Trojan

Trojan disguises proxy traffic as ordinary HTTPS. The client opens a TLS connection to the server and sends a hash of the password followed by the destination. Anything that fails authentication is handed to a real web server, so probes only ever see a website. In MeowX, TLS is on by default for Trojan. REALITY and the WebSocket / gRPC / XHTTP transports are also supported, and UDP is full-cone.

Examples

Minimal:

proxies:
  - name: trojan-basic
    type: trojan
    server: example.com
    port: 443
    password: "your-password"

All supported options (Trojan over WebSocket):

proxies:
  - name: trojan-ws
    type: trojan
    server: example.com
    port: 443
    password: "your-password"
    udp: true
    sni: cdn.example.com
    alpn:
      - http/1.1
    skip-cert-verify: false
    network: ws
    ws-opts:
      path: /trojan
      headers:
        Host: cdn.example.com
    dialer-proxy: relay-group

Trojan with REALITY:

proxies:
  - name: trojan-reality
    type: trojan
    server: 192.0.2.1
    port: 443
    password: "your-password"
    sni: www.example.com
    reality-opts:
      public-key: "SERVER-PUBLIC-KEY-BASE64URL"
      short-id: "01ab"

Parameters

Field	Type	Required	Default	Description
`name`	string	yes	—	Node name.
`type`	string	yes	—	`trojan`
`server`	string	yes	—	Server domain or IP.
`port`	integer	yes	—	Server port.
`password`	string	yes	—	Trojan password.
`udp`	boolean	no	`false`	Relay UDP (full-cone).
`tls`	boolean	no	`true`	TLS is on unless you set `tls: false` explicitly, which sends Trojan in the clear (rarely useful). REALITY does not depend on this field.
`sni` / `servername`	string	no	`server`	TLS / REALITY server name. If both are set, `servername` wins.
`alpn`	list of strings	no	—	TLS ALPN protocols (ignored with REALITY).
`skip-cert-verify`	boolean	no	`false`	Accept any server certificate (TLS only).
`reality-opts`	map	no	—	`public-key` and `short-id`. See REALITY.
`network`	string	no	`tcp`	Transport: `tcp`, `ws`, `grpc` or `xhttp`. See Transports.
`ws-opts`	map	no	—	WebSocket options (`path`, `headers`). Also supplies the path for `xhttp`.
`grpc-opts`	map	no	—	gRPC options (`grpc-service-name`).
`dialer-proxy`	string	no	—	Connect to the server through another proxy or group.

Transports and security

TLS (default). With a direct connection the system TLS stack is used; through dialer-proxy, MeowX’s own TLS 1.3 client is used. A self-signed server certificate needs skip-cert-verify: true. See TLS and REALITY.
REALITY is used whenever reality-opts.public-key is set, replacing normal TLS.
Transports — ws, grpc and xhttp, on top of TLS or REALITY. See Transports.

UDP

With udp: true, UDP is carried inside the Trojan connection (Trojan’s UDP ASSOCIATE command). Every datagram carries its own destination, so UDP is full-cone. UDP also works through dialer-proxy.

Validation

Problem	Result
`password` missing or empty	The whole configuration is rejected.
Invalid REALITY `public-key`	Connections fail with an error naming the key.
Unknown `network` value (for example `h2`, `httpupgrade`)	No warning. The node connects without any transport framing and will fail against such a server.