SagerNet · xchacha20-poly1305 · Apr 28, 2026 · Jan 28, 2026
diff --git a/constant/proxy.go b/constant/proxy.go
@@ -34,6 +34,7 @@ const (
 	TypeOOMKiller          = "oom-killer"
 	TypeACME               = "acme"
 	TypeCloudflareOriginCA = "cloudflare-origin-ca"
+	TypeTrustTunnel        = "trusttunnel"
 )
 
 const (
@@ -93,6 +94,8 @@ func ProxyDisplayName(proxyType string) string {
 		return "Tailscale"
 	case TypeCloudflared:
 		return "Cloudflared"
+	case TypeTrustTunnel:
+		return "TrustTunnel"
 	case TypeSelector:
 		return "Selector"
 	case TypeURLTest:

diff --git a/docs/changelog.md b/docs/changelog.md
@@ -2,6 +2,10 @@
 icon: material/alert-decagram
 ---
 
+#### 1.14.0-alpha.20
+
+** Fixes and improvements
+
 #### 1.14.0-alpha.19
 
 * Preserve comments between formatting

diff --git a/docs/configuration/inbound/index.md b/docs/configuration/inbound/index.md
@@ -31,11 +31,12 @@
 | `hysteria2`   | [Hysteria2](./hysteria2/)     | :material-close: |
 | `vless`       | [VLESS](./vless/)             | TCP              |
 | `anytls`      | [AnyTLS](./anytls/)           | TCP              |
+| `trusttunnel` | [TrustTunnel](./trusttunnel/) | TCP              |
 | `tun`         | [Tun](./tun/)                 | :material-close: |
 | `redirect`    | [Redirect](./redirect/)       | :material-close: |
 | `tproxy`      | [TProxy](./tproxy/)           | :material-close: |
 | `cloudflared` | [Cloudflared](./cloudflared/) | :material-close: |
 
 #### tag
 
-The tag of the inbound.
+The tag of the inbound.
diff --git a/docs/configuration/inbound/index.zh.md b/docs/configuration/inbound/index.zh.md
@@ -31,11 +31,12 @@
 | `hysteria2`   | [Hysteria2](./hysteria2/)     | :material-close: |
 | `vless`       | [VLESS](./vless/)             | TCP              |
 | `anytls`      | [AnyTLS](./anytls/)           | TCP              |
+| `trusttunnel` | [TrustTunnel](./trusttunnel/) | TCP              |
 | `tun`         | [Tun](./tun/)                 | :material-close: |
 | `redirect`    | [Redirect](./redirect/)       | :material-close: |
 | `tproxy`      | [TProxy](./tproxy/)           | :material-close: |
 | `cloudflared` | [Cloudflared](./cloudflared/) | :material-close: |
 
