sing-box setup: free, and every protocol supported

sing-box occupies a different niche from Clash: it is a general proxy platform. Any protocol, every platform, official clients, no cost.

Why it is worth having

On iOS it is the only free complete option

The most practical reason:

Feature-wise it gives up nothing, and its protocol coverage is broader. You pay in interface polish.

New protocols arrive here first

Hysteria2, TUIC, VLESS + Reality, AnyTLS — sing-box is typically earliest and most complete.

If your provider issues nodes on a very recent protocol, sing-box is the safe bet.

One config, every device

Windows, macOS, Linux, iOS and Android all have official clients sharing a config format. Set it up once.

Installing

On desktop you choose between the command-line core (write your own config) and a community GUI wrapper. Beginners should take the GUI, or simply use Clash Verge Rev, which handles most of the same protocols — see Clash Verge Rev setup.

Importing a subscription

Mobile

1. Open sing-box
2. Profiles
3. Top right +
4. Type: Remote
5. Name: anything
6. URL: your subscription link
7. Save and wait for the fetch
8. Tap the profile so it becomes active

Step 8 again — imported is not enabled.

1. Back on the home screen, flip the toggle
2. Allow the VPN configuration prompt on first run

Desktop

The GUI flow is similar. The command-line core reads a config.json:

sing-box run -c config.json

What the config looks like

sing-box uses JSON, not YAML:

{
  "log": { "level": "info" },
  "dns": {
    "servers": [
      { "tag": "remote", "address": "https://8.8.8.8/dns-query" },
      { "tag": "local", "address": "223.5.5.5", "detour": "direct" }
    ]
  },
  "inbounds": [
    { "type": "mixed", "listen": "127.0.0.1", "listen_port": 7890 }
  ],
  "outbounds": [
    {
      "type": "hysteria2",
      "tag": "proxy",
      "server": "example.com",
      "server_port": 443,
      "password": "your-password",
      "tls": { "enabled": true, "server_name": "example.com" }
    },
    { "type": "direct", "tag": "direct" }
  ],
  "route": {
    "rules": [
      { "rule_set": "geoip-cn", "outbound": "direct" },
      { "rule_set": "geosite-cn", "outbound": "direct" }
    ],
    "final": "proxy"
  }
}

Mapping to Clash concepts:

Using a subscription, you never touch any of this.

Hysteria2 deserves its own section

sing-box handles Hysteria2 best, and Hysteria2 is notably better than TCP-based protocols on lossy connections.

It runs on QUIC (UDP), with its own congestion control and forward error correction, so a few dropped packets do not collapse throughput the way TCP retransmission does.

Where it wins:

Where it fails:

• Your network restricts UDP. Some campus and corporate networks block it outright.
• UDP is being actively disrupted at that moment.
• Large clock skew between client and server also causes trouble.

Full comparison: SS vs VMess vs Trojan vs Hysteria2.

Common problems

Config parse failure

JSON syntax. Usually:

• A trailing comma after the last element
• Curly quotes instead of straight ones
• Unbalanced brackets

Any JSON validator will point at the line.

Subscription imports empty

• Wrong format (Clash YAML given to sing-box)
• Dead link
• No route out, so the fetch never completed

Walkthrough: No nodes after importing.

iOS keeps dropping

The usual iOS suspects, identical to Shadowrocket:

1. Connect On Demand off
2. iCloud Private Relay off
3. Low Power Mode off

Details in Shadowrocket setup — the causes and fixes are the same.

You want graphical rule editing

The official client is deliberately spare here. If you want to edit rules often, browse the connection list, or route by process, Clash Verge Rev's interface is more comfortable.

What I actually run: sing-box on the iPhone, because it is free and sufficient; Clash Verge Rev on the desktop, because the interface is pleasant. Both fed by the same provider in their respective formats.

Read next

• Shadowrocket setup
• SS vs VMess vs Trojan vs Hysteria2
• Clash Verge Rev setup
• How to actually test a free node