Mieru

Mieru is an encrypted proxy protocol with its own session layer. It can run over TCP or over UDP (with built-in retransmission), and a server can listen on a whole range of ports. MeowX implements the Mieru client natively and works with the official mita server.

Nodes use the mihomo / Clash Meta config format (type: mieru).

Minimal example

proxies:
  - name: mieru-node
    type: mieru
    server: example.com
    port: 2999
    transport: TCP
    username: your-username
    password: your-password

Full example

proxies:
  - name: mieru-udp
    type: mieru
    server: 192.0.2.1
    port-range: 2090-2099
    transport: UDP
    username: your-username
    password: your-password
    # optional: send this node's connections through another proxy
    # (TCP transport only)
    # dialer-proxy: entry-node

Parameters

Field	Type	Required	Default	Description
`name`	string	Yes	—	Node name. Must be unique.
`type`	string	Yes	—	`mieru`.
`server`	string	Yes	—	Server domain name or IP address.
`port`	integer	One of `port` / `port-range`	—	Server port.
`port-range`	string	One of `port` / `port-range`	—	A single range `a-b` (1–65535, `a` ≤ `b`). Each new underlying connection picks a random port from the range.
`transport`	string	No	`TCP`	`TCP` or `UDP` (case-insensitive). Must match the server’s listener.
`username`	string	Yes	—	User name configured on the server.
`password`	string	Yes	—	Password for that user.
`dialer-proxy`	string	No	—	Send the underlying TCP connection through another node or group. TCP transport only. See Chained proxies.

Ignored fields

multiplexing — accepted but ignored. Each session always gets its own underlying connection (equivalent to MULTIPLEXING_OFF).
handshake-mode — HANDSHAKE_NO_WAIT (0-RTT) is not supported; the standard handshake is always used.
traffic-pattern — not supported.
udp — proxied UDP is always available, whatever this field says.

Ports

Write either port or port-range. With port-range, every new underlying connection picks a port uniformly at random from the range and sticks to it; there is no hopping within a connection.
Only a single a-b range is accepted (no lists).
If both are written, MeowX logs a warning and uses port-range, ignoring port. (mihomo rejects this combination.)
If port-range cannot be parsed, MeowX logs a warning and falls back to port when one is present.

Transports

TCP — one TCP connection per proxied connection. Reliable and simple; this is the default.

UDP — sessions run over UDP with Mieru’s own acknowledgements and retransmission. The handshake allows up to 10 seconds so a lost packet or two does not fail the connection. Server domain names are resolved by MeowX before the UDP socket is opened.

Both transports carry proxied TCP and proxied UDP traffic.

UDP

Proxied UDP is supported on both transports and is full-cone: each datagram carries its own destination, so one session can talk to many destinations.

Interoperability notes

Keep the device clock accurate. Mieru derives its keys from the current time, and the UDP transport additionally rejects packets whose timestamp is more than about a minute off. A device clock that is several minutes wrong will fail to connect.
transport must match what the server listens on; a TCP client cannot talk to a UDP listener and vice versa.

Validation

Problem	Result
`username` or `password` missing or empty	The whole configuration fails to load.
Neither a `port` nor a valid `port-range`	The whole configuration fails to load.
Both `port` and `port-range`	Warning; `port-range` is used.
Invalid `port-range` but `port` present	Warning; `port` is used.
`transport` other than `TCP` / `UDP`	Node is skipped with a warning in the logs.
`dialer-proxy` together with `transport: UDP`	Node is skipped with a warning in the logs.

Limitations

No multiplexing (several sessions sharing one underlying connection).
No 0-RTT handshake (HANDSHAKE_NO_WAIT) and no traffic-pattern.