AnyTLS

AnyTLS is a TLS-based proxy protocol designed to avoid the “TLS inside TLS” traffic patterns that give away many proxies. The client authenticates with a password hash. Many proxied connections are then multiplexed as streams over one TLS connection, which saves a handshake for every new connection. In MeowX the connection is always TLS (or REALITY), and UDP is always available and full-cone.

Examples

Minimal:

proxies:
  - name: anytls-basic
    type: anytls
    server: example.com
    port: 443
    password: "your-password"

All supported options:

proxies:
  - name: anytls-full
    type: anytls
    server: 192.0.2.1
    port: 443
    password: "your-password"
    sni: example.com
    alpn:
      - h2
      - http/1.1
    skip-cert-verify: false
    dialer-proxy: relay-group

AnyTLS with REALITY:

proxies:
  - name: anytls-reality
    type: anytls
    server: 192.0.2.1
    port: 443
    password: "your-password"
    sni: www.example.com
    reality-opts:
      public-key: "SERVER-PUBLIC-KEY-BASE64URL"
      short-id: "0123456789abcdef"

Parameters

Field	Type	Required	Default	Description
`name`	string	yes	—	Node name.
`type`	string	yes	—	`anytls`
`server`	string	yes	—	Server domain or IP.
`port`	integer	yes	—	Server port.
`password`	string	yes	—	AnyTLS password.
`sni` / `servername`	string	no	`server`	TLS / REALITY server name. If both are set, `servername` wins.
`alpn`	list of strings	no	—	TLS ALPN protocols (ignored with REALITY).
`skip-cert-verify`	boolean	no	`false`	Accept any server certificate. Needed for servers with a self-signed certificate.
`reality-opts`	map	no	—	`public-key` and `short-id`, to use REALITY instead of TLS. See REALITY.
`dialer-proxy`	string	no	—	Connect to the server through another proxy or group.

udp is not needed: UDP is always enabled for AnyTLS. tls is not read either, because TLS is always on.

How it behaves

One session per node. MeowX keeps a single TLS session to each AnyTLS node and opens a new stream on it for every proxied connection. If many connections start at once (for example right after connecting), they wait for the same session instead of each opening their own. If the session dies, the next connection opens a fresh one.
Idle timeout. A session with no open streams for 30 seconds is closed.
Padding. MeowX does not add client-side padding. A padding scheme pushed by the server is accepted but not applied. This does not affect connectivity.

UDP

UDP is carried inside an AnyTLS stream using UDP-over-TCP (version 2, the format used by sing-box and mihomo AnyTLS servers). Every datagram carries its own destination, so UDP is full-cone. UDP also works through dialer-proxy.

Validation

Problem	Result
`password` missing or empty	The whole configuration is rejected.
Invalid REALITY `public-key`	Connections fail with an error naming the key.