HTTP

An HTTP node forwards connections through an HTTP proxy using the CONNECT method. With tls: true, the connection to the proxy itself is protected by TLS (often called an “HTTPS proxy”). HTTP nodes carry TCP only — there is no UDP.

Nodes use the mihomo / Clash Meta config format (type: http).

Minimal example

proxies:
  - name: http-node
    type: http
    server: 192.0.2.1
    port: 8080

Full example

proxies:
  - name: https-proxy
    type: http
    server: proxy.example.com
    port: 443
    username: your-username
    password: your-password
    tls: true
    sni: proxy.example.com
    skip-cert-verify: false

Parameters

Field	Type	Required	Default	Description
`name`	string	Yes	—	Node name. Must be unique.
`type`	string	Yes	—	`http`.
`server`	string	Yes	—	Proxy domain name or IP address.
`port`	integer	Yes	—	Proxy TCP port.
`username`	string	No	—	User name for HTTP Basic authentication.
`password`	string	No	—	Password for HTTP Basic authentication. Credentials are only sent when both `username` and `password` are set.
`tls`	boolean	No	`false`	Connect to the proxy over TLS.
`servername`	string	No	value of `sni`, then `server`	TLS server name (SNI) and the name the certificate is checked against.
`sni`	string	No	—	Alias of `servername`; `servername` wins if both are set.
`skip-cert-verify`	boolean	No	`false`	With `tls: true`, accept any certificate (self-signed, expired, wrong name).
`alpn`	list of strings	No	none	ALPN values to offer in the TLS handshake.
`dialer-proxy`	string	No	—	Send the connection through another node or group. See Chained proxies.

Ignored fields

headers — custom request headers on the CONNECT request are not supported.
udp — HTTP proxies cannot relay UDP; the field is ignored.
client-fingerprint, fingerprint.

How it works

For each connection, MeowX sends:

CONNECT example.org:443 HTTP/1.1
Host: example.org:443
Proxy-Authorization: Basic <credentials>

The target is sent as a domain name when MeowX knows it, otherwise as an IP address. The Proxy-Authorization line is only included when credentials are configured. The proxy must answer with status 200 within 5 seconds; any other status (for example 407 Proxy Authentication Required) fails the connection.

TLS

Without dialer-proxy, TLS uses the system TLS stack (TLS 1.2 and 1.3) and the system trust store.
With dialer-proxy, TLS is performed by MeowX’s own TLS client, which supports TLS 1.3 only. A TLS 1.2-only HTTPS proxy cannot be used at the end of a chain.

UDP

Not supported. UDP is not sent through a node that cannot carry it. In Rule mode, a UDP flow skips any rule that leads to such a node and continues with the following rules (often ending at the final MATCH rule); in Global mode the UDP traffic is dropped, so applications fall back to TCP.

Validation

HTTP has no node-specific required fields beyond name, type, server and port. A missing port makes the whole configuration fail to load.