[Bug]:

[MaxShitikov]

Describe the bug

When creating a VLESS inbound with security: reality, clients cannot connect and the server logs show REALITY: processed invalid connection from <client IP>: failed to read client hello. However, if I change the inbound's security to none (keeping all other settings identical), the connection works immediately. The same client configuration works only when Reality is disabled.

How to reproduce the problem

1. Fresh 3x-ui installation (v3.2.8) on Ubuntu 22.04 / 24.04.
2. Xray-core version 26.6.1 (also tested with older versions).
3. Create a new VLESS inbound:
   • Port: 17625
   • Protocol: vless
   • Security: reality
   • Generate new key pair (publicKey: uBswDPCGA4joMeW4kbREVJwFvOhIYraUx2kyP7160Tc, privateKey: wEl2fJL9QwbdsKseUrs5mtq6JitCxStEMxcZ2IkhMEg)
   • Target: www.amd.com:443
   • serverNames: ["www.amd.com"]
   • shortIds: ["ea55","c1224a","2604bcf6a336","c7e9ab71","230bc53a5a","cdc23d02bf4d8a","18","d7b09df8dc5fbc78"]
   • fingerprint: chrome
   • flow: xtls-rprx-vision
4. Add a client with UUID 3993aaad-549e-465c-a01f-34f7e5f192ab and same flow.
5. Export the client config (vless:// link) and import into a Reality‑capable client (v2rayNG 1.8.5+, Nekobox 0.4.0+, Shadowrocket).
6. Attempt to connect – the client fails.
7. Check server logs: tail -f /var/log/x-ui/error.log shows repeated REALITY: processed invalid connection from <client IP>: failed to read client hello.
8. Change the inbound security from reality to none (keep everything else the same), regenerate client link, and the client connects immediately.

Expected behavior

The client should connect successfully with Reality enabled, just as it does when security is set to none. The handshake should complete without failed to read client hello.

Actual behavior

The client fails to connect. Server logs show failed to read client hello despite correct publicKey, shortId, SNI, and fingerprint. Disabling Reality restores connectivity.

Relevant logs

2026/06/05 16:28:38.041425 [Info] transport/internet/tcp: REALITY: processed invalid connection from 109.94.21.160:64950: failed to read client hello
2026/06/05 16:28:56.030605 [Info] transport/internet/tcp: REALITY: processed invalid connection from 109.94.21.160:64951: failed to read client hello
2026/06/05 16:29:17.074246 [Info] transport/internet/tcp: REALITY: processed invalid connection from 109.94.21.160:64979: failed to read client hello

Screenshots

No response

3x-ui version

3.2.8

Xray-core version

v26.6.1

How did you install 3x-ui?

install.sh script

Operating system

Ubuntu 24.04

Which parts of the panel are affected?

No response

Browser (only if it is a UI bug)

No response

Is the panel behind a reverse proxy or CDN?

None

Before submitting

• I searched existing issues and this bug has not been reported.
• I am running the latest released version of 3x-ui (or have verified the bug still exists on it).
• This bug report is written in English.
• I have redacted any sensitive data (tokens, real domains, client UUIDs).

[github-actions]

Thanks for the detailed report. I reviewed the relevant source code and have a few findings and diagnostics that should narrow this down.

---

What the error means

REALITY: processed invalid connection from <ip>: failed to read client hello

This is logged by xray-core (at Info level, in transport/internet/tcp) when it receives a TCP connection on the Reality port but the incoming bytes are not a valid TLS ClientHello. The three attempts (ports 64950, 64951, 64979) show the client is retrying — this is consistent with a Reality-capable client that keeps getting refused at the handshake stage.

---

Most likely cause: target site reachability

Reality works by relaying the TLS handshake to the target HTTPS site. When xray-core can't reach www.amd.com:443, it cannot complete the handshake and the connection is dropped before the ClientHello is fully processed.

Run this on your server:

curl -sv https://www.amd.com 2>&1 | head -30

If this times out or fails, that is the root cause. AMD's infrastructure is also known to use CDN / geo-routing that can make it an unreliable Reality target from some server regions.

