects.

Options

Field	Type	Default	Allowed values	Description
protocol	string	—	dokodemo-door | tunnel | http | socks | mixed | shadowsocks | vless | vmess | trojan | wireguard | hysteria | tun	Which inbound handler to run. The name is lowercased before the registry lookup, so matching is case-insensitive. `tunnel` is an alias for `dokodemo-door`, `mixed` shares the SOCKS handler (HTTP + SOCKS on one port).
port	*PortList	—	<int> | "<from>-<to>" | "port,port,..."	Port(s) to listen on: a single integer, a range string, or a comma-separated list of both. Required for socket-based protocols; `tun` ignores it and reads from a network interface instead.
listen	*Address	0.0.0.0	—	Address to bind. Defaults to all interfaces; set 127.0.0.1 to keep a local-only inbound.
settings	*json.RawMessage	—	—	Protocol-specific settings object, decoded by the handler selected by protocol. See the per-protocol pages for each shape.
tag	string	—	—	Unique name for this inbound. Referenced by routing rules (inboundTag) and used to label stats counters.
streamSettings	*StreamConfig	—	—	Transport and security for the listener (raw / ws / grpc / xhttp…, tls / reality). See the Transport and TLS pages.
sniffing	*SniffingConfig	—	—	Traffic-type detection on accepted connections. Fields below.

Source: infra/conf/xray.go:126-134 · pinned at v26.7.28 (5ca6f4b)

Sniffing (sniffing)

Field	Type	Default	Allowed values	Description
enabled	bool	false	true | false	Turn sniffing on for this inbound.
destOverride	StringList	—	"http" | "tls" | "quic" | "fakedns" | "fakedns+others"	Protocol list whose sniffed destination replaces the original target address. `https` and `ssl` are accepted as aliases of `tls`.
domainsExcluded	StringList	—	—	Domains that keep their original destination even when sniffing matched.
ipsExcluded	StringList	—	—	Destination IPs / CIDRs excluded from destination override.
metadataOnly	bool	false	true | false	Only use connection metadata for detection; do not inspect payload bytes.
routeOnly	bool	false	true | false	Use the sniffed domain for routing decisions only, without rewriting the destination.

Source: infra/conf/xray.go:55-62 · pinned at v26.7.28 (5ca6f4b)

Minimal example

{
  "inbounds": [
    {
      "tag": "socks-in",
      "protocol": "socks",
      "listen": "127.0.0.1",
      "port": 1080,
      "settings": { "udp": true },
      "sniffing": {
        "enabled": true,
        "destOverride": ["http", "tls"]
      }
    }
  ]
}

Notes

• An unknown protocol fails at startup with unknown config id; the lookup table is a fixed registry, not a plugin system.
• tag must be unique across inbounds — routing rules and the stats subsystem address inbounds by tag.
• tun is the one inbound that needs no port: it captures packets from a network interface. See TUN.
• Sniffing rewrites the destination before routing runs, which is what lets domain rules match connections that arrived by IP. routeOnly restricts the effect to routing.

Cross-core notes

• sing-box models the same concept as a flat object per entry — type + tag + type-specific fields merged at one level, instead of a nested settings block. See sing-box Inbounds.
• mihomo has no inbounds array at the top level: the common listeners are individual root keys (port, socks-port, mixed-port, …) plus a listeners list for extra entries. See HTTP & SOCKS and Redirect & TProxy.

Source: infra/conf/xray.go:126-134 · v26.7.28 (5ca6f4b)