Outbound ​

Clash has several types of outbound. Each type has its own characteristics and use cases. In this page, we will introduce the general characteristics of each type and how to configure them.

Proxies ​

Proxies are configurable outbound targets. Just like a proxy server, you define the destination for data packets here.

Shadowsocks ​

Clash supports the following Shadowsocks cipher methods:

Clash also supports popular Shadowsocks plugins obfs and v2ray-plugin.

ShadowsocksR ​

Clash also supports the notoriously censorship-circumvention protocol ShadowsocksR.

Supported ShadowsocksR cipher methods:

Supported obfuscation methods:

• plain
• http_simple
• http_post
• random_head
• tls1.2_ticket_auth
• tls1.2_ticket_fastauth

Supported protocols:

• origin
• auth_sha1_v4
• auth_aes128_md5
• auth_aes128_sha1
• auth_chain_a
• auth_chain_b

Vmess ​

Clash supports the following Vmess cipher methods:

• auto
• aes-128-gcm
• chacha20-poly1305
• none

- name: "vmess"
  type: vmess
  # interface-name: eth0
  # routing-mark: 1234
  server: server
  port: 443
  uuid: uuid
  alterId: 32
  cipher: auto
  # udp: true
  # tls: true
  # skip-cert-verify: true
  # servername: example.com
  # network: ws
  # ws-opts:
  #   path: /path
  #   headers:
  #     Host: v2ray.com

- name: "vmess-http"
  type: vmess
  # interface-name: eth0
  # routing-mark: 1234
  server: server
  port: 443
  uuid: uuid
  alterId: 32
  cipher: auto
  # udp: true
  # network: http
  # http-opts:
  #   # method: "GET"
  #   # path:
  #   #   - '/'
  #   # headers:
  #   #   Connection:
  #   #     - keep-alive

- name: "vmess-h2"
  type: vmess
  # interface-name: eth0
  # routing-mark: 1234
  server: server
  port: 443
  uuid: uuid
  alterId: 32
  cipher: auto
  network: h2
  tls: true
  h2-opts:
    host:
      - http.example.com
      - http-alt.example.com
    path: /

- name: vmess-grpc
  type: vmess
  # interface-name: eth0
  # routing-mark: 1234
  server: server
  port: 443
  uuid: uuid
  alterId: 32
  cipher: auto
  network: grpc
  tls: true
  servername: example.com
  # skip-cert-verify: true
  grpc-opts:
    grpc-service-name: "example"

Socks5 ​

Clash also supports Socks5 proxy.

HTTP ​

Clash also supports HTTP proxy.

- name: "http"
  type: http
  # interface-name: eth0
  # routing-mark: 1234
  server: server
  port: 443
  # username: username
  # password: password

- name: "http"
  type: http
  # interface-name: eth0
  # routing-mark: 1234
  server: server
  port: 443
  # username: username
  # password: password
  tls: true
  skip-cert-verify: true

Snell ​

As an optional anti-censorship protocol, Clash also integrates support for Snell.

Trojan ​

Clash has built-in support for the popular Trojan protocol.

- name: "trojan"
  type: trojan
  # interface-name: eth0
  # routing-mark: 1234
  server: server
  port: 443
  password: yourpsk
  # udp: true
  # sni: example.com
  # alpn:
  #   - h2
  #   - http/1.1
  # skip-cert-verify: true

- name: trojan-grpc
  type: trojan
  # interface-name: eth0
  # routing-mark: 1234
  server: server
  port: 443
  password: "example"
  network: grpc
  sni: example.com
  # skip-cert-verify: true
  udp: true
  grpc-opts:
    grpc-service-name: "example"

- name: trojan-ws
  type: trojan
  # interface-name: eth0
  # routing-mark: 1234
  server: server
  port: 443
  password: "example"
  network: ws
  sni: example.com
  # skip-cert-verify: true
  udp: true
  # ws-opts:
    # path: /path
    # headers:
    #   Host: example.com

Proxy Groups ​

Proxy Groups are used to distribute requests from rules according to different strategies. They can be referenced directly by rules, or referenced by other proxy groups, with the top-level proxy groups being referenced by rules.

relay ​

Requests are relayed through the specified proxy servers in sequence. UDP is not currently supported. The specified proxy servers should not contain another relay.

url-test ​

Clash periodically sends HTTP HEAD requests to each proxy server in the list via the specified URL to test latency. You can set the maximum tolerance, test interval, and target URL.

fallback ​

Clash periodically sends HTTP HEAD requests to each proxy server in the list via the specified URL to test availability. The first available server will be used.

load-balance ​

Requests with the same eTLD+1 will use the same proxy server.

select ​

By default, Clash uses the first proxy in the group on startup. Users can use the RESTful API to select which proxy to use. In this mode, you can hardcode servers in the configuration or use Proxy Providers to dynamically add servers.

In either case, sometimes you may also use a direct connection to route packets. In this case, you can use the DIRECT direct outbound.

To use a different network interface, you need a proxy group that includes DIRECT and set the interface-name option.

Proxy Providers ​

Proxy Providers allow users to dynamically load proxy server lists instead of hardcoding them in the configuration file. Currently there are two types of proxy providers:

• http: Clash loads the server list from the specified URL on startup. If the interval option is set, Clash periodically pulls the server list from the remote.
• file: Clash loads the server list from the specified file path on startup. Health checks are available for both modes and are exactly the same as fallback in proxy groups.