Inbounds

English | 简体中文

What is an inbound?

An inbound is a Mihomo listener that accepts client connections. In Inbounds, each row represents a listener and can contain one or more client credentials when the underlying Mihomo protocol supports multiple users.

Supported listener types

The current UI includes:

• mixed
• http
• socks
• shadowsocks
• snell
• vmess
• vless
• trojan
• hysteria2
• tuic
• anytls
• mieru
• sudoku
• shadowquic
• trusttunnel
• hysteria2-realm

Available fields change when the protocol, network, or security mode changes. m-ui validates the values using Mihomo's actual listener model before writing config.yaml.

Creating an inbound

1. Open Inbounds.
2. Click Add Inbound.
3. Choose a protocol and enter a unique Remark, Listen IP, and port.
4. Configure protocol, transport, security, and client settings.
5. Save the inbound.
6. Use General Actions → Test Current Config.
7. Restart Mihomo to apply the saved YAML.

Important

Saving an inbound regenerates the managed YAML, but a running Mihomo process continues using its previous configuration until you restart Mihomo.

Common settings

• Enabled controls whether the listener is emitted to Mihomo.
• Remark must be unique because Mihomo listener names cannot be duplicated.
• Listen IP is usually 0.0.0.0, ::, or a specific local address.
• Port must not conflict with another inbound, the panel, subscription service, mixed port, or controller.
• Total Flow and Duration set inbound-level limits.
• Traffic Reset supports never, hourly, daily, weekly, or monthly resets.
• Description is panel metadata and can be used in generated node remarks.

Clients

Multi-user listeners have a Clients section. A client can include a Username/Name, protocol credential, enable flag, traffic cap, expiry time, and optional expiry-after-first-use behavior.

The effective subscription username is the client's Username when present, otherwise its Name. Clients with the same Username across different inbounds are aggregated into one subscription.

Single-secret listeners

Some Mihomo listeners contain one secret rather than a list of independently authenticated users. m-ui exposes only one meaningful client cell for these inbounds during synchronization. Examples include Shadowsocks, Snell, and Sudoku.

For Shadowsocks, the core authenticates the single listener password. Additional panel client metadata cannot make Mihomo enforce separate passwords for the same listener. For Snell, the PSK is stored in its single client and a client version must be stated explicitly because Mihomo's client and listener defaults differ.

Security and transport

Depending on the protocol, the editor can expose:

• TLS certificate and private-key paths
• Client certificate authentication
• ECH key material
• Reality destination, server names, key pair, short IDs, fingerprint, and SpiderX
• WebSocket and gRPC transport settings
• XHTTP, mKCP, and Mekya settings
• ShadowTLS, RestTLS, TLSMirror, JLS, and Trojan SS extensions
• Hysteria2 and TUIC QUIC parameters
• AnyTLS padding schemes

Only options understood by the selected Mihomo listener are emitted. Some fields, such as a client-facing SNI or allow-insecure marker for protocols that do not accept it on the listener, may be retained for share-link generation without being written as a server option.

Traffic and online state

The Inbounds page shows total upload/download, usage, inbound count, client count, and online indicators. Client quota enforcement and inbound/client counters are always active. Traffic changes are sampled from Mihomo, so very short connections may not appear in outbound-classified counters.

Row actions

Depending on the item, the row menu allows editing, copying/exporting links, exporting the inbound as JSON, resetting traffic, enabling/disabling, and deleting. When an inbound has no supported share-link representation, no usable link is emitted.

General Actions

• Import an Inbound imports an m-ui inbound JSON file.
• Export All URLs exports available share links.
• Export All Subscriptions lists the normal browser subscription URL for every Username.
• Export All Subscriptions (Cross Panel) opens the cross-panel aggregation window.
• Test Current Config asks Mihomo to validate the generated YAML.
• Reset All Inbounds Traffic clears inbound counters.
• Reset All Clients Traffic clears client counters.
• Sync Inbound sends selected inbound/client combinations to trusted peer panels.
• Delete Depleted Clients deletes clients whose traffic or expiry limit is exhausted.

Destructive actions ask for confirmation. Create a backup before bulk deletion or major configuration changes.

Certificate portability during synchronization

Sync Inbound reads referenced certificate, private-key, and client-CA files on the source and transports their PEM content through the encrypted peer session. It does not assume that the target server has the same path. Machine-specific values such as listen addresses, masquerade destinations, and outbound names still require a compatible target environment.