• Local HTTP/HTTPS/SOCKS server with authentication support
• VMess, VLESS, Shadowsocks, Trojan, Snell, TUIC, Hysteria protocol support
• Built-in DNS server that aims to minimize DNS pollution attack impact, supports DoH/DoT upstream and fake IP.
• Rules based off domains, GEOIP, IPCIDR or Process to forward packets to different nodes
• Remote groups allow users to implement powerful rules. Supports automatic fallback, load balancing or auto select node based off latency
• Remote providers, allowing users to get node lists remotely instead of hard-coding in config
• Netfilter TCP redirecting. Deploy Mihomo on your Internet gateway with iptables.
• Comprehensive HTTP RESTful API controller
• Support encrypted(aes128, aes256, aes512) config file

To generate an encrypted config file, you need a regular (unencrypted) config file.

clash.meta --action encrypt -f Path/To/RegularConfigFile -p YourPassword

The encrypted file will be in the same folder as the config file, named config-encrypt.yaml

You can use the encrypted config file by adding the -p parameter to the normal command.

clash.meta -d Path/To/Config/Dir -f Path/To/Encrypted/Config/File -p YourPassword

Also you can decrypt the encrypted config file by this command

clash.meta --action decrypt -f Path/To/Encrypted/Config/File -p YourPassword

The decrypted file will be in the same folder as the config file, named config-decrypt.yaml

if password length less than or equal to 16 bytes, will use AES-128

if password length greater to 16 bytes and less than or equal to 24 bytes, will use AES-192

if password length greater to 24 bytes, will use AES-256

if no -p parameter, need input password from prompt

A web dashboard with first-class support for this project has been created; it can be checked out at metacubexd.

Configuration example is located at /docs/config.yaml.

Documentation can be found in mihomo Docs.

Requirements: Go 1.20 or newer

Build mihomo:

git clone https://github.com/MetaCubeX/mihomo.git
cd mihomo && go mod download
go build

Set go proxy if a connection to GitHub is not possible:

go env -w GOPROXY=https://goproxy.io,direct

Build with gvisor tun stack:

go build -tags with_gvisor

Work on Linux OS which supported iptables

# Enable the TPROXY listener
tproxy-port: 9898

iptables:
  enable: true # default is false
  inbound-interface: eth0 # detect the inbound interface, default is 'lo'

Check wiki to get an instruction on using debug API.

• Dreamacro/clash
• SagerNet/sing-box
• riobard/go-shadowsocks2
• v2ray/v2ray-core
• WireGuard/wireguard-go
• yaling888/clash-plus-pro

This software is released under the GPL-3.0 license.