General

[general] controls how Core routes traffic and where it listens. It is the only section a profile needs; everything else is optional.

[general]
route-mode = "rule"
global-proxy = ""
log-level = "info"
port = 7890
protocols = "mixed"
allow-lan = false
api-listen = ""
api-secret = ""

Fields

Field	Type	Default	Accepted values
route-mode	string	"rule"	direct, global, rule
global-proxy	string	""	name of a proxy or proxy group; required when route-mode = "global"
log-level	string	"info"	trace, debug, info, warn, error, critical, off
port	integer	7890	1–65535, or 0 for no local listener
protocols	string or array	"mixed"	mixed, http, socks5 (alias socks), none
allow-lan	boolean	false	true listens on 0.0.0.0 instead of 127.0.0.1
ipv6	boolean	false	reported to the UI; DNS IPv6 answers are set by [dns].ipv6
api-listen	string	""	IP:port, localhost:port or [IPv6]:port; empty disables the TCP control API
api-secret	string	""	shared secret for the TCP control API

Any other key in [general] is rejected with Unknown general field.

Routing modes

Mode	Behavior
direct	every connection goes direct; proxies, groups and rules are loaded but unused
global	every connection goes to global-proxy
rule	each connection is matched against [rule].list, first match wins

Start with direct to prove the local setup works, then global to prove a proxy works, then rule. Changing one layer at a time makes failures easy to locate.

Local listener

port and protocols open one local port for applications that support a proxy setting.

[general]
port = 7890
protocols = "mixed"          # HTTP and SOCKS5 on the same port

protocols can also be a list:

[general]
port = 1080
protocols = ["socks5"]       # SOCKS5 only

• mixed is HTTP plus SOCKS5. HTTP includes CONNECT, so HTTPS sites work through it; there is no separate https value.
• none cannot be combined with other values. Use it, or port = 0, when you only want Enhanced Mode and no explicit proxy port.
• Ports below 1024 need elevated privileges.

The same two fields can be written as a sub-table. Use one form or the other, not both:

[general.inbound]
port = 7890
protocols = "mixed"

Clients connect to 127.0.0.1:<port>. For example: curl -x http://127.0.0.1:7890 …, or export ALL_PROXY=socks5h://127.0.0.1:7890.

LAN access

allow-lan = true makes the port reachable from other machines on your network. Anyone who can reach it can use your proxies, so restrict it with a firewall.

Control API

The desktop UI always talks to Core over a local socket (Unix socket on Linux and macOS, named pipe on Windows); that needs no configuration. api-listen additionally opens a TCP endpoint for remote control:

[general]
api-listen = "127.0.0.1:9090"
api-secret = "a-long-random-string"

Keep it on loopback unless you need remote administration. The secret authenticates requests but does not encrypt them.

Names from older versions

These older names are rejected with an error that tells you the replacement:

Old	Current
mixed-port	port
external-controller	api-listen
rest-api-secret, api-secrect	api-secret
top-level [inbound]	port and protocols in [general]
protocols = ["http", "https"]	protocols = "http" (https is not a value)

Other top-level sections

A profile may contain these sections:

Section	Page
[general]	this page
[[proxy]]	Proxies
[[proxy-provider]]	Providers
[[proxy-group]]	Proxy Groups
[rule]	Rules
[dns]	DNS
[sniffer]	Sniffer
[enhanced-mode]	Enhanced Mode

Any other top-level section is rejected. A few names from older profiles — [metadata], [[rule-set]], [[module]], [[subscription]], [hosts] — are ignored with a warning instead, so old files still load; the settings in them have no effect.