Glossary

The terms you meet when self-hosting a proxy server, each in a sentence or two, with where it shows up in PSM.

Self-hosted proxy

A proxy service you run on a VPS you rent, for yourself and people you trust. The alternative is a commercial proxy subscription (called an "airport" in Chinese communities), shared by many users and run by the provider. Self-hosting gives you an IP nobody else uses and a setup you control; the price is maintaining the server, which is the work PSM is built for.

VPS

A virtual private server: a cloud machine rented by the month, with its own public IP and root access. PSM runs on the VPS and supports Debian, Ubuntu, Alpine and the Red Hat family.

Proxy core

The program that actually carries the proxy traffic. PSM manages three, Xray, sing-box and mihomo, which can be installed side by side; how they differ.

Xray

The proxy core of Project X, where VLESS, REALITY, Vision and XHTTP come from. It counts traffic per user, which PSM's per-user traffic quotas rely on.

sing-box

A universal proxy platform that works as both server and client; as a server it speaks VLESS REALITY, Hysteria2, TUIC, AnyTLS, Shadowsocks and more.

mihomo

Formerly Clash.Meta: the core behind Clash-family clients such as Clash Verge Rev, which can also run as a server. PSM exports complete mihomo client configs.

VLESS

A lightweight proxy protocol with no encryption of its own; TLS or REALITY around it provides encryption and camouflage.

REALITY

Xray's TLS camouflage: the server borrows the TLS handshake of a real website (the camouflage target), so no domain or certificate of your own is needed, and anyone without the right key sees that real website. It is one of the most widely used anti-censorship setups today; choosing the target.

Vision

xtls-rprx-vision, a VLESS flow mode that removes the traffic signature of TLS carried inside TLS; usually paired with REALITY or TLS.

XHTTP

An HTTP-based Xray transport that can pass through a CDN, so a node stays reachable through the CDN when its IP is blocked.

Hysteria2

A proxy protocol over QUIC (UDP) with aggressive congestion control, clearly faster on lossy or congested evening-peak routes. It needs a certificate; a self-signed one works.

Port hopping

A Hysteria2 feature: the client keeps changing its port within a range and the server forwards the whole range to one node, so throttling or blocking of a single UDP port matters less. PSM sets up the forwarding rules; details.

TUIC

Another QUIC-based proxy protocol (PSM uses v5), with low latency; a good spare UDP line next to Hysteria2.

AnyTLS

A TLS-based proxy protocol that uses padding and connection reuse to reduce the TLS-in-TLS signature; supported by sing-box and mihomo.

Snell

A proxy protocol by the Surge team, used mainly by the Surge client.

Shadowsocks 2022

The current Shadowsocks specification (ciphers starting with 2022-blake3), with better keys and replay protection. It needs no domain or certificate and is common for relays and exits.

Trojan

A protocol that dresses proxy traffic as ordinary HTTPS; it needs a domain and a valid certificate.

VMess

V2Ray's older protocol, supported by nearly every client, kept today mostly for older clients.

WireGuard

A modern VPN protocol, fast and simple; it carries a whole device's traffic rather than proxying by app or rule.

WARP

Cloudflare's free network service. PSM connects it as an exit so that chosen sites are reached from a Cloudflare IP, which gets around datacenter IPs being restricted by ChatGPT, Google and others; details.

Residential IP

An IP address of a home broadband line. Streaming and AI services treat it as an ordinary user, while datacenter IPs are often restricted. PSM's free residential exit uses home-broadband nodes offered by VPNGate volunteers.

SNI

The destination domain sent in clear text in the TLS handshake. PSM's port 443 sharing routes connections to nodes by it, without decrypting anything.

Port 443 sharing

Several nodes behind one public port 443: Nginx reads each connection's SNI and hands it to the matching node, and drops unknown names. Details.

Camouflage target

The real website whose TLS handshake REALITY borrows, also called dest or target. Pick a site in the same region that supports TLS 1.3 and is not behind a CDN.

Share links and subscriptions

A share link (such as vless:// or hysteria2://) is one line of text holding all of a node's settings, imported by pasting or scanning a QR code; a subscription is a URL the client polls for the current node list. Details.

Routing rules

Rules by domain, GeoSite, GeoIP or subscribed rule set that decide each connection's exit: direct, WARP, residential, or blocked. GeoSite and GeoIP are ready-made databases of sites by category and IPs by country.

BBR

Google's TCP congestion control, which speeds up high-latency, lossy international routes noticeably. PSM turns it on in one step.

Self-signed certificate

A certificate the server generates itself, not issued by a certificate authority. Hysteria2, TUIC and AnyTLS can use one; the client has to allow an untrusted certificate.