Try switching the target to a well-tested alternative:

In the inbound editor → Security → REALITY, change the Target and update SNI to match:

Target	SNI
www.microsoft.com:443	www.microsoft.com
addons.mozilla.org:443	addons.mozilla.org
www.lovelive-anime.jp:443	www.lovelive-anime.jp

After saving, restart xray from the panel (or systemctl restart x-ui), regenerate the client link, and retry.

---

Verify the generated share link

The vless:// link must contain these Reality-specific query parameters (you can copy it from the panel's QR/share dialog and inspect it):

security=reality
pbk=<your public key>
fp=chrome
sni=www.amd.com
sid=<one of your short IDs>
flow=xtls-rprx-vision

If pbk is empty or missing, the client won't use Reality and will connect without it — which causes exactly this error on the server side.

I traced through the share-link generation code (sub/subService.go:applyShareRealityParams) and the config-to-xray pipeline (web/service/xray.go): for a freshly created inbound with v3.2.8, the public key is stored under realitySettings.settings.publicKey in the database and the code does extract it into the pbk parameter. However, if you imported or manually edited the inbound JSON, the structure may differ.

To see the exact config being sent to xray-core, use the panel API (requires a valid session or API key):

GET /panel/api/server/getConfigJson

In the response, find the inbound with port 17625 and confirm realitySettings contains privateKey, serverNames, shortIds, and target — and does not have a settings sub-object (the panel strips it before sending to xray).

---

Additional checks

• Make sure UDP 17625 is not being intercepted: ss -tlnp | grep 17625
• Confirm xray is actually running with the updated config after you saved the inbound: systemctl status x-ui
• Check if the client app supports the xtls-rprx-vision flow + Reality combination — v2rayNG ≥ 1.8.5 and Nekobox ≥ 0.4.0 both do

---

Could you share: (1) the result of curl -sv https://www.amd.com on the server, and (2) the vless:// link content with only the server IP/domain redacted? That will make it much easier to confirm the root cause.

[MaxShitikov]

root@ljayhbuerd:~# curl -v https://www.nvidia.com 2>&1 | head -30
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 0* Host www.nvidia.com:443 was resolved.

• IPv6: (none)
• IPv4: 95.100.107.72, 95.100.107.88
• Trying 95.100.107.72:443...
• ALPN: curl offers h2,http/1.1
  } [5 bytes data]
• TLSv1.3 (OUT), TLS handshake, Client hello (1):
  } [1569 bytes data]
• SSL Trust Anchors:
• CAfile: /etc/ssl/certs/ca-certificates.crt
• CApath: /etc/ssl/certs
  { [5 bytes data]
• TLSv1.3 (IN), TLS handshake, Server hello (2):
  { [122 bytes data]
• TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):
  { [1 bytes data]
• TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
  { [29 bytes data]
• TLSv1.3 (IN), TLS handshake, Certificate (11):
  { [4351 bytes data]
• TLSv1.3 (IN), TLS handshake, CERT verify (15):
  { [78 bytes data]
• TLSv1.3 (IN), TLS handshake, Finished (20):
  { [52 bytes data]
• TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
  } [1 bytes data]
• TLSv1.3 (OUT), TLS handshake, Finished (20):
  } [52 bytes data]
  root@ljayhbuerd:~#

