mihomo Documentation

mihomo accepts incoming traffic through three primary methods: Proxy Ports, TUN, and Listeners. The accessibility of these connections from the internet depends on the listening address, system routing, and firewall settings rather than the protocol category.

Methods of Configuration

1. Proxy Ports: Use top-level parameters like port, socks-port, mixed-port, redir-port, and tproxy-port when you only need a single fixed set of proxy ports.
2. TUN: Use the top-level tun configuration to intercept system traffic. This is suitable for automatic routing, DNS interception, and routing specific applications.
3. Listeners: Use the listeners field to create multiple incoming connections of different types with different addresses and ports simultaneously. Each listener can have its own independent rule and proxy settings.

listeners:
  - name: socks5-in-1
    type: socks
    port: 10808
    # listen: 0.0.0.0 # default
    # rule: sub-rule-name1
    # proxy: proxy
    # udp: false # default is true

The enhanced-mode determines how DNS is handled for traffic interception. Supported values are fake-ip and redir-host (default).

Fake-IP Mode

In fake-ip mode, the system returns a virtual IP address to the client instead of the real IP. This requires configuring ranges:

• fake-ip-range: The IPv4 range for fake IPs (e.g., 198.18.0.1/16). This is also used as a reference for the tun inbound.
• fake-ip-range6: The IPv6 range for fake IPs.
• fake-ip-ttl: The TTL returned for fake-ip queries. Do not change this unless necessary.

Fake-IP Filtering

You can prevent certain domains from receiving a fake IP using fake-ip-filter and fake-ip-filter-mode.

• fake-ip-filter-mode:
  • blacklist (default): Domains in the filter will NOT get a fake IP.
  • whitelist: Only domains in the filter will get a fake IP.
  • rule: Uses routing rule syntax (GEOSITE, RuleSet, etc.) to decide whether to assign a fake IP or a real IP.
• fake-ip-filter: A list of domains or patterns to exclude from fake-ip mapping.

dns:
  enhanced-mode: fake-ip
  fake-ip-range: 198.18.0.1/16
  fake-ip-filter-mode: rule
  fake-ip-filter:
    - RULE-SET,reject-domain,fake-ip
    - GEOSITE,gfw,fake-ip
    - DOMAIN,www.baidu.com,real-ip
    - MATCH,fake-ip

Fake-IP mode maps domains to a virtual IP range to speed up resolution and routing.

Core Settings

• enhanced-mode: Set to fake-ip to enable this mode (default is redir-host).
• fake-ip-range: The IPv4 range for fake-ip mappings.
• fake-ip-range6: The IPv6 range for fake-ip mappings.
• fake-ip-ttl: The TTL returned by fake-ip queries (do not modify unless necessary).

Filtering Logic

fake-ip-filter defines domains that should receive real IP mappings instead of fake IPs.

• fake-ip-filter-mode:
  • blacklist (default): Matches in fake-ip-filter get real IPs.
  • whitelist: Only matches in fake-ip-filter get fake IPs.
  • rule: Uses routing rule syntax (GEOSITE, RuleSet, DOMAIN*, MATCH).

Rule Mode Example

When fake-ip-filter-mode is set to rule, use the following syntax:

dns:
  fake-ip-filter-mode: rule
  fake-ip-filter:
    - RULE-SET,reject-domain,fake-ip
    - GEOSITE,gfw,fake-ip
    - DOMAIN,www.baidu.com,real-ip
    - MATCH,fake-ip

dns:
  enhanced-mode: fake-ip
  fake-ip-range: 198.18.0.1/16
  fake-ip-filter-mode: blacklist
  fake-ip-filter:
    - '*.lan'

The stack option determines how network protocols are handled. Choosing the right stack affects stability, security, and performance.

• system: Uses the operating system's native network stack. It is generally more stable, provides a more comprehensive experience, and consumes fewer resources.
• gvisor: Implements the network stack in user space. This provides higher security and isolation, and can improve performance by avoiding kernel/user-space context switching in specific scenarios.
• mixed: A hybrid approach where TCP uses the system stack and UDP uses the gvisor stack. This often provides the best overall experience.
• mips: Uses an IP stack specifically developed by mihomo.

Important: Firewall Compatibility If a firewall is enabled, system and mixed stacks may not work. You must allow the core through the firewall:

• Windows: Allow the application through Windows Defender Firewall.
• MacOS: Allow the mihomo application in System Settings > Network > Firewall > Options.
• Linux: Allow outgoing traffic for the TUN interface (e.g., sudo iptables -A OUTPUT -o Mihomo -j ACCEPT).

tun:
  stack: mixed # Recommended for most users

When using fallback servers, fallback-filter determines if the results from nameserver are sufficient or if fallback must be used.

Filter Options

• geoip: Enables GeoIP judgment. If geoip-code (default CN) is set, results from IPs outside that country are considered 'polluted' and trigger a fallback query.
• geosite: (Deprecated) Domains in these collections are considered polluted and will force fallback resolution. Use nameserver-policy instead.
• ipcidr: Subnets (e.g., 192.168.0.0/16) that are considered polluted.
• domain: Specific domains that are considered polluted.
• fallback-lazy-query: If true, the system only initiates a fallback query if the nameserver results fail the fallback-filter conditions.

dns:
  fallback:
    - tls://8.8.4.4
  fallback-filter:
    geoip: true
    geoip-code: CN
    ipcidr:
      - 240.0.0.0/4
    domain:
      - '+.google.com'