VLESS→SBX / NIX

A wiring diagram for your vless:// link, not a black box.

Paste a vless:// link to generate a sing-box config. Runs entirely in this tab.

01 · paste your link

One vless:// link per line — multiple build a selector.

step 1 of 5

02 · dns resolution

Remote & direct Remote resolver tunneled through the proxy Direct resolver for LAN, bypass domains & geosite-private Defaults to System default — v2rayN's own default (DNSPod) is unreachable for many outside China.

Bootstrap resolver Bootstrap resolver resolves the DNS servers' own hostnames

step 2 of 5

03 · security posture

Leak protection Block UDP/443 (QUIC)prevents HTTP/3 bypass Reject IPv6also disable IPv6 at the OS level for full leak-proofing Block AAAA DNS answersforces IPv4 at the DNS level

TUN interface Address (CIDR) Stack Strict routeroutes all system traffic into the TUN Own traffic is auto-excluded from the tunnel by process name.

step 3 of 5

04 · optional extras

Local inbounds SOCKS/HTTP inboundoff = TUN-only SOCKS port Clash APIfor GUI clients, bound to localhost Port API secret recommended if exposing beyond localhost

Rule sets & caching geosite-private rule-setoptional — ip_is_private already covers private IPs geosite-private rule-set source DNS cache filepersists DNS cache across restarts

Bypass domains — sent direct, one per line Prefix a line with . or *. to match subdomains only · keyword: for a substring match · regex: for a regular expression

Bypass applications — one Linux process name per line Matches by process name — a full path is fine too, only the filename is used. Linux truncates process names to 15 characters internally.

step 4 of 5

05 · review & download

Verify with sing-box check -c config.json before relying on it.

link

tls / reality

doh dns

route

config.json

// finish step 1 to generate a config here

step 5 of 5