Direct

Changes in sing-box 1.11.0

direct outbound send requests directly.

Structure

{
  "type": "direct",
  "tag": "direct-out",

  "override_address": "1.0.0.1",
  "override_port": 53,
  "use_origin_dst": false,
  "xlat464_prefix": "",

  ... // Dial Fields
}

Fork-Specific Dial Fields

Fork additions

ipv6_source_address_range
ipv6_source_address_mode

Fields

override_address

Deprecated in sing-box 1.11.0

Destination override fields are deprecated in sing-box 1.11.0 and will be removed in sing-box 1.13.0, see Migration.

Override the connection destination address.

override_port

Deprecated in sing-box 1.11.0

Destination override fields are deprecated in sing-box 1.11.0 and will be removed in sing-box 1.13.0, see Migration.

Override the connection destination port.

Protocol value can be 1 or 2.

use_origin_dst

Use the original destination address obtained via SO_ORIGINAL_DST (Linux transparent proxy) instead of the connection's apparent destination.

Use this when the connection was redirected by iptables/nftables REDIRECT or TPROXY, and the direct outbound should forward to the pre-redirect destination rather than the local listener address.

xlat464_prefix

464XLAT (CLAT) prefix for synthesizing an IPv4-mapped IPv6 address (RFC 6052). Must be a /96 prefix.

When set, IPv4 destination addresses are translated to IPv6 by embedding them in this prefix, enabling IPv4 connectivity over IPv6-only networks.

Example: "64:ff9b::/96" (the well-known NAT64 prefix)

ipv6_source_address_range

This is a fork-specific dial field.

Select source IPv6 addresses from this CIDR prefix when direct dialing IPv6 destinations.

When configured, sing-box selects an IPv6 source address from the specified prefix for outbound connections to IPv6 destinations. This is useful for:

IPv6 address isolation and tracking
Per-user IPv6 source address assignment (when used with hash_rid mode)
Compliance with IPv6 prefix delegation scenarios

Accepted prefix length range is /0 through /64.

Example: "fd00:1234:5678::/48" - Uses addresses from this ULA prefix

If source selection fails, sing-box logs a fallback warning and continues with normal direct dialing behavior.

ipv6_source_address_mode

This is a fork-specific dial field.

Selection mode for ipv6_source_address_range.

Mode	Description
`random` (default)	Randomly select an address from the range for each connection
`hash_5tuple`	Hash the inbound 5-tuple (network, source IP, source port, destination IP, destination port) for stable source address per connection flow
`hash_rid`	Hash the connection's Resource ID (from JWT authentication) for stable source address per user

hash_rid Mode

When using mixed inbound JWT authentication, the hash_rid mode assigns each authenticated user a consistent IPv6 source address based on their Resource ID (rid claim).

This enables: - Stable per-user IPv6 addresses across connections - IPv6-based user identification and tracking - Compliance with IPv6 prefix delegation requirements

If no Resource ID is available (unauthenticated connections), sing-box logs a fallback warning and continues with normal direct dialing behavior.

Example configuration:

{
  "outbounds": [
    {
      "type": "direct",
      "tag": "direct",
      "ipv6_source_address_range": "fd00:cafe:babe::/48",
      "ipv6_source_address_mode": "hash_rid"
    }
  ]
}

Dial Fields

See Dial Fields for details.