Docs Config Sudoku

Sudoku

A newer protocol with quite a few parameters, centered around its built-in httpmask HTTP disguise layer, which can run through a CDN or reverse proxy. The fields are fairly granular, so adjust them as needed.

Example Config

config.yaml YAML

proxies:
  - name: sudoku
    type: sudoku
    server: 1.2.3.4
    port: 443
    key: "<client_key>"
    aead-method: chacha20-poly1305
    padding-min: 2
    padding-max: 7
    table-type: prefer_ascii
    httpmask:
      disable: false
      mode: legacy
      tls: true
      multiplex: off
    enable-pure-downlink: false

Basic Fields

keyRequired

If you generated an ED25519 key pair with sudoku, put the private key here; otherwise, use the same UUID as the server.

aead-methodOptional

Choose chacha20-poly1305/aes-128-gcm/none; even with none, the sudoku obfuscation layer still keeps things secure.

padding-min / padding-maxOptional

The minimum/maximum padding size in bytes, used to disrupt traffic pattern analysis.

table-type / custom-table(s)Optional

table-type can be prefer_ascii/prefer_entropy/up_ascii_down_entropy/up_entropy_down_ascii; custom-table/custom-tables let you customize the byte layout (must include 2 x's, 2 p's, and 4 v's), which only affects the entropy direction — you generally won't need to change this.

enable-pure-downlinkOptional

Turning off downstream obfuscation (false) can significantly boost download speed while keeping data secure, but must match the server's setting; in this case aead-method cannot be none.

httpmask HTTP Disguise

httpmask.modeDefault: legacy

Choose legacy/stream/poll/auto/ws — all except legacy support running through a CDN or reverse proxy.

httpmask.tls / host / path-rootOptional

Only applies when mode is stream/poll/auto/ws: tls forces https/http; host overrides the Host/SNI; path-root is the tunnel endpoint's top-level path prefix (must match on both ends) — for example, setting it to aabbcc generates paths like /aabbcc/session and /aabbcc/stream.

httpmask.multiplexDefault: off

auto reuses HTTP keep-alive/H2 connections to reduce connection setup latency; on multiplexes multiple target connections over a single tunnel (only supported by stream/poll/auto — forced off in ws mode).