Setting up SSTP and NaiveProxy

SSTP server

SSTP requires a public hostname, TCP 443 or other available TCP port, TLS certificate, PPP authentication, and IPv4 configuration on the server. RouterOS, SoftEther and Windows RRAS style deployments are suitable if they provide a compatible SSTP service.

RouterOS style example

/ip pool
add name=your-pool ranges=10.20.30.10-10.20.30.200

/ppp profile
add name=sstp-profile \
    local-address=10.20.30.1 \
    remote-address=your-pool \
    dns-server=1.1.1.1,8.8.8.8 \
    use-encryption=yes

/ppp secret
add name=username password="strong-password" service=sstp profile=sstp-profile

/interface sstp-server server
set enabled=yes \
    port=443 \
    certificate=your-certificate-name \
    authentication=mschap2 \
    default-profile=sstp-profile

Connection link

sstp://username:strong-password@yourdomain.com:443?name=Office&cc=DE&label=Work

• If possible, use a valid public TLS certificate.
• Open the SSTP TCP port in the firewall.
• Create unique credentials for each user or device.
• Let the PPP server provide IP and DNS parameters if your scheme supports it.
• Use RADIUS or native server restrictions for expiration, accounting, and concurrent session limits.

SSTP diagnostic checklist

NaiveProxy with Caddy

A common NaiveProxy scheme uses Caddy with an assembly to which forward-proxy is added. The important part is authenticated HTTP CONNECT over TLS. The exact build of Caddy and plugin syntax may vary, so the deployment pattern shown below is not a guaranteed copy-paste.

yourdomain.com {
    tls admin@yourdomain.com

    route {
        forward_proxy {
            basic_auth username strong-password
            hide_ip
            hide_via
            probe_resistance
        }

        respond 204
    }
}

naive+https://username:strong-password@yourdomain.com:443?sni=yourdomain.com&name=Office&cc=DE&label=Work

This option is often chosen for the usual TLS completion at the proxy, automatic certificates and simple basic authentication.

NaiveProxy with sing-box

Another option is to run sing-box directly from Naive inbound. This is convenient when one binary must own both the proxy-listener and the routing logic.

{
  "log": { "level": "warn" },
  "inbounds": [
    {
      "type": "naive",
      "tag": "naive-in",
      "listen": "0.0.0.0",
      "listen_port": 443,
      "users": [
        { "username": "username", "password": "strong-password" }
      ],
      "tls": {
        "enabled": true,
        "server_name": "yourdomain.com",
        "certificate_path": "/etc/letsencrypt/live/yourdomain.com/fullchain.pem",
        "key_path": "/etc/letsencrypt/live/yourdomain.com/privkey.pem"
      }
    }
  ],
  "outbounds": [
    { "type": "direct", "tag": "direct" }
  ],
  "route": { "final": "direct" }
}

[Unit]
Description=sing-box naive proxy
After=network-online.target
Wants=network-online.target

[Service]
ExecStart=/usr/local/bin/sing-box run -c /etc/sing-box/config.json
Restart=on-failure
RestartSec=3
LimitNOFILE=1048576

[Install]
WantedBy=multi-user.target

UDP-over-TCP for NaiveProxy

NaiveProxy is mainly TCP oriented. If users need UDP-like traffic through a Naive profile, MONO VPN can route UDP streams to a separate Naive TCP listener. Add uot to the link and run a compatible listener on that port.

naive+https://username:strong-password@yourdomain.com:443?sni=yourdomain.com&uot=8443

{
  "log": { "level": "warn" },
  "inbounds": [
    {
      "type": "naive",
      "tag": "naive-uot-in",
      "listen": "0.0.0.0",
      "listen_port": 8443,
      "users": [
        { "username": "username", "password": "strong-password" }
      ],
      "tls": {
        "enabled": true,
        "server_name": "yourdomain.com",
        "certificate_path": "/etc/letsencrypt/live/yourdomain.com/fullchain.pem",
        "key_path": "/etc/letsencrypt/live/yourdomain.com/privkey.pem"
      }
    }
  ],
  "outbounds": [
    { "type": "direct", "tag": "direct" }
  ],
  "route": { "final": "direct" }
}

Open the UoT TCP port only when using this mode. If uot is absent, MONO VPN uses the regular NaiveProxy branch for TCP traffic and an additional listener is not needed.

Safety and Operation

• Do not publish real passwords, root credentials, or long-lived shared keys.
• Issue unique credentials to each user or device.
• Recall and rotate data when a user leaves, a link has leaked, or access has expired.
• Update Caddy, sing-box, RouterOS, SoftEther or your chosen VPN stack.
• Limit management ports by IP source and separate administration from VPN/proxy ports.

ufw allow 443/tcp
ufw allow 443/udp
ufw allow 8443/tcp

Open only ports that match your design. UDP 443 is optional and depends on the use of QUIC/HTTP3. TCP 8443 is only needed for the UDP-over-TCP example.