Chained proxies (dialer-proxy)

A chained proxy sends your traffic through two (or more) servers: MeowX first connects to an entry node, and through it reaches the landing node, which then connects to the destination. Websites see the landing node’s IP address. Common uses are a stable landing IP behind a fast entry, or reaching a server that is only reachable from certain networks.

MeowX supports chaining with the mihomo dialer-proxy field, set on the landing node.

Example

proxies:
  # entry: the node you connect to first
  - name: entry
    type: ss
    server: entry.example.com
    port: 8388
    cipher: 2022-blake3-aes-128-gcm
    password: your-ss-password

  # landing: reached through "entry"
  - name: landing
    type: trojan
    server: landing.example.com
    port: 443
    password: your-trojan-password
    udp: true
    dialer-proxy: entry

Use landing in your proxy groups and rules as usual. Connections through it go: device → entry → landing → destination.

Using a proxy group as the entry

dialer-proxy can name a proxy group instead of a node. The group is resolved each time a connection is made, so the chain follows whatever the group currently selects (or the fastest member, for url-test / fallback):

proxies:
  - name: landing
    type: vless
    server: landing.example.com
    port: 443
    uuid: 00000000-0000-0000-0000-000000000000
    tls: true
    servername: landing.example.com
    dialer-proxy: Entry Nodes

proxy-groups:
  - name: Entry Nodes
    type: url-test
    proxies: [hk-1, hk-2, jp-1]

Longer chains

The entry node may itself have a dialer-proxy, giving a chain of three or more hops.

Field

Field	Type	Required	Default	Description
`dialer-proxy`	string	No	—	Name of a node, proxy group or built-in outbound (e.g. `DIRECT`) to carry this node’s connection to its `server`. Leading and trailing spaces are ignored; an empty value means no chaining.

Supported protocols

dialer-proxy on the landing node works for protocols that connect to their server over TCP:

Landing protocol	`dialer-proxy`	UDP through the chain
Shadowsocks	Supported	Off — Shadowsocks UDP uses separate UDP packets that cannot pass through a TCP chain
VMess	Supported	Works (if the node has `udp: true`)
VLESS	Supported	Works (if the node has `udp: true`)
Trojan	Supported	Works (if the node has `udp: true`)
AnyTLS	Supported	Works
Snell	Supported	Works (if the node has `udp: true`)
Miu	Supported	Works
Mieru, `transport: TCP`	Supported	Works
Mieru, `transport: UDP`	Not supported — node is skipped	—
SOCKS5	Supported	Off — SOCKS5 UDP datagrams travel outside the TCP connection
HTTP	Supported	HTTP nodes never carry UDP
Hysteria 2	Not supported — node is skipped	—
WireGuard	Not supported — node is skipped	—

Protocols that run over UDP (Hysteria 2, WireGuard, Mieru’s UDP transport) cannot be carried through a TCP proxy. A node of one of those types that has dialer-proxy set is skipped, with a warning in the logs. They can, however, be used as the entry of a chain for TCP-based landing nodes.

Transports (WebSocket, gRPC, XHTTP), TLS and REALITY on the landing node all work through a chain.

UDP behavior

Where the table says “Works”, the landing protocol carries UDP inside its TCP connection, so UDP goes through the full chain. Where it says “Off”, the landing node is treated as not supporting UDP, even if udp: true is set.

UDP is not sent through a node that cannot carry it. In Rule mode, a UDP flow skips any rule that leads to such a node and continues with the following rules (often ending at the final MATCH rule); in Global mode the UDP traffic is dropped, so applications fall back to TCP.

TLS on the landing node

Without a chain, TLS connections to a node’s server use the system TLS stack. Through a chain, MeowX uses its own TLS client instead:

TLS 1.3 only. A landing server that only speaks TLS 1.2 cannot be reached through a chain.
The certificate chain is checked against the system trust store (missing intermediate certificates are not downloaded), and the server’s signature is verified.
skip-cert-verify: true on the landing node skips both checks — needed for self-signed landing certificates.
REALITY landing nodes work as usual.

Validation

Problem	Result
`dialer-proxy` names a node or group that does not exist	The whole configuration fails to load.
Chains form a loop (A → B → A, a node chained through itself, or through a group that contains it)	The whole configuration fails to load.
Landing node is Hysteria 2, WireGuard, or Mieru with `transport: UDP`	That node is skipped with a warning in the logs.
The entry node exists in the file but could not be created (for example, it was skipped)	The landing node loads, but its connections fail.

`relay` groups

mihomo’s type: relay proxy groups are not supported as chains: MeowX treats a relay group like a select group (connections use the selected member only). Use dialer-proxy instead.