Docs Config dialer-proxy

dialer-proxy

Specifies that a proxy establishes its connection through another proxy group/outbound proxy, forming a proxy chain — commonly used to protect the real IP of your own VPS landing node, or to traverse network isolation between internal and external networks.

Basic Usage

config.yaml YAML

proxies:
  - name: "ss1"
    dialer-proxy: dialer
    # ...

  - name: "ss2"
    # ...

proxy-groups:
  - name: dialer
    type: select
    proxies:
      - ss2

rules:
  - MATCH,ss1

In the example above, ss1 connects through ss2, forming this proxy chain: Core --ss1--> wrapped by ss2 --ss2--> ss2 server --ss1--> ss1 server --> destination. The end result is:

The target website only sees ss1's IPIt has no idea ss2 exists
Your ISP only sees you connecting to ss2It has no idea ss1 exists
The ss2 server only knows it's forwarding to ss1It has no idea what site is ultimately being accessed

Common Use Case: Protecting a Self-Hosted VPS Landing Node

config.yaml YAML

proxies:
  - name: "ss1"
    dialer-proxy: dialer
    # ...

proxy-providers:
  provider1:
    type: http
    url: "http://test.com"

proxy-groups:
  - name: dialer
    type: select
    use:
      - provider1

rules:
  - MATCH,ss1

Put your subscription URL in provider1, and the node running on your own VPS in ss1. Any site you visit will see ss1's IP.

Unless you have a specific need, avoid using UDP-based protocols like hy2/tuic/wg for the landing VPS node being relayed through, and avoid TLS-disguise protocols like reality/shadowtls — subscription nodes may not handle these protocols properly. A simple SS-AEAD or VMess setup is recommended instead.

Migrating From relay

The relay proxy group type has been deprecated (see relay), but proxy groups themselves don't directly support dialer-proxy. If your old relay contained multiple select groups, you can migrate by using a proxy-providers entry's override to bulk-set dialer-proxy:

config.yaml YAML

proxies:
  - { name: "proxy1", type: "socks" }
  - { name: "proxy2", type: "socks" }
proxy-groups:
  - { name: "select1", type: select, proxies: ["proxy1", "proxy2"] }
  - { name: "select2", type: select, use: ["provider1"] }
proxy-providers:
  provider1:
    type: inline
    override:
      dialer-proxy: select1
    payload:
      - { name: "proxy3", type: "socks" }
      - { name: "proxy4", type: "socks" }
rules:
  - MATCH,select2

The idea is to define the nodes from the second half of the old relay chain (proxy3/proxy4) inside an inline-type proxy-providers entry, then use override.dialer-proxy to make all of them route through select1 — achieving the same effect as the original chained proxy.