# Instance name
[main]

# Uncomment to bind source socket to a specific interface
# source-if = 0.0.0.0

# Port to listen for the source client (real client or client obfuscator)
source-lport = 13255

# Host and port of the target to forward to (server obfuscator or real server)
target = 10.13.1.100:13255

# Obfuscation key, must be the same on both sides
key = test

# Obfuscation mode. Must be the same on both sides.
# Supported values: wireguard (alias: wg), socks5
#
# wireguard - default. UDP relay that obfuscates WireGuard traffic (masking,
#             static bindings and media-* options apply only to this mode).
# socks5    - TCP relay / proxy for SOCKS5. See 'role' below. The masking option
#             (STUN/MEDIA/TLS) applies here: the obfuscated TCP stream is framed to
#             look like a STUN call (STUN), an RTP/H.264 stream (MEDIA) or an HTTPS
#             session (TLS); use the same value on both sides. For reliable MEDIA
#             detection also set a fixed media-ssrc token.

# SOCKS5 role (only for mode = socks5, default - relay). Must be paired correctly.
#
# relay  - transport-only obfuscating relay: forwards the (de)obfuscated byte stream
#          to a real SOCKS5 server given by 'target'. Deploy as a symmetric pair.
#          Supports extra TCP routes via static-bindings (see below).
# client - local SOCKS5 server: terminates SOCKS5 from the app (CONNECT and UDP
#          ASSOCIATE) and tunnels over the obfuscated channel to the server role
#          ('target' = the server-role instance).
# server - exit: terminates the tunnel and dials the requested targets directly
#          (no external SOCKS5 daemon needed). 'target' is not required.
#
# role = relay
#
# mode = wireguard

# Change this to the name of protocol you want to use for masking for DPI evasion.
# The default is "AUTO", which will not use masking for server side, and will
# automatically detect masking type of the client. AUTO/per-packet autodetection
# is a WireGuard-mode feature only: in socks5 mode "AUTO" behaves exactly like
# "NONE" (the masking type is fixed for the whole process, not negotiated or
# detected per connection), so set it explicitly there.
# Supported values: STUN, MEDIA, TLS, AUTO, NONE
#
# STUN  - traffic is wrapped into STUN messages (autodetected by magic cookie in
#         WireGuard mode; must be set explicitly on both sides in socks5 mode).
# MEDIA - traffic looks like a continuous RTP/H.264 media stream. In WireGuard
#         mode the session starts with a STUN/ICE-like phase (reusing STUN
#         signaling) and then carries data as RTP over UDP. In socks5 mode the
#         TCP stream itself is framed as RTP-over-TCP (RFC 4571). MEDIA must be
#         set explicitly on BOTH sides in both modes (it is not autodetected).
#         See media-* options below.
# TLS   - socks5 mode only (rejected in WireGuard mode). The obfuscated TCP
#         stream is framed as TLS 1.2/1.3 application_data records, so it looks
#         like an ordinary HTTPS session. Must be set explicitly on both sides.
masking = AUTO

# Obfuscate only the first <n> bytes of the payload instead of the whole packet.
# WireGuard mode only (has no effect in socks5 mode, which always obfuscates the
# entire TCP stream). This hides the WireGuard fingerprint (header + reserved
# bytes) while leaving the already-high-entropy WireGuard ciphertext untouched,
# which lowers CPU load on weak routers. 0 = obfuscate the whole payload. When
# MEDIA masking is selected and this is not set, it defaults to 16. Note: with
# partial obfuscation dummy padding is disabled (it must be the same value on
# both sides).
#
# obfuscate-bytes = 16

# MEDIA masking options (used only when masking = MEDIA, same on both sides):
# RTP payload type (dynamic range 96..127):
# media-pt = 96
# RTP SSRC, used as a hidden recognition token (hex or decimal):
# media-ssrc = 0x4D454449
# RTP timestamp clock in frames per second:
# media-clock = 30

# You can specify a static bindings for two-way mode (when the server is also a client)
# This is useful when both WireGuard server and client have a public static IP
# The format is comma-separated list of <client_ip>:<client_port>:<forward_port>,
# where <client_ip> is the IP of the client, <client_port> is the UDP port of the client,
# and <forward_port> is the local UDP port used by connections to the server,
# e.g. UDP port to which the server should send packets.
# Spaces are allowed around the commas.
#
# static-bindings = 1.2.3.4:12883:6670, 5.6.7.8:12083:6679
#
# In socks5 mode with role = relay, static-bindings instead defines extra
# listen->target TCP routes served by the same process:
#   <listen_port>:<target_host>:<target_port>, ...
# e.g. (socks5) static-bindings = 8443:10.0.0.5:443, 9090:example.com:80

# Verbosity level (0 - 4)
# ERRORS (critical errors only)
# WARNINGS (important messages)
# INFO (informational messages: status messages, connection established, etc.)
# DEBUG (detailed debug messages)
# TRACE (very detailed debug messages, including packet dumps)
verbose = INFO

# Maximum number of clients
# This is the maximum number of clients that can be connected to the obfuscator at the same time.
# If the limit is reached, new clients will be rejected.
# Default is 1024.
#
# max-clients = 1024

# Maximum idle timeout in milliseconds
# This is the maximum time in milliseconds that a client can be idle before it is disconnected.
# If the client does not send any packets for this time, it will be disconnected.
# Default is 300 seconds (5 minutes).
#
# idle-timeout = 300

# Maximum dummy length for data packets
# This is the maximum length of dummy data in bytes that can be added to data packets.
# This is used to obfuscate the traffic and make it harder to detect.
# The value must be between 0 and 1024.
# If set to 0, no dummy data will be added.
# Default is 4.
# Note: total packet size with dummy bytes will be limited to 1024 bytes.
#
# max-dummy = 4

# Number of worker threads
# 0 = auto-detect from available CPUs (honors CPU affinity / cgroup limits, spreads
# across physical cores then SMT siblings). Workers share the listen socket(s),
# registered in every worker's epoll instance with EPOLLEXCLUSIVE so the kernel
# wakes only one worker per event, and shard connection state between themselves
# (shared-nothing, no cross-worker locking on the hot path). Set a fixed number
# only for tuning/tests. Default is 0 (auto).
#
# threads = 0

# You can specify multiple instances
# [second_server]
# source-if = 0.0.0.0
# source-lport = 13255
# target = 10.13.1.100:13255
# key = test
# static-bindings = 1.2.3.4:12883:6670, 5.6.7.8:12083:6679
# verbose = 2