Sing-box Setup Guide 2026: iOS, Android, Windows & Mac Full Config
Quick Summary: Sing-box is the most powerful open-source universal proxy platform, supporting VLESS, VMess, Trojan, Shadowsocks, Hysteria2, TUIC, and NaïveProxy on every major platform. This guide covers installation and configuration for iOS, Android, Windows, macOS, and Linux with VPN07 subscription.
What Is Sing-box? The Universal Proxy Platform
Sing-box is a next-generation, open-source proxy platform developed by the SagerNet team. Unlike traditional proxy clients that focus on a single operating system, sing-box is written in Go and runs natively on iOS, Android, Windows, macOS, Linux, and even routers. It's often described as the spiritual successor to Clash, but with significantly more protocol support and a cleaner architecture.
The core philosophy of sing-box is "one config, all platforms." You write a single JSON configuration file, and it behaves identically whether you're running it on your iPhone, your Windows gaming PC, or a Raspberry Pi in your closet. This makes sing-box particularly popular among technical users who want a consistent experience across all their devices.
Sing-box Strengths
- Supports 15+ proxy protocols including latest VLESS Reality and Hysteria2
- Available on iOS, Android, Windows, macOS, Linux
- Subscription URL support with auto-update
- Advanced traffic routing with rule-sets
- TUN mode for transparent proxy on all platforms
- Actively maintained, frequent protocol updates
Supported Protocols
Installing Sing-box on iOS (iPhone / iPad)
On iOS, sing-box is distributed through the App Store as a paid app. Like other proxy clients for iOS, it requires a non-China Apple ID since the app is not available in the mainland China App Store. The iOS version provides a full-featured graphical interface that makes configuration straightforward without touching JSON files directly.
Get a Non-China Apple ID
If you don't have one, create a US or Hong Kong Apple ID at appleid.apple.com. Set the region to United States during registration.
Download from App Store
Sign into App Store with your non-China Apple ID. Search "sing-box" and download the official app by SagerNet. The app costs around $3.99 as a one-time purchase.
Import VPN07 Subscription
Open sing-box → tap Profiles → tap + → select Remote. Paste your VPN07 subscription URL and tap Save. All nodes will be imported automatically.
Enable and Connect
Return to the Dashboard tab and toggle the main switch to ON. Accept the VPN configuration permission when iOS prompts you. Your connection is live when the VPN indicator appears in the status bar.
iOS Tip: Use Auto-Select Group
In the Profiles section, after importing VPN07 subscription, tap the profile to expand it. Look for the outbound group named "Auto" or "URLTest" — this group automatically pings all nodes and connects to the lowest-latency one. Enable it for always-on best performance without manual selection.
Installing Sing-box on Android
Android users have more installation flexibility with sing-box. You can get it from the Google Play Store, or download the APK directly from the official GitHub releases page. The Android version includes the same feature set as iOS with full TUN mode support for system-wide proxying.
Download Sing-box APK
Visit github.com/SagerNet/sing-box → Releases → download the latest ARM64 APK for your Android device. Alternatively, search "sing-box" on Google Play Store and install the official app.
Enable Unknown Sources (if using APK)
Go to Settings → Security → Install Unknown Apps. Grant permission to your file manager app, then open and install the downloaded sing-box APK.
Add Remote Profile
Open sing-box → tap the menu → Profiles → New Profile → Remote. Enter your VPN07 subscription URL. Set auto-update interval to 12 hours and tap Save.
Select Profile and Connect
Back on the main screen, tap your newly added profile to make it active (it will show a checkmark). Tap the large power button to start the VPN. Android will request VPN permission — tap OK to proceed.
Android: Enable Per-App Proxy
Sing-box on Android supports per-app routing. In Settings → Routes → Per-app proxy, you can specify which apps use the VPN and which connect directly. This is useful for banking apps or local services that shouldn't go through a proxy, while keeping browsers and messaging apps fully routed through VPN07.
Installing Sing-box on Windows
Windows users typically run sing-box in one of two ways: as a standalone command-line application, or via a GUI wrapper like Karing or Hiddify (which use sing-box as their core engine). For users who prefer a graphical interface, we recommend using the Karing GUI frontend for sing-box on Windows. For power users, direct CLI configuration gives you maximum control.