{
"listen": "",
"port": 32239,
"protocol": "vless",
"tag": "in-32239-tcp",
"settings": {
"clients": [
{
"id": "ff403ea5-cf47-4e60-9142-950712bc0846",
"email": "test",
"flow": "xtls-rprx-vision",
"limitIp": 0,
"totalGB": 0,
"expiryTime": 0,
"enable": true,
"tgId": 0,
"subId": "ta6p256q6qfafn3t",
"comment": "",
"reset": 0,
"created_at": 1780826370811,
"updated_at": 1780826370000
}
],
"decryption": "none",
"encryption": "none",
"testseed": [
900,
500,
900,
256
]
},
"sniffing": {
"enabled": false
},
"streamSettings": {
"network": "tcp",
"tcpSettings": {
"acceptProxyProtocol": false,
"header": {
"type": "none"
}
},
"security": "reality",
"realitySettings": {
"show": false,
"xver": 0,
"target": "www.nvidia.com:443",
"serverNames": [
"www.nvidia.com"
],
"privateKey": "IFtYQg76sPJ7tyR1pKPT7YOkcRJsqqq3Mmsb3PAVxl8",
"minClientVer": "",
"maxClientVer": "",
"maxTimediff": 0,
"shortIds": [
"20b00e3c4414",
"3a",
"721f",
"ea5a04a2a470ad",
"7e802a",
"aa340c1ef6847550",
"ac6b6365",
"04cd0fd370"
],
"mldsa65Seed": "",
"settings": {
"publicKey": "TjFZMSG5Ke4VaTQ36kLxOuY7VrNnrksDGl-wxYLspEI",
"fingerprint": "chrome",
"serverName": "",
"spiderX": "/",
"mldsa65Verify": ""
}
}
}
}

