[Bug]: externalProxy breaks VLESS+TCP+Reality link generation (incorrect security types)

[NooNooJoo]

Describe the bug

When configuring a VLESS + TCP + Reality inbound, enabling the externalProxy feature completely corrupts the generated client subscription links, share links, and QR codes. The link generator either strips the Reality security protocols entirely or forces a wrong TLS handshake depending on the Force TLS option.

How to reproduce the problem

1. Create a standard inbound configuration: VLESS + TCP (Raw) + Reality on a custom port (for example, 20020).
2. Scroll down to the bottom of the inbound configuration window and enable the External Proxy toggle.
3. Put your public domain or server IP and the same custom port (20020) into the external proxy settings.
4. Try generating a link/QR code with different options in the Force TLS dropdown menu:
   • Select none: Notice that the generated link outputs security=none, stripping Reality.
   • Select tls: Notice that the generated link outputs security=tls, causing clients to fail the handshake.
   • Select same: The link says security=reality, but the connection drops due to core routing/network context bugs on custom ports.

Expected behavior

The link generator should be context-aware. If the parent inbound is configured with security: "reality", the externalProxy block must strictly preserve security=reality in the output URI, regardless of what option is chosen in the Force TLS dropdown (which seems to only comply with standard TLS/WS setups).

Actual behavior

Depending on the Force TLS option, the panel generates completely broken share links. It either forces security=none or security=tls (which makes client applications perform a generic TLS handshake instead of Reality, dropping the connection), or it outputs security=reality via the same option but the connection still instantly drops on client devices due to core routing misconfigurations on custom ports.

Relevant logs

2026/06/09 18:04:12 INFO - BSt7M4LYCl logged in successfully
2026/06/09 18:04:12 INFO - BSt7M4LYCl logged in successfully, Ip Address: 127.0.0.1

2026/06/09 17:32:02 INFO - Remove Inbound User main due to expiration or traffic limit
2026/06/09 17:32:02 INFO - Remove Inbound User main due to expiration or traffic limit
2026/06/09 17:32:02 INFO - Remove Inbound User main due to expiration or traffic limit
2026/06/09 17:32:02 INFO - Remove Inbound User main due to expiration or traffic limit
2026/06/09 17:32:02 INFO - Remove Inbound User main due to expiration or traffic limit
2026/06/09 17:32:02 INFO - Remove Inbound User main due to expiration or traffic limit
2026/06/09 17:27:02 INFO - Remove Inbound User main due to expiration or traffic limit
2026/06/09 17:27:02 INFO - Remove Inbound User main due to expiration or traffic limit
2026/06/09 17:27:02 INFO - Remove Inbound User main due to expiration or traffic limit
2026/06/09 17:27:02 INFO - Remove Inbound User main due to expiration or traffic limit
2026/06/09 17:27:02 INFO - Remove Inbound User main due to expiration or traffic limit
2026/06/09 17:27:02 INFO - Remove Inbound User main due to expiration or traffic limit
2026/06/09 17:24:32 INFO - Remove Inbound User main due to expiration or traffic limit
2026/06/09 17:24:32 INFO - Remove Inbound User main due to expiration or traffic limit
2026/06/09 17:24:32 INFO - Remove Inbound User main due to expiration or traffic limit
2026/06/09 17:24:32 INFO - Remove Inbound User main due to expiration or traffic limit
2026/06/09 17:24:32 INFO - Remove Inbound User main due to expiration or traffic limit
2026/06/09 17:24:32 INFO - Remove Inbound User main due to expiration or traffic limit
2026/06/09 17:21:32 INFO - Remove Inbound User main due to expiration or traffic limit
2026/06/09 17:21:32 INFO - Remove Inbound User main due to expiration or traffic limit
2026/06/09 17:21:32 INFO - Remove Inbound User main due to expiration or traffic limit
2026/06/09 17:21:32 INFO - Remove Inbound User main due to expiration or traffic limit
2026/06/09 17:21:32 INFO - Remove Inbound User main due to expiration or traffic limit
2026/06/09 17:21:32 INFO - Remove Inbound User main due to expiration or traffic limit
2026/06/09 17:10:04 WARNING - XRAY: core: Xray 26.6.1 started
2026/06/09 17:10:02 WARNING - XRAY: infra/conf: REALITY: Listening on non-443 ports may get your IP blocked by the GFW
2026/06/09 17:10:02 WARNING - XRAY: infra/conf: REALITY: Listening on non-443 ports may get your IP blocked by the GFW
2026/06/09 17:10:02 WARNING - XRAY: common/errors: The feature gRPC transport (with unnecessary costs, etc.) is deprecated, not recommended for using and might be removed. Please migrate to XHTTP stream-up H2 as soon as possible.
2026/06/09 17:10:02 WARNING - XRAY: infra/conf: REALITY: Listening on non-443 ports may get your IP blocked by the GFW
2026/06/09 17:10:02 WARNING - XRAY: common/errors: The feature gRPC transport (with unnecessary costs, etc.) is deprecated, not recommended for using and might be removed. Please migrate to XHTTP stream-up H2 as soon as possible.
2026/06/09 17:10:02 WARNING - XRAY: infra/conf: REALITY: Listening on non-443 ports may get your IP blocked by the GFW
2026/06/09 17:10:02 WARNING - XRAY: common/errors: The feature gRPC transport (with unnecessary costs, etc.) is deprecated, not recommended for using and might be removed. Please migrate to XHTTP stream-up H2 as soon as possible.
2026/06/09 17:10:02 WARNING - XRAY: infra/conf: REALITY: Listening on non-443 ports may get your IP blocked by the GFW
2026/06/09 17:10:02 WARNING - XRAY: common/errors: The feature gRPC transport (with unnecessary costs, etc.) is deprecated, not recommended for using and might be removed. Please migrate to XHTTP stream-up H2 as soon as possible.
2026/06/09 17:10:02 WARNING - XRAY: infra/conf: REALITY: Listening on non-443 ports may get your IP blocked by the GFW
2026/06/09 17:10:02 WARNING - XRAY: common/errors: The feature gRPC transport (with unnecessary costs, etc.) is deprecated, not recommended for using and might be removed. Please migrate to XHTTP stream-up H2 as soon as possible.
2026/06/09 17:10:02 INFO - XRAY: infra/conf/serial: Reading config: &{Name:bin/config.json Format:json}
2026/06/09 17:10:02 INFO - Remove Inbound User main due to expiration or traffic limit
2026/06/09 17:10:02 INFO - Remove Inbound User main due to expiration or traffic limit
2026/06/09 17:10:02 INFO - Remove Inbound User main due to expiration or traffic limit
2026/06/09 17:10:02 INFO - Remove Inbound User main due to expiration or traffic limit
2026/06/09 17:10:02 INFO - Remove Inbound User main due to expiration or traffic limit
2026/06/09 17:10:02 INFO - Remove Inbound User main due to expiration or traffic limit
2026/06/09 16:56:18 INFO - BSt7M4LYCl logged in successfully
2026/06/09 16:56:18 INFO - BSt7M4LYCl logged in successfully, Ip Address: 127.0.0.1

