--- /dev/null
+++ b/docs/configuration/outbound/mysql.md
@@ -0,0 +1,65 @@
+// OMV
+
+### Structure
+
+```json
+{
+  "type": "mysql",
+  "tag": "mysql-out",
+
+  "server": "127.0.0.1",
+  "server_port": 3306,
+  "username": "root",
+  "password": "my_password",
+  "tls": {},
+  "multiplex": {},
+
+  ... // Dial Fields
+}
+```
+
+### Fields
+
+#### server
+
+==Required==
+
+The server address.
+
+#### server_port
+
+The server port.
+
+Default `3306`.
+
+#### username
+
+The MySQL username for authentication.
+
+Default `root`.
+
+#### password
+
+The MySQL password for authentication.
+
+#### tls
+
+TLS configuration, see [TLS](/configuration/shared/tls/#outbound).
+
+If not set or disabled, an insecure TLS config will be used (since TLS is required for the MySQL handshake tunnel).
+
+#### multiplex
+
+See [Multiplex](/configuration/shared/multiplex#outbound) for details.
+
+The `max_connections` option controls how many parallel smux sessions (each over a separate MySQL+TLS connection) are maintained. Streams are round-robin distributed across sessions.
+
+### Dial Fields
+
+See [Dial Fields](/configuration/shared/dial/) for details.
+
+### Description
+
+The MySQL outbound connects to a MySQL inbound server. It performs a MySQL client handshake (using [go-mysql](https://github.com/go-mysql-org/go-mysql)) to negotiate TLS, then establishes smux sessions over the encrypted connection.
+
+Each proxied connection opens a new smux stream with a 1-byte command header (`0x01` for TCP, `0x03` for UDP) followed by the destination address. UDP connections use UDP-over-TCP (UoT).