root@ljayhbuerd:~# tail -f /var/log/x-ui/error.log
2026/06/07 10:01:10.002576 [Info] [3753240240] proxy/dokodemo: received request for 127.0.0.1:37672
2026/06/07 10:01:10.002587 [Info] [3753240240] app/dispatcher: taking detour [api] for [tcp:127.0.0.1:62789]
2026/06/07 10:01:14.358045 [Debug] app/observatory/burst: checking мск
2026/06/07 10:01:14.358307 [Info] app/dispatcher: taking platform initialized detour [мск] for [tcp:www.google.com:443]
2026/06/07 10:01:14.358323 [Info] transport/internet/tcp: dialing TCP to tcp:5.39.255.209:33185
2026/06/07 10:01:14.358326 [Debug] transport/internet: dialing to tcp:5.39.255.209:33185
2026/06/07 10:01:14.405794 [Info] proxy/vless/outbound: tunneling request to tcp:www.google.com:443 via 5.39.255.209:33185
2026/06/07 10:01:15.003288 [Debug] [351240648] proxy/dokodemo: processing connection from: 127.0.0.1:37678
2026/06/07 10:01:15.003312 [Info] [351240648] proxy/dokodemo: received request for 127.0.0.1:37678
2026/06/07 10:01:15.003317 [Info] [351240648] app/dispatcher: taking detour [api] for [tcp:127.0.0.1:62789]
2026/06/07 10:01:20.002369 [Debug] [2367175441] proxy/dokodemo: processing connection from: 127.0.0.1:41348
2026/06/07 10:01:20.002429 [Info] [2367175441] proxy/dokodemo: received request for 127.0.0.1:41348
2026/06/07 10:01:20.002438 [Info] [2367175441] app/dispatcher: taking detour [api] for [tcp:127.0.0.1:62789]
2026/06/07 10:01:25.004751 [Debug] [3015615984] proxy/dokodemo: processing connection from: 127.0.0.1:41354
2026/06/07 10:01:25.004809 [Info] [3015615984] proxy/dokodemo: received request for 127.0.0.1:41354
2026/06/07 10:01:25.004820 [Info] [3015615984] app/dispatcher: taking detour [api] for [tcp:127.0.0.1:62789]
2026/06/07 10:01:25.917396 [Debug] app/observatory/burst: checking мск
2026/06/07 10:01:25.917682 [Info] app/dispatcher: taking platform initialized detour [мск] for [tcp:www.google.com:443]
2026/06/07 10:01:25.917703 [Info] transport/internet/tcp: dialing TCP to tcp:5.39.255.209:33185
2026/06/07 10:01:25.917709 [Debug] transport/internet: dialing to tcp:5.39.255.209:33185
2026/06/07 10:01:25.963592 [Info] proxy/vless/outbound: tunneling request to tcp:www.google.com:443 via 5.39.255.209:33185
2026/06/07 10:01:29.937470 [Info] transport/internet/tcp: REALITY: processed invalid connection from 109.94.21.160:63272: handshake did not complete successfully
2026/06/07 10:01:29.938573 [Info] transport/internet/tcp: REALITY: processed invalid connection from 109.94.21.160:63273: handshake did not complete successfully
2026/06/07 10:01:29.947742 [Info] transport/internet/tcp: REALITY: processed invalid connection from 109.94.21.160:63275: handshake did not complete successfully
2026/06/07 10:01:30.004016 [Debug] [2636747601] proxy/dokodemo: processing connection from: 127.0.0.1:35140
2026/06/07 10:01:30.004063 [Info] [2636747601] proxy/dokodemo: received request for 127.0.0.1:35140
2026/06/07 10:01:30.004073 [Info] [2636747601] app/dispatcher: taking detour [api] for [tcp:127.0.0.1:62789]
2026/06/07 10:01:30.953813 [Info] transport/internet/tcp: REALITY: processed invalid connection from 109.94.21.160:63278: failed to read client hello
2026/06/07 10:01:30.955081 [Info] transport/internet/tcp: REALITY: processed invalid connection from 109.94.21.160:63271: failed to read client hello
2026/06/07 10:01:30.955683 [Info] transport/internet/tcp: REALITY: processed invalid connection from 109.94.21.160:63276: failed to read client hello
2026/06/07 10:01:30.956652 [Info] transport/internet/tcp: REALITY: processed invalid connection from 109.94.21.160:63277: failed to read client hello
2026/06/07 10:01:30.960500 [Info] transport/internet/tcp: REALITY: processed invalid connection from 109.94.21.160:63274: failed to read client hello
2026/06/07 10:01:31.521744 [Info] transport/internet/tcp: REALITY: processed invalid connection from 109.94.21.160:63281: failed to read client hello
2026/06/07 10:01:31.559109 [Debug] app/observatory/burst: checking ti1szq51ux
2026/06/07 10:01:31.559234 [Info] app/dispatcher: taking platform initialized detour [ti1szq51ux] for [tcp:www.google.com:443]
2026/06/07 10:01:31.559500 [Info] transport/internet/tcp: dialing TCP to tcp:193.124.203.171:44068
2026/06/07 10:01:31.559535 [Debug] transport/internet: dialing to tcp:193.124.203.171:44068
2026/06/07 10:01:31.649288 [Info] proxy/vless/outbound: tunneling request to tcp:www.google.com:443 via 193.124.203.171:44068
2026/06/07 10:01:31.649797 [Debug] proxy: XtlsFilterTls found tls client hello! 1506
2026/06/07 10:01:31.649865 [Debug] proxy: XtlsPadding 1506 95 0
2026/06/07 10:01:31.709335 [Debug] proxy: Xtls Unpadding new block, content 5178 padding 49 command 0
