Miu

Miu is a proxy protocol designed for MeowX. Every Miu connection is wrapped in an outer TLS 1.3 or REALITY layer that looks like an ordinary HTTPS connection from a Chrome browser. Inside, MeowX keeps a small pool of already-authenticated connections, so opening a new proxied connection on a warm pool needs no extra handshake round trip. Traffic that is already TLS 1.3–encrypted (most HTTPS) is forwarded without being encrypted a second time, which saves CPU and battery.

You normally do not write Miu nodes by hand: they arrive in your subscription from a provider whose servers support Miu. This page explains the fields in case you need to read or adjust one.

Nodes use the mihomo / Clash Meta config format (type: miu).

Minimal example

Miu with a TLS outer layer:

proxies:
  - name: miu-node
    type: miu
    server: example.com
    port: 443
    psk: your-psk

Full examples

TLS outer layer with an explicit server name:

proxies:
  - name: miu-tls
    type: miu
    server: 192.0.2.1
    port: 443
    psk: your-psk
    sni: example.com
    skip-cert-verify: false

REALITY outer layer:

proxies:
  - name: miu-reality
    type: miu
    server: 192.0.2.1
    port: 443
    psk: your-psk
    servername: www.example.com
    reality-opts:
      public-key: your-reality-public-key
      short-id: 0123abcd

Parameters

Field	Type	Required	Default	Description
`name`	string	Yes	—	Node name. Must be unique.
`type`	string	Yes	—	`miu`.
`server`	string	Yes	—	Server domain name or IP address.
`port`	integer	Yes	—	Server TCP port.
`psk`	string	Yes	—	Pre-shared key. It is both your identity and your key — there is no separate user ID. Must be base64 that decodes to at least 16 bytes, or a plain string of at least 16 bytes.
`servername`	string	No	value of `sni`, then `server`	TLS server name (SNI). With REALITY, this is the camouflage domain configured on the server.
`sni`	string	No	—	Alias of `servername`; `servername` wins if both are set.
`skip-cert-verify`	boolean	No	`false`	TLS mode only: accept any server certificate. Leave off unless your provider tells you otherwise.
`reality-opts.public-key`	string	No	—	When set, the outer layer is REALITY instead of TLS. The server’s REALITY public key.
`reality-opts.short-id`	string	No	empty	REALITY short ID (hex). Must match one configured on the server.
`dialer-proxy`	string	No	—	Send the connection through another node or group. See Chained proxies.

Ignored fields

client-fingerprint — the outer handshake always uses a Chrome fingerprint.
alpn — fixed by MeowX.
udp — UDP is always available on Miu nodes.
vision, id — fields from the first version of Miu; accepted for compatibility and ignored.

Miu runs directly over TCP with its TLS or REALITY layer; leave network and the transport options unset.

Outer layer

TLS (no reality-opts): a standard TLS 1.3 connection with full certificate validation against the system trust store, unless skip-cert-verify is on.

The server must support TLS 1.3.
The server certificate must not use an Ed25519 key (ECDSA and RSA certificates work).

REALITY (reality-opts.public-key set): the server is authenticated with its REALITY key instead of a certificate. See TLS and REALITY for background on REALITY.

UDP

UDP is always supported and is full-cone. Each UDP session gets a dedicated connection from the pool, so it is never held up by other traffic.

Chained proxies

dialer-proxy is supported for both TLS and REALITY; UDP keeps working through the chain.

Validation

Problem	Result
`psk` missing or empty	The whole configuration fails to load.
`psk` shorter than 16 bytes (after base64 decoding, or as plain text)	Node is skipped with a warning in the logs.
Invalid REALITY `public-key`	The node loads, but connections through it fail.

Troubleshooting

REALITY node never connects: check short-id. A missing or wrong short ID makes the REALITY authentication fail.
TLS node fails with a certificate error: make sure servername / sni matches the certificate, or ask your provider whether the server uses a self-signed certificate.

Miu