SOCKS5

A SOCKS5 node forwards connections through a standard SOCKS5 server, with or without user name / password authentication. It is useful for self-hosted proxies, proxies on your local network, or as the last hop of a chain. SOCKS5 itself is not encrypted; do not use it across untrusted networks unless it is wrapped in an encrypted chain.

Nodes use the mihomo / Clash Meta config format (type: socks5).

Minimal example

proxies:
  - name: socks-node
    type: socks5
    server: 192.0.2.1
    port: 1080

Full example

proxies:
  - name: socks-auth
    type: socks5
    server: example.com
    port: 1080
    username: your-username
    password: your-password
    udp: true

Parameters

Field	Type	Required	Default	Description
`name`	string	Yes	—	Node name. Must be unique.
`type`	string	Yes	—	`socks5`.
`server`	string	Yes	—	Server domain name or IP address.
`port`	integer	Yes	—	Server TCP port.
`username`	string	No	—	User name for user name / password authentication (RFC 1929). When set, MeowX offers only that method.
`password`	string	With `username`	—	Password for that user.
`udp`	boolean	No	`false`	Enable UDP relay through the server (SOCKS5 `UDP ASSOCIATE`).
`dialer-proxy`	string	No	—	Send the TCP connection through another node or group. See Chained proxies.

Ignored fields

tls, sni, skip-cert-verify, fingerprint — SOCKS5 over TLS is not supported; the connection is always plain TCP.

Authentication

Without username, MeowX asks for no authentication. If the server insists on a password, the connection fails.
With username, MeowX asks for user name / password authentication. Set password as well, otherwise the connection fails when the server asks for it.

UDP

With udp: true, MeowX opens a SOCKS5 UDP ASSOCIATE session and sends datagrams to the relay address the server returns. If the server returns 0.0.0.0 as the relay address (common), MeowX sends to the server’s own address instead.

UDP is full-cone: one association can talk to many destinations.
The server and every firewall in between must allow the UDP relay port, not just the TCP port.
With udp: false (the default), the node does not carry UDP. In Rule mode, a UDP flow skips any rule that leads to the node and continues with the following rules (often ending at the final MATCH rule); in Global mode the UDP traffic is dropped, so applications fall back to TCP.

Chained proxies

dialer-proxy is supported for TCP. Because SOCKS5 UDP datagrams travel outside the TCP connection, UDP is turned off on a SOCKS5 node that uses dialer-proxy, even if udp: true is set.

Timeouts

The SOCKS5 greeting, authentication and connect reply must arrive within 5 seconds after the TCP connection is established; otherwise the connection fails.

Validation

SOCKS5 has no node-specific required fields beyond name, type, server and port. A missing port makes the whole configuration fail to load.