Docs Config Inbound

Inbound

The listeners field lets you open multiple inbound ports in a single config, and even have mihomo itself act as a Shadowsocks/VMess/TUIC server. It's functionally equivalent to writing separate port/socks-port/mixed-port fields, but more flexible.

LAN Inbounds

Used to listen for LAN traffic, suitable for unencrypted transport scenarios:

config.yaml YAML

listeners:
  - name: socks5-in-1
    type: socks
    port: 10808
    # listen: 0.0.0.0        # Defaults to listening on 0.0.0.0
    # rule: sub-rule-name1   # Uses rules by default; falls back to rules if this sub-rule isn't found
    # proxy: proxy           # If set, this inbound's traffic goes directly to the specified proxy
    # udp: false             # Defaults to true

  - name: http-in-1
    type: http
    port: 10809
    listen: 0.0.0.0

  - name: mixed-in-1
    type: mixed # Mixed HTTP(S) and SOCKS proxy
    port: 10810
    listen: 0.0.0.0

  - name: redir-in-1
    type: redir
    port: 10811
    listen: 0.0.0.0

  - name: tproxy-in-1
    type: tproxy
    port: 10812
    listen: 0.0.0.0

  - name: tunnel-in-1
    type: tunnel
    port: 10816
    listen: 0.0.0.0
    network: [tcp, udp]
    target: target.com

  - name: tun-in-1
    type: tun
    stack: system # gvisor / lwip
    dns-hijack:
      - 0.0.0.0:53
    inet4-address: # The IPv4 address range must be set manually
      - 198.19.0.1/30
    inet6-address: # The IPv6 address range must be set manually
      - "fdfe:dcba:9877::1/126"

Every listener entry generally supports rule (which sub-rule this inbound uses by default, falling back to the main rules if not found) and proxy (if set, this inbound's traffic goes directly to the specified outbound proxy/proxy group, skipping routing rules).

Internet-Facing Inbounds

Lets mihomo itself act as an encrypted protocol server, so other devices can connect to this machine as if it were a Shadowsocks / VMess / TUIC node:

config.yaml YAML

listeners:
  - name: shadowsocks-in-1
    type: shadowsocks
    port: 10813
    listen: 0.0.0.0
    password: vlmpIPSyHH6f4S8WVPdRIHIlzmB+GIRfoH3aNJ/t9Gg=
    cipher: 2022-blake3-aes-256-gcm

  - name: vmess-in-1
    type: vmess
    port: 10814
    listen: 0.0.0.0
    users:
      - username: 1
        uuid: 9d0cb9d0-964f-4ef6-897d-6c6b3ccf9e68
        alterId: 1

  - name: tuic-in-1
    type: tuic
    port: 10815
    listen: 0.0.0.0
    certificate: ./server.crt
    private-key: ./server.key

For protocol-specific fields (like mixed's users/TLS certificate, or TUIC's choice of token vs users), refer to that protocol's page. To accept a subscription-link-style inbound directly at this level, you can also use a one-line format like ss-config: ss://... / vmess-config: vmess://....