Option A: Sing-box CLI on Windows
# Download sing-box for Windows (PowerShell)
# Visit: github.com/SagerNet/sing-box/releases
# Download: sing-box-X.X.X-windows-amd64.zip
# Extract and run:
./sing-box.exe run -c config.json
After downloading, create a config.json file in the same directory with your VPN07 configuration (see the configuration section below). Run as Administrator for TUN mode support.
Option B: Use Karing GUI (Recommended for Beginners)
Karing is a user-friendly GUI frontend that uses sing-box as its proxy core. It supports direct subscription URL import and provides a familiar dashboard-style interface. Download Karing from github.com/KaringX/karing, then import your VPN07 subscription URL in the Connections → Subscriptions menu.
Download and Extract Sing-box
Get the latest Windows AMD64 build from GitHub releases. Extract to a folder like C:\sing-box\. No installation needed — it's a portable executable.
Create Configuration File
Create config.json in the same folder. Copy the VPN07-provided sing-box configuration template from your user dashboard, or use the JSON structure from the Configuration section of this guide.
Run as Administrator
Right-click sing-box.exe → Run as Administrator. For TUN mode (which routes ALL system traffic), admin privileges are required. A terminal window will open showing connection logs.
Installing Sing-box on macOS
macOS users can install sing-box via Homebrew (recommended for developers) or use the official macOS app from the App Store. Both approaches work well, but the App Store version provides the easiest setup experience with a native macOS menu bar interface.
Via Homebrew (CLI)
brew install sing-box
sing-box run -c config.json
Ideal for developers. Easy updates with brew upgrade sing-box. Can be run as a background service with brew services start sing-box.
Via App Store
Search "sing-box" in the Mac App Store. This version includes a native menu bar UI, subscription URL support, and automatic TUN mode configuration. Recommended for users who prefer a GUI.
Note: Requires macOS 12 Monterey or later. Grant full disk access in System Settings → Privacy & Security if requested.
Sing-box Configuration: JSON Structure Explained
Understanding sing-box's JSON configuration format is key to customizing it for your needs. The config is divided into several main sections. Here's the essential structure for connecting to VPN07:
{
"log": { "level": "info" },
"dns": {
"servers": [
{ "tag": "cloudflare", "address": "https://1.1.1.1/dns-query" },
{ "tag": "local", "address": "223.5.5.5", "detour": "direct" }
],
"rules": [
{ "outbound": "any", "server": "local" },
{ "rule_set": "geosite-cn", "server": "local" }
]
},
"inbounds": [
{
"type": "tun",
"inet4_address": "172.19.0.1/30",
"auto_route": true,
"strict_route": true
}
],
"outbounds": [
{
"type": "vless",
"tag": "vpn07-hk",
"server": "hk01.vpn07.com",
"server_port": 443,
"uuid": "YOUR-UUID-HERE",
"flow": "xtls-rprx-vision",
"tls": { "enabled": true, "server_name": "hk01.vpn07.com" }
},
{ "type": "direct", "tag": "direct" },
{ "type": "block", "tag": "block" }
],
"route": {
"rules": [
{ "rule_set": "geosite-cn", "outbound": "direct" },
{ "rule_set": "geoip-cn", "outbound": "direct" }
]
}
}
Use Subscription Import Instead of Manual Config
For most users, manually editing JSON is unnecessary. VPN07 provides a ready-to-use sing-box configuration file accessible from your user dashboard. You can also paste your subscription URL directly into the iOS or Android app — the app handles all JSON generation automatically.
| Config Section | Purpose | Key Options |
|---|---|---|
| log | Logging verbosity | info, warn, error, debug |
| dns | DNS resolution routing | DoH servers, rules for CN/global |
| inbounds | Traffic capture method | tun (system-wide), socks, http |
| outbounds | Proxy server definitions | vless, vmess, trojan, ss, hysteria2 |
| route | Traffic routing rules | geoip, geosite, rule-sets, direct/block |
Sing-box Protocol Comparison: Which to Use?
One of sing-box's biggest advantages is its support for multiple modern protocols. Not all protocols perform equally — here's a practical guide for choosing the right one with VPN07:
VLESS + Reality (Recommended)
BESTThe most advanced protocol available in 2026. Reality steals TLS fingerprints from real websites, making your traffic indistinguishable from normal HTTPS. Zero packet length patterns that deep inspection tools can identify. Best choice for users in high-censorship environments.