 #### tag
 
-入站的标签。
+入站的标签。
diff --git a/docs/configuration/inbound/trusttunnel.md b/docs/configuration/inbound/trusttunnel.md
@@ -0,0 +1,80 @@
+---
+icon: material/new-box
+---
+
+!!! question "Since sing-box 1.14.0"
+
+### Structure
+
+```json
+{
+  "type": "trusttunnel",
+  "tag": "trusttunnel-in",
+
+  ... // Listen Fields
+
+  "users": [
+    {
+      "username": "trust",
+      "password": "tunnel"
+    }
+  ],
+  "quic_congestion_control": "bbr",
+  "network": "tcp,udp",
+  "tls": {}
+}
+```
+
+### Listen Fields
+
+See [Listen Fields](/configuration/shared/listen/) for details.
+
+### Fields
+
+#### users
+
+==Required==
+
+TrustTunnel user list.
+
+#### users.username
+
+==Required==
+
+TrustTunnel username.
+
+#### users.password
+
+==Required==
+
+TrustTunnel user password.
+
+#### quic_congestion_control
+
+QUIC congestion control algorithm.
+
+| Algorithm | Description |
+|-----------|-------------|
+| `bbr` | BBR |
+| `bbr_standard` | BBR (Standard version) |
+| `bbr2` | BBRv2 |
+| `bbr_variant` | BBRv2 (An experimental variant) |
+| `cubic` | CUBIC |
+| `reno` | New Reno |
+
+`bbr` is used by default.
+
+#### network
+
+Network list.
+
+Available values:
+
+- `tcp` (HTTP/2)
+- `udp` (HTTP/3)
+
+When `udp` is enabled, `tls` must be enabled.
+
+#### tls
+
+Inbound TLS configuration, see [TLS](/configuration/shared/tls/#inbound).
diff --git a/docs/configuration/inbound/trusttunnel.zh.md b/docs/configuration/inbound/trusttunnel.zh.md
@@ -0,0 +1,80 @@
+---
+icon: material/new-box
+---
+
+!!! question "自 sing-box 1.14.0 起"
+
+### 结构
+
+```json
+{
+  "type": "trusttunnel",
+  "tag": "trusttunnel-in",
+
+  ... // 监听字段
+
+  "users": [
+    {
+      "username": "trust",
+      "password": "tunnel"
+    }
+  ],
+  "quic_congestion_control": "bbr",
+  "network": "tcp,udp",
+  "tls": {}
+}
+```
+
+### 监听字段
+
+监听字段参阅 [监听字段](/zh/configuration/shared/listen/)。
+
+### 字段
+
+#### users
+
+==必填==
+
+TrustTunnel 用户列表。
+
+#### users.username
+
+==必填==
+
+TrustTunnel 用户名。
+
+#### users.password
+
+==必填==
+
+TrustTunnel 用户密码。
+
+#### quic_congestion_control
+
+QUIC 拥塞控制算法。
+
+| 算法 | 描述 |
+|------|------|
+| `bbr` | BBR |
+| `bbr_standard` | BBR (标准版) |
+| `bbr2` | BBRv2 |
+| `bbr_variant` | BBRv2 (一种试验变体) |
+| `cubic` | CUBIC |
+| `reno` | New Reno |
+
+默认使用 `bbr`。
+
+#### network
+
+网络列表。
+
+可选值：
+
+- `tcp` (HTTP/2)
+- `udp` (HTTP/3)
+
+当启用 `udp` 时，必须启用 `tls`。
+
+#### tls
+
+入站 TLS 配置，参阅 [TLS](/zh/configuration/shared/tls/#inbound)。
diff --git a/docs/configuration/outbound/index.md b/docs/configuration/outbound/index.md
@@ -37,6 +37,7 @@
 | `selector`     | [Selector](./selector/)         |
 | `urltest`      | [URLTest](./urltest/)           |
 | `naive`        | [NaiveProxy](./naive/)          |
+| `trusttunnel`  | [TrustTunnel](./trusttunnel/)   |
 
 #### tag
 

diff --git a/docs/configuration/outbound/index.zh.md b/docs/configuration/outbound/index.zh.md
@@ -37,6 +37,7 @@
 | `selector`     | [Selector](./selector/)         |
 | `urltest`      | [URLTest](./urltest/)           |
 | `naive`        | [NaiveProxy](./naive/)          |
+| `trusttunnel`  | [TrustTunnel](./trusttunnel/)   |
 
 #### tag
 

diff --git a/docs/configuration/outbound/trusttunnel.md b/docs/configuration/outbound/trusttunnel.md
@@ -0,0 +1,85 @@
+---
+icon: material/new-box
+---
+
+!!! question "Since sing-box 1.14.0"
+
+### Structure
+
+```json
+{
+  "type": "trusttunnel",
+  "tag": "trusttunnel-out",
+
+  "server": "127.0.0.1",
+  "server_port": 443,
+  "username": "trust",
+  "password": "tunnel",
+  "health_check": true,
+  "quic": false,
+  "quic_congestion_control": "bbr",
+  "tls": {},
+
+  ... // Dial Fields
+}
+```
+
+### Fields
+
+#### server
+
+==Required==
+
+The server address.
+
+#### server_port
+
+==Required==
+
+The server port.
+
+#### username
+
+==Required==
+
+Authentication username.
+
+#### password
+
+Authentication password.
+
+#### health_check
+
+Enable periodic health check.
+
+#### quic
+
+Use QUIC transport.
+
+- `false`: Use HTTP/2 over TCP.
+- `true`: Use HTTP/3 over UDP.
+
+#### quic_congestion_control
+
+QUIC congestion control algorithm.
+
+| Algorithm | Description |
+|-----------|-------------|
+| `bbr` | BBR |
+| `bbr_standard` | BBR (Standard version) |
+| `bbr2` | BBRv2 |
+| `bbr_variant` | BBRv2 (An experimental variant) |
+| `cubic` | CUBIC |
+| `reno` | New Reno |
+
+`bbr` is used by default.
+
+#### tls
+
+==Required==
+
+Outbound TLS configuration, see [TLS](/configuration/shared/tls/#outbound).
+
+### Dial Fields
+
+See [Dial Fields](/configuration/shared/dial/) for details.