Set up mieru as a fallback proxy

mieru is an encrypted proxy that works differently from REALITY and Hysteria2, so it gives you another way in if a network blocks those. It needs no domain, certificate or decoy website. This guide sets up mita, its server program, as a backup for VLESS and REALITY. If the server is brand new, do the first ten minutes on a new VPS first.

1. Sync the clock

mieru uses the current time to build its encryption keys, so the server and your device must agree on the time to within 4 minutes. Our Debian 13 image does not keep the clock in sync by default.

$ sudo apt install -y systemd-timesyncd
$ timedatectl show -p NTPSynchronized --value

$ chronyc tracking

On Ubuntu and Debian the second command must print yes. RHEL-based systems usually run chrony already, and chronyc tracking should show Leap status : Normal. Keep the clock on your own device correct too.

2. Install mita

Each mieru release comes with packages and a checksum file. We tested v3.38.1; for a newer release, change the version number.

$ V=3.38.1
$ curl -LO https://github.com/enfein/mieru/releases/download/v$V/mita_${V}_amd64.deb
$ curl -LO https://github.com/enfein/mieru/releases/download/v$V/mita_${V}_amd64.deb.sha256.txt
$ sha256sum -c mita_${V}_amd64.deb.sha256.txt
$ sudo dpkg -i mita_${V}_amd64.deb

$ V=3.38.1
$ curl -LO https://github.com/enfein/mieru/releases/download/v$V/mita-$V-1.x86_64.rpm
$ curl -LO https://github.com/enfein/mieru/releases/download/v$V/mita-$V-1.x86_64.rpm.sha256.txt
$ sha256sum -c mita-$V-1.x86_64.rpm.sha256.txt
$ sudo rpm -Uvh --force mita-$V-1.x86_64.rpm

The checksum line must end in OK. On RHEL-based systems, --force also lets you reinstall the same version. The package creates a mita user and starts the service, which then waits for a config.

3. Write the server config

Create a password with openssl rand -hex 16, then save this as mita.json:

{
  "portBindings": [ { "port": 2027, "protocol": "TCP" } ],
  "users": [ { "name": "family", "password": "YOUR-PASSWORD" } ],
  "loggingLevel": "INFO",
  "mtu": 1400,
  "dns": { "dualStack": "PREFER_IPv4" }
}

The mieru docs recommend TCP and a port between 1025 and 65535. Load the config and start the proxy:

$ sudo mita apply config mita.json
$ sudo mita start
$ sudo mita status

The status should read RUNNING, and the proxy starts again by itself after a reboot.

If you change the config later, note that apply config only adds to what is saved and never removes anything. To remove a user or port, run sudo mita replace config mita.json, then sudo mita reload.

4. Open the port

$ sudo ufw allow 2027/tcp

$ sudo firewall-cmd --get-active-zones
$ zone=public
$ sudo firewall-cmd --permanent --zone="$zone" --add-port=2027/tcp
$ sudo firewall-cmd --reload

For firewalld, replace public with the zone the first command shows. If you use neither firewall, skip this step.

5. Connect a client

Windows, macOS and Linux

The official client, mieru, is on the same releases page. Save this as client.json, with your server's IP address:

{
  "profiles": [
    {
      "profileName": "d4",
      "user": { "name": "family", "password": "YOUR-PASSWORD" },
      "servers": [ { "ipAddress": "203.0.113.10", "portBindings": [ { "port": 2027, "protocol": "TCP" } ] } ]
    }
  ],
  "activeProfile": "d4",
  "rpcPort": 8964,
  "socks5Port": 1080,
  "loggingLevel": "INFO"
}

$ mieru apply config client.json
$ mieru start
$ mieru test

rpcPort is a local port the client uses to control itself; leave it as it is. mieru test should print Connected to. Then set your browser or app to use the SOCKS5 proxy at 127.0.0.1:1080. After a reboot, run mieru start again; the client does not start by itself.

Android

v2rayNG and sing-box cannot connect to mieru, so use ClashMetaForAndroid. Save this as a .yaml file on the phone:

mixed-port: 7890
mode: rule
proxies:
  - name: d4-mieru
    type: mieru
    server: 203.0.113.10
    port: 2027
    transport: TCP
    udp: true
    username: family
    password: YOUR-PASSWORD
    multiplexing: MULTIPLEXING_LOW
proxy-groups:
  - name: PROXY
    type: select
    proxies: [d4-mieru]
rules:
  - MATCH,PROXY

In the app:

1. Open Profile, tap +, then File.
2. Tap Browse Files, open the menu next to Configuration.yaml, choose Import and pick your file.
3. Save, select the profile, go back, tap the top card to start, and allow the VPN request.

Shadowrocket on iPhone says it supports mieru too, but we did not test it.

6. Troubleshooting

• Run sudo mita get metrics on the server. If FailedIterateDecrypt or FailedHintMatchDecrypt goes up each time you try to connect, the user name or password is wrong, or one of the clocks is more than 4 minutes off.
• Check that the client uses the same port and protocol as the server, and that the firewall allows them.
• If the client connects but pages do not load, the browser is probably not set to use the SOCKS5 proxy.

Quick reference

Where to go next

Keep mieru as a fallback for networks where REALITY and Hysteria2 stop working. Before you order, use the Looking Glass to test the route from your network to each location.