sing-box — Universal Proxy Platform with Multi-Protocol Support

Introduction

sing-box is a modern universal proxy platform created by the SagerNet team. It unifies fragmented proxy protocols (Shadowsocks, VMess, Trojan, Hysteria, TUIC, WireGuard, and more) under a single binary with a consistent JSON configuration schema. Unlike older platforms that grew organically, sing-box was designed from scratch with clean abstractions, making it easier to configure and extend.

What sing-box Does

• Runs multiple proxy protocols simultaneously in one process with unified configuration
• Routes traffic using rule sets based on domain, IP-CIDR, GeoIP, process name, and protocol detection
• Provides transparent proxy (TProxy/TUN) for system-wide traffic interception on Linux and mobile
• Implements Clash-compatible API for dashboard monitoring and real-time rule switching
• Supports platform-native TUN interfaces on iOS, Android, macOS, and Windows with GUI clients

Architecture Overview

sing-box uses an inbound/outbound/route architecture. Inbounds accept connections via various protocols or TUN interfaces. The route engine matches connections against ordered rule sets and dispatches to outbounds. DNS is integrated as a first-class subsystem with per-domain resolver routing. The codebase leverages Go's concurrency model with connection pooling and multiplexing. Rule sets can be loaded remotely and cached for offline use.

Self-Hosting & Configuration

• Install via package managers (apt, brew, scoop) or download prebuilt binaries for your platform
• Define inbounds, outbounds, route rules, and DNS in a single JSON configuration file
• Use rule sets (SRS format) for compact binary-encoded domain and IP lists that load instantly
• Enable the Clash API for real-time monitoring via Yacd or MetaCubeX dashboards
• Deploy as a systemd service with auto-restart and log rotation for production servers

Key Features

• Single binary supporting 10+ proxy protocols without external dependencies or plugins
• Clean JSON schema with IDE-friendly documentation and validation support
• Built-in TUN mode for transparent proxying of all system traffic without iptables rules
• Rule set system using compact binary format for fast loading of millions of routing rules
• Active development with rapid protocol adoption (REALITY, ECH, and new QUIC variants)

Comparison with Similar Tools

• V2Ray/Xray — Older platforms with larger ecosystems; sing-box offers cleaner config and unified protocol support
• Clash/mihomo — Rule-based clients using YAML; sing-box uses JSON and supports more server-side protocols
• Hysteria — Single-protocol QUIC proxy; sing-box can use Hysteria as one of many outbounds
• WireGuard — Kernel VPN with simple setup; sing-box integrates WireGuard alongside application-layer protocols
• Shadowsocks-rust — Fast single-protocol implementation; sing-box bundles SS with routing and DNS

FAQ

Q: Can sing-box replace both client and server proxy software? A: Yes. sing-box functions as both a proxy server (accepting inbound connections) and a client (TUN/system proxy), making it suitable for both endpoints of a proxy chain.

Q: Does sing-box support subscription links from proxy providers? A: sing-box itself does not parse subscription URLs, but companion tools and GUI clients (SFI, SFA, SFM) convert subscriptions to sing-box configuration format.

Q: How does TUN mode work on mobile devices? A: On Android and iOS, sing-box creates a VPN tunnel interface through the OS VPN API, intercepting all device traffic and applying routing rules locally before forwarding.

Q: What are rule sets and why use them over inline rules? A: Rule sets are precompiled binary files containing thousands of domain or IP rules. They load in milliseconds compared to parsing large inline JSON arrays, and can be updated independently of the main config.

Sources

• https://github.com/SagerNet/sing-box
• https://sing-box.sagernet.org/