EasyXrayTransports & Security
Every transport EasyXray exposes — TCP, mKCP, WebSocket, gRPC, HTTPUpgrade, XHTTP, Hysteria, XDRIVE, MASQUE — with their settings, plus FinalMask obfuscation, sockopt, TLS/REALITY, XTLS-Vision, and VLESS encryption.
A transport decides how packets are carried between client and server, a security layer decides how they're encrypted and disguised, and FinalMask can obfuscate what's left. The panel only offers valid combinations; this page lists every transport's settings and the rules the panel enforces.
Transports
Pick the transport (the inbound's network) in the inbound/outbound form. Each
network writes its own settings key on the wire (tcpSettings, kcpSettings, …).
| Transport | Settings key | When to use it |
|---|---|---|
| TCP (Raw) | tcpSettings | Lowest overhead. The basis for REALITY + XTLS-Vision and fallbacks; optional HTTP/1.1 header camouflage. |
| mKCP | kcpSettings | Reliable protocol over UDP — trades bandwidth for lower latency on lossy links. Carries no TLS/REALITY. |
| WebSocket | wsSettings | Works through CDNs and HTTP reverse proxies; very compatible. |
| gRPC | grpcSettings | HTTP/2-based; multiplexes well and proxies cleanly through Nginx. |
| HTTPUpgrade | httpupgradeSettings | CDN-friendly HTTP/1.1 Upgrade; lighter than full WebSocket. |
| XHTTP | xhttpSettings | Modern stream-multiplexed HTTP transport; CDN-friendly and REALITY-capable. |
| Hysteria | hysteriaSettings | QUIC-based transport — only for the Hysteria2 protocol. |
| XDRIVE | xdriveSettings | Tunnels the stream through files in shared cloud storage (Google Drive, a local folder or any HTTP storage API). |
| MASQUE | masqueSettings | CONNECT-IP over HTTP/3 or HTTP/2 — only for the MASQUE protocol. See MASQUE. |
WireGuard and Tunnel (dokodemo-door) inbounds expose no transport
selector — their stream carries only security/sockopt. Earlier panels also
exposed a raw HTTP/2 (http) transport; it has been superseded by XHTTP
and is no longer selectable.
TCP (Raw) — tcpSettings
| Field | Default | Meaning |
|---|---|---|
acceptProxyProtocol | false | Accept the PROXY protocol from an upstream proxy so the real client IP is preserved. |
header.type | none | none, or http for HTTP/1.1 camouflage. |
header.request / response | — | When type: http: method, path, version and a header map that mimic a normal HTTP exchange. |
mKCP — kcpSettings
| Field | Default | Meaning |
|---|---|---|
mtu | 1350 | Maximum transmission unit, in bytes (576–1460). |
tti | 20 | Transmission time interval, in ms (10–100). Lower = more responsive, more overhead. |
uplinkCapacity | 5 | Upload bandwidth budget, in MB/s. |
downlinkCapacity | 20 | Download bandwidth budget, in MB/s. |
cwndMultiplier | 1 | Congestion-window multiplier; raise to push harder on good links. |
maxSendingWindow | 2097152 | Upper bound on in-flight packets. |
mKCP can't carry TLS or REALITY. To disguise it, add a FinalMask UDP mask —
the mkcp-legacy mask reproduces the classic header obfuscation that older Xray
stored in kcpSettings.header/seed (those fields no longer exist here).
WebSocket — wsSettings
| Field | Default | Meaning |
|---|---|---|
path | / | Request path — route on it when several services share one host. |
host | (none) | Host header override (useful behind a CDN). |
headers | {} | Extra request headers. |
heartbeatPeriod | 0 | Seconds between keepalive pings; 0 disables them. |
acceptProxyProtocol | false | Accept the PROXY protocol from an upstream. |
gRPC — grpcSettings
| Field | Default | Meaning |
|---|---|---|
serviceName | (none) | gRPC service path; acts like a secret route. |
authority | (none) | :authority pseudo-header override. |
multiMode | false | Multiplex several streams over one connection. |
HTTPUpgrade — httpupgradeSettings
| Field | Default | Meaning |
|---|---|---|
path | / | Request path. |
host | (none) | Host header override. |
headers | {} | Extra request headers. |
acceptProxyProtocol | false | Accept the PROXY protocol from an upstream. |
HTTPUpgrade is a one-shot HTTP/1.1 Upgrade with no WebSocket framing — there's
no heartbeat field.
XHTTP — xhttpSettings
XHTTP (SplitHTTP) has a large field set; the panel fills sensible defaults. The ones you'll usually touch:
| Field | Default | Meaning |
|---|---|---|
path | / | Request path. |
host | (none) | Host header override. |
mode | auto | auto, packet-up, stream-up, or stream-one. packet-up is the most CDN-compatible; stream-* are lower latency. |
xPaddingBytes | 100-1000 | Random padding range that blurs packet sizes. |
scMaxBufferedPosts | 30 | Server-side buffer for uploaded POSTs. |
scStreamUpServerSecs | 20-80 | Stream-up server window (dash range). |
xmux (enableXmux) | (off) | Connection multiplexing — maxConcurrency 16-32, maxConnections 6, … Turn on for high concurrency. |
Session-ID fields (sessionIDPlacement, sessionIDKey, sessionIDTable,
sessionIDLength) and the scMin/MaxEachPostBytes knobs are advanced; leave them
empty unless you're matching a specific upstream.