Hysteria2 (Fastest Raw Speed)
SPEEDBased on QUIC (UDP), Hysteria2 achieves extremely high throughput even on congested or lossy networks. Ideal for video streaming, large file downloads, and 4K content. However, UDP-based traffic is sometimes blocked in more restrictive environments.
Trojan (Reliable Fallback)
STABLETrojan disguises proxy traffic as TLS/HTTPS on port 443. It's been widely tested and is extremely reliable. Use Trojan when VLESS+Reality isn't available or when you need maximum compatibility with older sing-box configurations.
Traffic Routing Rules in Sing-box
Sing-box's routing engine is one of its most powerful features. Unlike simple proxy clients, sing-box can make intelligent routing decisions for every connection based on domain, IP address, application, or network type. Here's how to configure effective routing rules with VPN07:
Global Mode
All outbound traffic routed through VPN07. Simplest configuration — add only one outbound rule pointing everything to your VPN07 proxy. Best for maximum privacy.
Use for: Privacy-first setupsSplit Routing (Rule Mode)
Chinese sites (geosite-cn, geoip-cn) connect directly. Blocked international sites go through VPN07. Domestic apps stay fast while you access the global internet freely.
Use for: Daily use (recommended)Ad-block Integration
Add geosite-category-ads-all to a block outbound rule. Sing-box will silently drop connections to known advertising and tracking domains across all apps on your device.
Use for: Ad-free browsingPer-App Routing
On Android and iOS, specify package names or bundle IDs to route specific apps differently. Route your browser and social media through VPN07 while banking apps connect directly.
Use for: Fine-grained controlCommon Sing-box Problems and Fixes
Problem: Sing-box starts but no internet access
Cause: TUN mode requires administrator/root permissions to create a virtual network adapter. Without elevated permissions, sing-box can proxy local app traffic but can't intercept system-level DNS.
Fix: On Windows, right-click and "Run as Administrator." On macOS, approve the Network Extension in System Settings → Privacy & Security → Network Extensions. On Android, grant VPN permission when prompted.
Problem: Config file fails to parse (JSON error)
Cause: JSON syntax errors are easy to introduce when manually editing config files. Even a single misplaced comma or missing bracket will prevent sing-box from starting.
Fix: Paste your config into jsonlint.com to validate before running. Sing-box also prints the exact line number of syntax errors in the console output when it fails to start.
Problem: Connection works but very slow
Cause: You may be using a VMess TCP node when Hysteria2 or VLESS+Reality would be significantly faster on your network. Also check if you're on a shared congested node.
Fix: In the iOS/Android app, use the URL-test selector to auto-select the fastest VPN07 node. If you're manually editing config, try switching the outbound protocol from VMess to VLESS+Reality or Hysteria2 — VPN07 supports all three.
Problem: iOS shows "VPN Permission Denied"
Cause: A previously installed VPN or proxy app already has an active VPN configuration that conflicts with sing-box.
Fix: Go to iOS Settings → General → VPN & Device Management → VPN. Delete any existing VPN profiles. Then reopen sing-box and try connecting again. Only one VPN can be active at a time on iOS.
Why VPN07 Is the Best Server Backend for Sing-box
Sing-box is only as good as the server infrastructure behind it. The app is the engine, but VPN07 is the fuel. Here's why thousands of sing-box users trust VPN07 as their server provider:
VPN07 — #1 for Sing-box Users
- Full sing-box subscription URL provided — just paste and go
- Supports VLESS+Reality, Trojan, VMess, Hysteria2, Shadowsocks
- 1000Mbps bandwidth — no throttling on 4K streaming or large downloads
- 30-day money-back guarantee — zero risk to try
VPN07 — Best VPN for Sing-box
1000Mbps · 70+ Countries · Trusted Since 2015
VPN07 provides native sing-box subscription URLs with VLESS+Reality, Trojan, Hysteria2, and VMess protocols. Import one URL and instantly access all 70+ country nodes optimized for sing-box's routing engine. With 1000Mbps bandwidth and 10+ years of proven reliability, VPN07 is the ideal server partner for your sing-box setup on any platform.
Related Articles
Hiddify vs NekoBox 2026: Best Cross-Platform VPN Clients Compared
Compare Hiddify and NekoBox — two leading sing-box-based GUI clients. Which one offers the best experience on your platform?
Read More →Clash Verge Rev Full Tutorial 2026: Mihomo Profiles & Rules
Master Clash Verge Rev on Windows and macOS — the most popular Mihomo/Clash Meta GUI with advanced rule management.
Read More →