sing-box in plain terms: a universal proxy core
sing-box is a universal proxy and VPN platform written in Go. A single binary can work as both a server and a client, and it supports almost all current protocols: VLESS, VMess, Shadowsocks, Trojan, Hysteria/Hysteria2, TUIC, WireGuard, ShadowTLS, plus built-in DNS resolvers and advanced routing.
Why it is needed: instead of keeping one client on your phone for WireGuard, another for VLESS, and a third for Hysteria, you install one universal client — sing-box or a GUI built on it (Hiddify, NekoBox, sing-box for Apple). All your subscriptions and configs work in one place.
Below we will look at what this “core” is, which protocols it covers, and how it differs from the related Xray-core.
In short
- sing-box is a cross-platform proxy and VPN core written in Go, packaged as a single binary.
- It supports VLESS, VMess, Shadowsocks, Trojan, Hysteria/Hysteria2, TUIC, WireGuard, ShadowTLS.
- It works as both a client and a server — you can run your own node from the same file.
- It is used inside Hiddify, NekoBox, sing-box for iOS/macOS.
- It is both a competitor and a relative of Xray-core: its own architecture, regular updates.
- Universal routing: by domains, IPs, ASN, GeoIP, through rule-set.
What is inside sing-box
Technically, sing-box is a set of modules glued into one process. It takes a JSON config with inbounds (how to accept traffic), outbounds (where to send it), and route (routing rules). The core then decides which packet should be sent into which tunnel.
Which protocols it supports
Out of the box, it includes all widely used modern protocols: VLESS (including REALITY and XTLS-Vision), VMess, Trojan, Shadowsocks with AEAD and Shadowsocks-2022, Hysteria version 1 and 2, TUIC v5, WireGuard, ShadowTLS v1/v2/v3. The full list and support status are in the sagernet/sing-box repository.
One binary — client and server
Unlike the classic “client here, server there” model, in sing-box the role is defined by the config. The same binary can be run on a VPS as a server and on a laptop as a client. This is convenient: one set of documentation, one logic, no “version zoo”.
Routing and DNS
sing-box can filter traffic before it enters the tunnel: you can send Russian sites directly, Western sites through REALITY, and torrents through WireGuard. The built-in DNS supports fakeip, DoH/DoT, and different resolvers for different rules.
Why a “native” GUI is needed
The sing-box binary itself is launched from the console. Wrappers are more convenient for regular users: Hiddify, NekoBox, sing-box for Apple. Under the hood, all of them run the same core, but add subscription import, switch buttons, and a status widget.
What can break when using sing-box
| Symptom | Possible cause | What to check |
|---|---|---|
| The client says “config parse error” | A typo in JSON, a required field is missing | Check the config with a linter, look at the changelog for your version |
| There is a connection, but sites do not open | DNS is going outside the tunnel | Enable fakeip, check the dns block in the config |
| Some sites go directly | routing rules with geoip ru were triggered | Check the rule order in route → rules |
| After a day, the client silently disconnected | The VMess/VLESS token or key expired | Reissue the key, update the subscription |
| The client works on iOS, but not on Android | Different core versions inside the wrappers | Compare the sing-box version in About |
| Ping is too high | The core has nothing to do with it — the server is far away | Switch to a VPS that is geographically closer to Russia |
How to check right now
If your sing-box client has stopped working, the source of the problem is almost never the core itself — it is stable and well tested. More often, the issue is either a specific server from the subscription or protocol blocking by your operator.
Freedom Checker collects data on the availability of popular protocols by operator and region. If you see many checks saying “vless+reality does not respond for everyone on one operator,” the issue is not your client.
Failure or blocking?
A sing-box failure usually appears the same way across all protocols at once: the client does not start, it crashes on launch, or there is a general config error. This is about an app update or broken JSON.
Blocking behaves in a targeted way: one protocol does not work, another does; one server does not respond, another does. sing-box makes it easy to check this in a minute: add an alternative outbound and switch the active config. If the alternative works, the problem is not in the core, but in filtering of a specific flow.
What to pay attention to
- Watch the version: new DPI heuristics often appear before a core update.
- Keep 2 outbounds with different protocols so you can switch quickly when something drops.
- Enable TUN mode (system proxy) only if you are sure — otherwise traffic goes around it.
- sing-box logs in debug mode give a clear report on the handshake.
- It is better to use subscriptions with updatable URLs, not one-time static files.
- When switching the core to a new major version, read the migration guide — the JSON format changes.
- On a server, sing-box is convenient because one process can listen for VLESS+REALITY and Hysteria2 at the same time.
Conclusion
sing-box is a “universal remote” for modern proxies and VPNs. It does not do anything that Xray or WireGuard cannot do separately, but it combines them into one client and one routing logic. For a user with 3–4 different configs from different services, this is a major simplification.
If you are just starting to figure it out, it is easier to take a GUI based on the sing-box core (Hiddify or sing-box for Apple) and use it like a normal VPN client — without editing JSON.