VPNGate

English | 简体中文

What is a VPNGate outbound?

A VPNGate outbound gives selected traffic a residential (home-broadband) exit in a chosen country and ISP. m-ui connects the server to a VPN Gate volunteer server through the SoftEther VPN Client, then exposes that tunnel as a managed Mihomo direct outbound bound to the tunnel's network interface.

Like WARP, it only changes the egress of traffic you route to it. The server's default route, the panel's own connections and all other outbounds are unaffected.

Important

VPN Gate servers are run by volunteers. Availability, speed and IP addresses change constantly, and a node can disappear at any time. Read and accept the SoftEther licence and the VPN Gate terms before use.

Requirements

• A Linux server on x86_64 or arm64. Other platforms and architectures are not supported.
• m-ui running as root, because it creates network adapters, DHCP leases and policy routes.
• dhclient for DHCP. On hosts where AppArmor confines dhclient, m-ui adjusts the profile automatically (see below).

Install the client

1. Open Mihomo Settings → Outbounds and click VPNGate.
2. Click Install. m-ui downloads a pinned official SoftEther VPN Client release and builds it.

m-ui checks the build dependencies but never runs apt, yum or another package manager. If something is missing, install it yourself and click Install again.

Add a VPNGate outbound

In the VPNGate window:

Field	Description
Country code	Two uppercase letters, for example JP or KR.
ISP / ASN keyword	A preset ISP, or a fragment of the ASN name to match.
Outbound name	The name used as a Routing Rule or policy-group target. It must not clash with another outbound.
VPNGate NIC index	Slot 0–9. Slot N always uses interface vpn_vpnN and routing table 100+N, so two outbounds never share an interface.

ISP presets:

• Japan: KDDI, SoftBank, Sony, Docomo, Asahi, Chubu. A free ASN keyword is also accepted.
• Korea: KT, SK, LG only.
• Other countries: enter an ASN name keyword.

Click Add to Draft, then Save. After saving, m-ui:

1. Downloads the VPN Gate server list.
2. Looks up each candidate's ASN and keeps the nodes that match the ISP.
3. Connects the slot's adapter, obtains a DHCP lease and installs the policy route.

The Saved VPNGate Outbounds list shows each outbound's state: Starting, Searching nodes, Connecting, Connected, Reconnecting or Error. Restart Mihomo once, as with any outbound change, so the core loads the new outbound.

Same-country ISP fallback

When no node of the chosen ISP is available, m-ui connects to a node of another ISP in the same country, and the status shows Same-country ISP fallback. It keeps checking, and switches back as soon as a node of the target ISP appears. A healthy fallback connection is not torn down before that.

Reconnect and remove

• Reconnect drops the current node and searches again.
• Uninstall NIC adds the removal to the draft. When you click Save, m-ui disconnects, deletes the account, and disables and deletes the adapter.

Route traffic through VPNGate

A VPNGate outbound is a normal outbound name. Use it as a target in Routing Rules, add it to a policy group, or reference it from an inbound's proxy. For example:

GEOSITE,netflix,VPNGate-JP
DOMAIN-SUFFIX,example.jp,VPNGate-JP

ASN lookups and the IPinfo token

To match ISPs, m-ui looks up the ASN of each candidate node:

• With no token, it uses the free IPinfo endpoint first. It falls back to the non-commercial HTTP endpoint of ip-api only after IPinfo explicitly reports its quota is used up.
• With a token set in Panel Settings → General → IPinfo Token, lookups go to IPinfo only.

AppArmor

Before requesting a DHCP lease, m-ui checks whether AppArmor enforces the standard dhclient profile:

• If it does, m-ui adds the configuration, lease, PID and hook permissions for slots 0–9 under the real VPNGate data directory to the profile's local rules, then reloads the profile. Custom installation paths and both sbin.dhclient and usr.sbin.dhclient layouts are supported.
• Existing local rules are kept. The previous file is backed up as a hidden .m-ui-vpngate.bak beside it and restored if loading fails. Reconnecting does not duplicate rules.
• Unconfined or complain-mode profiles are left alone.

This needs root, access to the loaded profile list, and apparmor_parser from the apparmor package. m-ui does not install packages or disable AppArmor. Policy errors appear in the VPNGate status.

Backups

The VPNGate settings of each outbound travel with panel backups. The SoftEther client, leases and process IDs do not. After restoring onto another server:

• If the client is not installed there, the restore reports it. Open the VPNGate window and click Install.
• m-ui stops slots configured by the old state and rebuilds them from the restored settings.

Troubleshooting

• "VPNGate only supports Linux servers": VPNGate is unavailable on Windows and on architectures other than x86_64/arm64.
• Stuck in Searching nodes: there may be no node for that country/ISP right now. Try a broader ASN keyword or another ISP.
• DHCP fails on an AppArmor host: check the VPNGate status for a policy error, and make sure apparmor_parser is installed.
• Traffic does not use the outbound: check that the Routing Rule targets the outbound name, the status is Connected, and Mihomo was restarted after saving.