vless:// → config.json

Turn a share link into a hardened client config.

Paste one or more vless:// links. Config Forge builds a sing-box config for the Windows client — TUN inbound, DNS over HTTPS routed through your own proxy, and a fail-closed route table — using the same shape as a v2rayN-generated config. Nothing leaves this tab: the conversion runs locally in JavaScript.

link

tls / reality

doh dns

route

config.json

01 · links

one per line

02 · options

hardened defaults — edit if needed

DNS & privacy Remote resolver (DNS‑over‑HTTPS, tunneled through proxy) Local / direct resolver (for LAN & direct domains) Block UDP/443 (QUIC)stops traffic bypassing the proxy over HTTP/3 Reject IPv6TUN only advertises an IPv4 route — this closes the v6 leak path

TUN interface Interface name Address (CIDR) MTU Stack Strict routeforces all system traffic into the TUN, even off-subnet

Local inbounds SOCKS/HTTP mixed inboundfor apps that don't use the system proxy Port Clash APIfor GUI clients (v2rayN tray, yacd, etc.) — bound to localhost Port API secret (recommended if exposing beyond localhost)

Rule sets & misc geosite-private rule-set source Log level DNS cache filepersists fakeip/cache across restarts, kept next to config.json

Bypass domains — sent direct, not through the proxy One per line. Matches the domain and its subdomains by default. Prefix a line with . or *. to match subdomains only (not the bare domain) · keyword: for a substring match · regex: for a regular expression · full URLs are cleaned to a bare hostname automatically

03 · config.json

// parse a link on the left to generate a config here

reading the output

DNS never leaks in the clear

Remote lookups go out as DoH, and that DoH request is itself sent through the proxy outbound — your resolver sees the proxy server, never your ISP. Direct/LAN domains use the local resolver over plain UDP so split-horizon and captive portals still work.

Fail closed, not fail open

route.final is proxy. Anything not explicitly matched to direct — private IPs and the geosite-private set — goes through the tunnel. If the tunnel is down, it fails, it doesn't silently fall back to your real IP.

Two common leak paths, closed by default

QUIC (UDP/443) can carry HTTP/3 straight past a TCP-only proxy path; it's rejected. IPv6 isn't captured by the IPv4-only TUN address here, so it's rejected too rather than left to route unprotected — both are toggles above if you'd rather handle them differently.

Windows paths

This build targets the Windows sing-box client: experimental.cache_file.path and the rule-set path (if you choose local rule-sets) use Windows-style paths. Point the rule-set path at wherever your sing-box install keeps its .srs files, or leave it on auto-download.