Outbounds

outbounds is the array of upstream targets. Each entry is one OutboundDetourConfig: a protocol name, a protocol-specific settings object, and optional transport (streamSettings), chaining (proxySettings) and multiplexing (mux) blocks. The first entry in the array is the default outbound — traffic that matches no routing rule goes there.

Options

Field	Type	Default	Allowed values	Description
protocol	string	—	freedom | direct | blackhole | block | loopback | http | socks | shadowsocks | vless | vmess | trojan | hysteria | dns | wireguard	Which outbound handler to dial with. Lowercased before the registry lookup. `direct` is an alias for `freedom`, `block` for `blackhole`.
sendThrough	*string	0.0.0.0	—	Local source address to dial from. Accepts an IP, a CIDR (a random address inside it is used per connection), or the special domains `origin` / `srcip`.
tag	string	—	—	Unique name for this outbound. Referenced by routing rules, balancers, proxySettings chains and stats counters.
settings	*json.RawMessage	—	—	Protocol-specific settings object, decoded by the handler selected by protocol. See the per-protocol pages for each shape.
streamSettings	*StreamConfig	—	—	Transport and security for outgoing connections (raw / ws / grpc / xhttp…, tls / reality). See the Transport and TLS pages.
proxySettings	*ProxyConfig	—	—	Chain this outbound through another one, addressed by tag. Fields below.
mux	*MuxConfig	—	—	Mux multiplexing over the underlying connection. Fields below.
targetStrategy	string	AsIs	AsIs | UseIP | UseIPv4 | UseIPv6 | UseIPv4v6 | UseIPv6v4 | ForceIP | ForceIPv4 | ForceIPv6 | ForceIPv4v6 | ForceIPv6v4	How to resolve the target domain before dialing (matched case-insensitively). Use* prefers the given families with fallback, Force* refuses to fall back. An unknown value is a startup error.

Source: infra/conf/xray.go:213-222 · pinned at v26.7.28 (5ca6f4b)

Chaining (proxySettings)

Field	Type	Default	Allowed values	Description
tag	string	—	—	Tag of the outbound to relay through.
transportLayer	bool	false	true | false	Chain at the transport layer instead of the application layer — equivalent to sockopt.dialerProxy, so the two must not be combined.

Source: infra/conf/transport_internet.go:312-317 · pinned at v26.7.28 (5ca6f4b)

Multiplexing (mux)

Field	Type	Default	Allowed values	Description
enabled	bool	false	true | false	Turn Mux on for TCP traffic through this outbound.
concurrency	int16	—	—	Maximum concurrent streams per physical connection. A negative value disables Mux entirely, including the XUDP path.
xudpConcurrency	int16	—	—	Separate concurrency for XUDP (UDP-over-Mux) connections.
xudpProxyUDP443	string	reject	reject | allow | skip	What to do with proxied UDP/443 (QUIC) traffic inside XUDP: reject it, allow it, or skip Mux for it.

Source: infra/conf/xray.go:102-107 · pinned at v26.7.28 (5ca6f4b)

Minimal example

{
  "outbounds": [
    {
      "tag": "proxy",
      "protocol": "vless",
      "settings": {
        "vnext": [
          {
            "address": "example.com",
            "port": 443,
            "users": [{ "id": "uuid", "encryption": "none" }]
          }
        ]
      },
      "streamSettings": { "security": "tls" }
    },
    { "tag": "direct", "protocol": "freedom", "settings": {} },
    { "tag": "block", "protocol": "blackhole", "settings": {} }
  ]
}

Notes

• Ordering matters: routing sends unmatched traffic to the first outbound. Keep the proxy or freedom entry you want as the default at index 0.
• proxySettings.tag conflicts with streamSettings.sockopt.dialerProxy — configuring both is rejected at startup. With transportLayer: true the chain is rewritten into exactly that sockopt internally.
• sendThrough with a CIDR picks a random source address inside the range for every connection — useful with a routed IPv6 prefix.
• The dns protocol is a special outbound that intercepts DNS queries; see DNS.

Cross-core notes

• sing-box models the same concept as a flat object per entry (type + tag + fields at one level) and has no implicit "first is default" rule — the default is route.final. See sing-box Outbounds.
• mihomo calls these proxies and always dispatches through proxy groups or rules rather than an ordered default.

Source: infra/conf/xray.go:213-222 · v26.7.28 (5ca6f4b)