2026/06/07 10:01:31.709394 [Debug] proxy: XtlsFilterTls inconclusive server hello 1163 52
2026/06/07 10:01:31.709403 [Debug] proxy: XtlsFilterTls found tls 1.3! 2372 TLS_AES_128_GCM_SHA256
2026/06/07 10:01:31.710415 [Debug] proxy: XtlsPadding 64 1324 0
2026/06/07 10:01:31.710510 [Debug] proxy: XtlsPadding 713 649 2
2026/06/07 10:01:31.721719 [Info] transport/internet/tcp: REALITY: processed invalid connection from 109.94.21.160:63284: failed to read client hello
2026/06/07 10:01:31.726350 [Info] transport/internet/tcp: REALITY: processed invalid connection from 109.94.21.160:63285: failed to read client hello
2026/06/07 10:01:31.751592 [Debug] proxy: Xtls Unpadding new block, content 225 padding 768 command 2
2026/06/07 10:01:31.751643 [Debug] proxy: CopyRawConn (maybe) readv
2026/06/07 10:01:31.766272 [Info] transport/internet/tcp: REALITY: processed invalid connection from 109.94.21.160:63287: failed to read client hello
2026/06/07 10:01:32.489988 [Info] transport/internet/tcp: REALITY: processed invalid connection from 109.94.21.160:63290: failed to read client hello
2026/06/07 10:01:32.492534 [Info] transport/internet/tcp: REALITY: processed invalid connection from 109.94.21.160:63291: failed to read client hello
2026/06/07 10:01:35.004350 [Debug] [3851419560] proxy/dokodemo: processing connection from: 127.0.0.1:35152
2026/06/07 10:01:35.004392 [Info] [3851419560] proxy/dokodemo: received request for 127.0.0.1:35152
2026/06/07 10:01:35.004399 [Info] [3851419560] app/dispatcher: taking detour [api] for [tcp:127.0.0.1:62789]
2026/06/07 10:01:40.002912 [Debug] [684139900] proxy/dokodemo: processing connection from: 127.0.0.1:42772
2026/06/07 10:01:40.003123 [Info] [684139900] proxy/dokodemo: received request for 127.0.0.1:42772
2026/06/07 10:01:40.003148 [Info] [684139900] app/dispatcher: taking detour [api] for [tcp:127.0.0.1:62789]
2026/06/07 10:01:45.002239 [Debug] [286646472] proxy/dokodemo: processing connection from: 127.0.0.1:42774
2026/06/07 10:01:45.002364 [Info] [286646472] proxy/dokodemo: received request for 127.0.0.1:42774
2026/06/07 10:01:45.002388 [Info] [286646472] app/dispatcher: taking detour [api] for [tcp:127.0.0.1:62789]
2026/06/07 10:01:48.997103 [Info] transport/internet/tcp: REALITY: processed invalid connection from 109.94.21.160:63292: failed to read client hello
2026/06/07 10:01:49.045311 [Info] transport/internet/tcp: REALITY: processed invalid connection from 109.94.21.160:63295: failed to read client hello
2026/06/07 10:01:49.046293 [Info] transport/internet/tcp: REALITY: processed invalid connection from 109.94.21.160:63296: failed to read client hello
2026/06/07 10:01:49.046567 [Info] transport/internet/tcp: REALITY: processed invalid connection from 109.94.21.160:63294: failed to read client hello
2026/06/07 10:01:49.048985 [Info] transport/internet/tcp: REALITY: processed invalid connection from 109.94.21.160:63293: failed to read client hello
2026/06/07 10:01:49.452601 [Info] transport/internet/tcp: REALITY: processed invalid connection from 109.94.21.160:63297: failed to read client hello
2026/06/07 10:01:49.707436 [Info] transport/internet/tcp: REALITY: processed invalid connection from 109.94.21.160:63300: failed to read client hello
2026/06/07 10:01:49.709400 [Info] transport/internet/tcp: REALITY: processed invalid connection from 109.94.21.160:63299: failed to read client hello
2026/06/07 10:01:49.748351 [Info] transport/internet/tcp: REALITY: processed invalid connection from 109.94.21.160:63298: failed to read client hello
2026/06/07 10:01:50.002170 [Debug] [1131182060] proxy/dokodemo: processing connection from: 127.0.0.1:52662
2026/06/07 10:01:50.002212 [Info] [1131182060] proxy/dokodemo: received request for 127.0.0.1:52662
2026/06/07 10:01:50.002220 [Info] [1131182060] app/dispatcher: taking detour [api] for [tcp:127.0.0.1:62789]
2026/06/07 10:01:50.409538 [Info] transport/internet/tcp: REALITY: processed invalid connection from 109.94.21.160:63302: failed to read client hello
2026/06/07 10:01:50.417641 [Info] transport/internet/tcp: REALITY: processed invalid connection from 109.94.21.160:63301: failed to read client hello
2026/06/07 10:01:55.003074 [Debug] [3487759908] proxy/dokodemo: processing connection from: 127.0.0.1:52674
2026/06/07 10:01:55.003117 [Info] [3487759908] proxy/dokodemo: received request for 127.0.0.1:52674
2026/06/07 10:01:55.003127 [Info] [3487759908] app/dispatcher: taking detour [api] for [tcp:127.0.0.1:62789]

root@ljayhbuerd:~# ss -tlnp | grep 32239
iptables -L -n | grep 32239
LISTEN 0 4096 *:32239 : users:(("xray-linux-amd6",pid=26413,fd=7))

help pls

[MaxShitikov]

testvw6fsq2pb65cg4w4 | in-32239-tcp | 35.72 KB / ∞ -- | -- | --