Working with Other Proxies

UA3F can run as a local processing node before or after other proxy tools. A common setup is to run UA3F in SOCKS5 or HTTP mode and let Clash, gateway firewall rules, or another proxy client forward selected TCP/HTTP traffic to UA3F.

Common topologies

Clash forwards to UA3F

This is the simplest setup for desktop Clash deployments. Clash handles rule routing and upstream proxies, while UA3F handles HTTP rewrite, MitM, L3 rewrite, or Desync.

Client -> Clash -> UA3F -> Direct/Upstream

UA3F configuration:

server-mode: SOCKS5
bind-address: 127.0.0.1
port: 1080

rewrite-mode: GLOBAL
user-agent: "FFF"

Clash snippet:

proxies:
  - name: "ua3f"
    type: socks5
    server: 127.0.0.1
    port: 1080
    url: http://connectivitycheck.platform.hicloud.com/generate_204
    udp: false

rules:
  - NETWORK,udp,DIRECT
  - MATCH,ua3f

UA3F handles transparent traffic first

When UA3F runs on a gateway, it can use TPROXY, REDIRECT, or NFQUEUE mode to capture traffic before applying rewrite and network-layer processing.

server-mode: TPROXY
bind-address: 0.0.0.0
port: 1080

rewrite-mode: GLOBAL
user-agent: "FFF"

This setup must be paired with system firewall rules that send target traffic into UA3F's listen port. Linux gateway deployments are usually the better fit when TCP-layer processing, L3 rewrite, or Desync is needed.

Clash guidance

Scenario	Recommended setup	Notes
HTTP rewrite only	Clash -> UA3F SOCKS5	Clash handles routing; UA3F handles Header/Body/URL rewrite
HTTPS Header/Body rewrite	Clash -> UA3F SOCKS5 + MitM	Enable MitM only for hostnames that need rewriting
Transparent gateway capture	UA3F TPROXY or REDIRECT	Requires firewall forwarding rules
L3 rewrite or Desync	UA3F gateway mode	Network-layer features fit Linux gateways better
Upstream proxy subscriptions	Clash proxy-provider	Clash keeps subscriptions; UA3F acts as the local processing node

Reference configurations

These files live in the UA3F repository under configs/clash and can be downloaded and adjusted as needed.

Variant	File	UA3F mode	Notes
China only	ua3f-socks5-cn.yaml	SOCKS5	Ready to use
Proxy support	ua3f-socks5-global.yaml	SOCKS5	Add your subscription URL under proxy-providers > Global-ISP > url
DPI evasion with proxy support	ua3f-socks5-global-dpi.yaml	SOCKS5	Add your subscription URL under proxy-providers > Global-ISP > url
TProxy with proxy support	ua3f-tproxy-cn-dpi.yaml	TPROXY / REDIRECT / NFQUEUE	Add your subscription URL under proxy-providers > Global-ISP > url
TProxy DPI evasion with proxy support	ua3f-tproxy-global-dpi.yaml	TPROXY / REDIRECT / NFQUEUE	Add your subscription URL under proxy-providers > Global-ISP > url

Troubleshooting

• Ensure the UA3F listen address and port match the server and port values in Clash.
• If UA3F and Clash do not share the same network namespace, do not use 127.0.0.1; use a reachable address instead.
• UDP usually does not go through UA3F's HTTP rewrite flow, so NETWORK,udp,DIRECT is often appropriate in Clash.
• When MitM is enabled, clients must trust the UA3F CA and mitm.hostname must match the target hostname.
• When L3 rewrite or Desync is enabled, verify kernel support, firewall rules, and permissions first.