Snell

Snell is a lightweight encrypted proxy protocol originally created for Surge. MeowX supports Snell v4, v5 and v6, including the HTTP / TLS obfuscation layers and the ShadowTLS v3 wrapper for v4 and v5, the three v6 modes, connection reuse and UDP relay.

Nodes use the mihomo / Clash Meta config format (type: snell).

Minimal example

proxies:
  - name: snell-node
    type: snell
    server: example.com
    port: 8443
    psk: your-psk
    version: 4

Full examples

Snell v4 or v5 with TLS obfuscation:

proxies:
  - name: snell-v4-tls
    type: snell
    server: example.com
    port: 8443
    psk: your-psk
    version: 4
    udp: true
    reuse: true
    obfs-opts:
      mode: tls
      host: www.example.com

Snell v4 or v5 wrapped in ShadowTLS v3:

proxies:
  - name: snell-v5-shadowtls
    type: snell
    server: example.com
    port: 443
    psk: your-psk
    version: 5
    udp: true
    obfs-opts:
      mode: shadow-tls
      host: www.example.com
      password: your-shadowtls-password
      version: 3

Snell v6:

proxies:
  - name: snell-v6
    type: snell
    server: 192.0.2.1
    port: 8443
    psk: your-psk
    version: 6
    mode: default
    udp: true
    reuse: true

Parameters

Field	Type	Required	Default	Description
`name`	string	Yes	—	Node name. Must be unique.
`type`	string	Yes	—	`snell`.
`server`	string	Yes	—	Server domain name or IP address.
`port`	integer	Yes	—	Server TCP port.
`psk`	string	Yes	—	Pre-shared key, used exactly as written (it is not base64-decoded).
`version`	integer	Yes	—	`4`, `5` or `6`. A quoted number (`"4"`) is also accepted.
`udp`	boolean	No	`false`	Enable UDP relay through this node.
`reuse`	boolean	No	`false`	Reuse idle TCP connections for new proxied connections. See Connection reuse.
`obfs-opts`	map	No	none	v4 / v5 only. Obfuscation or ShadowTLS wrapper. Ignored for v6.
`obfs-opts.mode`	string	No	none	`http`, `tls` or `shadow-tls`. Empty, `none` or `off` means no obfuscation.
`obfs-opts.host`	string	No	see description	Disguise host. Defaults: `bing.com` for `http`, `cloudfront.net` for `tls`, the node’s `server` for `shadow-tls` (where it is the SNI of the TLS handshake server).
`obfs-opts.password`	string	With `shadow-tls`	—	ShadowTLS password.
`obfs-opts.version`	integer	With `shadow-tls`	—	ShadowTLS version. Must be `3`.
`mode`	string	No	`default`	v6 only: `default`, `unshaped` or `unsafe-raw`. Ignored for v4 / v5.
`dialer-proxy`	string	No	—	Send the TCP connection through another node or group. See Chained proxies.

Ignored fields

obfs-opts on v6 nodes, and mode on v4 / v5 nodes. Neither makes the node invalid.
client-fingerprint, tls, skip-cert-verify — Snell has no TLS layer of its own.

Versions

v4 — the classic encrypted Snell format.
v5 — on the wire, TCP and UDP-over-TCP are identical to v4, so a v5 node works with any v5 server. v5’s separate QUIC Proxy mode is not supported.
v6 — a new record layer with three modes. There is no negotiation: mode must be set to exactly what the server uses, otherwise the server just sees bytes it cannot decode and disconnects.

v6 `mode`	What it does
`default`	Encrypted, with traffic shaping derived from the PSK (padding, record sizes).
`unshaped`	Encrypted, no shaping.
`unsafe-raw`	No encryption. Only for use inside an already-encrypted channel.

v6 servers require a PSK between 12 and 255 bytes.

Obfuscation and ShadowTLS (v4 / v5)

mode: http and mode: tls add the same simple obfuscation layers Surge uses. The server must be configured with the same mode.
mode: shadow-tls wraps the connection in ShadowTLS v3: MeowX performs a real TLS 1.3 handshake with the handshake server named by host through the ShadowTLS server, then carries Snell traffic inside. Requirements:
- Only ShadowTLS v3 is supported.
- The handshake server must support TLS 1.3.
- With a wrong password, the ShadowTLS server forwards the connection to the real website; MeowX notices that the server never authenticated itself and fails the connection instead of sending data.

Connection reuse

With reuse: true, a TCP connection whose proxied stream finished cleanly in both directions is kept idle and used for the next connection:

Up to 10 idle connections are kept, for up to 180 seconds.
Idle connections are discarded when the network changes.
If a pooled connection turns out to be dead, MeowX transparently retries on a new connection.

Reuse only helps if the server ends streams cleanly without closing the TCP connection. Servers that close the TCP connection after every stream work fine, but reuse has no effect with them.

UDP

Set udp: true to relay UDP through the node.

Each UDP session uses its own TCP connection (UDP-over-TCP), on all three versions.
UDP is full-cone: one session can talk to many destinations, and replies carry their real source address.
Destinations given as domain names are resolved on the device first and sent as IP addresses.

When udp is off, the node does not carry UDP. In Rule mode, a UDP flow skips any rule that leads to the node and continues with the following rules (often ending at the final MATCH rule); in Global mode the UDP traffic is dropped, so applications fall back to TCP.

Chained proxies

dialer-proxy is supported for all versions, including obfuscation and ShadowTLS. UDP keeps working through a chain because it is carried over TCP.

Validation

Problem	Result
`psk` missing or empty	The whole configuration fails to load.
`version` missing or not 4 / 5 / 6 (v1–v3 are not supported)	Node is dropped with a warning.
`obfs-opts.mode` not `http` / `tls` / `shadow-tls` (v4 / v5)	Node is dropped with a warning.
`shadow-tls` without `password`, or `version` not `3`	Node is dropped with a warning.
v6 `mode` not `default` / `unshaped` / `unsafe-raw`	Node is dropped with a warning.