vless:// → config.json

Built from v2rayN's own C# source, not reverse-engineered.

Five steps: paste a link, set your DNS, set your security posture, add anything optional, then review and download. This tool's DNS/routing generation is ported directly from v2rayN's actual SingboxDnsService.cs / SingboxRoutingService.cs source. Nothing leaves this tab.

01 · paste your link

One or more vless:// share links, one per line. Multiple links build a selector so you can flip between servers later.

step 1 of 5

02 · dns resolution

v2rayN's 3-tier architecture: a bootstrap resolver handles the remote/direct servers' own hostnames, so any custom DoH provider works out of the box.

Remote & direct Remote resolver tunneled through the proxy Direct resolver for LAN, bypass domains & geosite-private v2rayN's actual default is 119.29.29.29 (DNSPod), a China-anycast address unreachable for many users outside China. Defaulted to System default here instead.

Bootstrap resolver Bootstrap resolver resolves the remote/direct servers' own hostnames — plain IP, no chicken-and-egg problem

step 2 of 5

03 · security posture

Leak protection, TUN interface behavior, and anti-detection options — the real v2rayN TUN policies (ICMP routing, TLS fragmentation) most generators skip.

Leak protection Block UDP/443 (QUIC)stops traffic bypassing the proxy over HTTP/3 Reject IPv6drops IPv6 that reaches the tunnel — true leak-proofing needs it disabled at the OS/adapter level too

TUN interface Address (CIDR) Stack Strict routeforces all system traffic into the TUN, even off-subnet TLS record fragmentationsplits sniffed TLS ClientHellos to evade SNI-based blocking This client's own traffic is always excluded from the tunnel automatically, by process name — no manual path needed.

step 3 of 5

04 · optional extras

Everything here is optional — local inbounds, rule sets, and domains/apps you'd rather send direct.

Local inbounds SOCKS/HTTP inboundfor apps that don't use the system proxy — off means TUN-only SOCKS port Clash APIfor GUI clients (v2rayN tray, yacd, etc.) — bound to localhost Port API secret recommended if exposing beyond localhost

Rule sets & caching geosite-private rule-setmatches local-network hostnames direct — not required: ip_is_private already covers private IPs geosite-private rule-set source DNS cache filepersists fakeip/cache across restarts

Bypass domains — sent direct, one per line Prefix a line with . or *. to match subdomains only · keyword: for a substring match · regex: for a regular expression

Bypass applications — one Windows executable per line Matches by process name — a full path is fine too, only the filename is used.

step 4 of 5

05 · review & download

Trace confirms which pieces are live. Download, then verify with sing-box check -c config.json before relying on it.

link

tls / reality

doh dns

route

config.json

// finish step 1 to generate a config here

step 5 of 5

reading the output

Bootstrap DNS, not a hosts-only guess

A small plain-IP bootstrap resolver handles resolving the remote/direct DNS servers' own hostnames by default — so any custom DoH provider works, not just ones hardcoded into a hosts table.

Real self-loop protection

The TUN interface's own address is explicitly rejected-and-dropped in route.rules, matched per single address rather than by CIDR prefix — on Linux, sing-tun registers a derived address in that same prefix range with systemd-resolved as a DNS upstream, so a prefix-wide match would silently break system DNS.

No forced TLS fingerprint

If your vless:// link doesn't specify fp=, no utls block is added at all — matching v2rayN's own behavior. Want one anyway? Step 3 has an explicit override.

Fail closed, not fail open

route.final is proxy. Anything not explicitly matched to direct goes through the tunnel. If the tunnel is down, it fails, it doesn't silently fall back to your real IP.