Hysteria — hysteriaSettings
Only valid when the protocol is Hysteria2.
| Field | Default | Meaning |
|---|---|---|
version | 2 | Hysteria protocol version. |
auth | (none) | Shared authentication string. |
udpIdleTimeout | 60 | Seconds (2–600) before idle UDP sessions are dropped. |
masquerade | — | Disguise as an HTTP/3 server: type proxy/file/string with url/dir/content, plus headers and statusCode. |
XDRIVE — xdriveSettings
XDRIVE carries the stream as files in a folder both ends can reach: the server polls that folder instead of accepting connections on its port. Both sides must use the same service, folder and secrets, so the JSON subscription ships them to every client; XDRIVE inbounds get no share link or Clash entry.
| Field | Default | Meaning |
|---|---|---|
service | Google Drive | Google Drive, local (a folder on disk) or template (any HTTP storage API). |
remoteFolder | — | Folder that holds the session files. |
secrets | — | Google Drive: ClientID, ClientSecret, RefreshToken — exactly three, in that order. Template: values read as {secret0}, {secret1}, …. |
template | — | Template service only: the storage API's auth, put, get, list and delete operations. |
| tuning | core defaults | segmentBytes (512 KiB), flushIntervalMs (20), pollIntervalMs/maxPollIntervalMs (50/500), eagerWindowMs (2000), holeTimeoutMs (30000), sessionTtlSeconds (300), concurrency (8). |
The optional Front address/port (the stream-level address/port) is a domain
front the storage API is dialed through; TLS still names the API host. XDRIVE has
no TLS/REALITY layer of its own — its traffic is the storage API's HTTPS. On an
outbound, TLS security shapes that HTTPS connection: its SNI, uTLS fingerprint
and ALPN are what the storage API sees.
FinalMask — late-layer obfuscation
FinalMask wraps traffic after the transport and security layers, so it can disguise transports that don't carry TLS (like mKCP) or add a second skin on top of TLS. Masks are configured per direction:
- TCP masks —
fragment,sudoku,header-custom,xmc(disguises the stream as Minecraft protocol traffic; requires a password, with optional hostname and player usernames). - UDP masks —
salamander,mkcp-legacy,header-custom,xdns,xicmp,noise,sudoku,realm, plus the client-onlyudphop. (mkcp-legacyreproduces the old mKCP header obfuscation;udphoprotates the remote port — and optionally the remote IP — on an interval or per connection to dodge port blocking.) - QUIC params — congestion control (
reno,bbr,brutal,force-brutal), Brutal up/down rates, and receive-window tuning. On an inbound, UDP Hop sets the port range advertised to clients (the share link'smportand the JSON subscription'sudphopmask); the server still listens on its own port. Since Xray 26.9.9 a client hops only through theudphopmask, so the panel converts an older clientquicParams.udpHopto it.
FinalMask replaces the per-transport header/seed obfuscation that older Xray
builds exposed.
sockopt — low-level socket options
sockopt rides alongside any transport and tunes the underlying socket. The most
useful fields:
| Field | Default | Meaning |
|---|---|---|
tcpFastOpen | false | Enable TCP Fast Open. |
tcpcongestion | bbr | Congestion control: bbr, cubic, or reno. |
tproxy | off | Transparent proxy mode: off, redirect, or tproxy. |
domainStrategy | AsIs | How addresses resolve (UseIP, ForceIPv4, …). |
dialerProxy | (none) | Chain this outbound's dialing through another outbound tag. |
interface | (none) | Bind to a specific network interface. |
mark | 0 | SO_MARK for policy routing (0 = unset). |
Numeric fields left at 0 are omitted on the wire so Xray keeps OS defaults.
Advanced entries (happyEyeballs, customSockopt[], keepalive timers) are
available for special cases.
Security
The security layer is one of none, tls, or reality, with these
eligibility rules:
| Security | Eligible transports | Eligible protocols |
|---|---|---|
| TLS | tcp, ws, grpc, httpupgrade, xhttp | VLESS, VMess, Trojan, Shadowsocks (Hysteria2 is always TLS) |
| REALITY | tcp, grpc, xhttp | VLESS, Trojan |
mKCP and Hysteria don't take a separate TLS/REALITY layer — mKCP runs plaintext (obfuscate with FinalMask), and Hysteria is QUIC/TLS by design. REALITY disguises your server as a real TLS site and needs no certificate — see REALITY.
XTLS-Vision flow
The xtls-rprx-vision flow is fast and DPI-resistant. It's available for
VLESS when either:
- the transport is raw TCP with TLS or REALITY security (classic XTLS-Vision), or
- VLESS encryption is enabled, on any transport (see below).
Set the flow on the VLESS client, not the inbound. With classic Vision on TCP, the panel can also offer a Vision seed once a client uses the flow.
VLESS encryption (ML-KEM)
VLESS supports post-quantum encryption (ML-KEM / mlkem768x25519), stored in
the inbound's decryption (server) and clients' encryption (for link
generation). When enabled, it unlocks the Vision flow on any transport. Generate the
keys from the panel's VLESS settings.
Shadowsocks ciphers
Shadowsocks inbounds support both classic ciphers and Shadowsocks-2022
(method names starting with 2022-blake3-). 2022-blake3-chacha20-poly1305 is not
offered for inbounds: Xray-core supports it only without users, and every panel
inbound has clients. Outbounds can still use it.
Transports and security must match on both ends. The client's share link
encodes them (type=ws, security=reality, flow=xtls-rprx-vision, …) —
decode any link with the share-link inspector.