2026/06/09 16:56:04 WARNING - XRAY: core: Xray 26.6.1 started
2026/06/09 16:56:02 WARNING - XRAY: infra/conf: REALITY: Listening on non-443 ports may get your IP blocked by the GFW
2026/06/09 16:56:02 WARNING - XRAY: infra/conf: REALITY: Listening on non-443 ports may get your IP blocked by the GFW
2026/06/09 16:56:02 WARNING - XRAY: common/errors: The feature gRPC transport (with unnecessary costs, etc.) is deprecated, not recommended for using and might be removed. Please migrate to XHTTP stream-up H2 as soon as possible.
2026/06/09 16:56:02 WARNING - XRAY: infra/conf: REALITY: Listening on non-443 ports may get your IP blocked by the GFW
2026/06/09 16:56:02 WARNING - XRAY: common/errors: The feature gRPC transport (with unnecessary costs, etc.) is deprecated, not recommended for using and might be removed. Please migrate to XHTTP stream-up H2 as soon as possible.
2026/06/09 16:56:02 WARNING - XRAY: infra/conf: REALITY: Listening on non-443 ports may get your IP blocked by the GFW
2026/06/09 16:56:02 WARNING - XRAY: common/errors: The feature gRPC transport (with unnecessary costs, etc.) is deprecated, not recommended for using and might be removed. Please migrate to XHTTP stream-up H2 as soon as possible.
2026/06/09 16:56:02 WARNING - XRAY: infra/conf: REALITY: Listening on non-443 ports may get your IP blocked by the GFW
2026/06/09 16:56:02 WARNING - XRAY: common/errors: The feature gRPC transport (with unnecessary costs, etc.) is deprecated, not recommended for using and might be removed. Please migrate to XHTTP stream-up H2 as soon as possible.
2026/06/09 16:56:02 WARNING - XRAY: infra/conf: REALITY: Listening on non-443 ports may get your IP blocked by the GFW
2026/06/09 16:56:02 WARNING - XRAY: common/errors: The feature gRPC transport (with unnecessary costs, etc.) is deprecated, not recommended for using and might be removed. Please migrate to XHTTP stream-up H2 as soon as possible.
2026/06/09 16:56:02 INFO - XRAY: infra/conf/serial: Reading config: &{Name:bin/config.json Format:json}
2026/06/09 16:56:02 INFO - Remove Inbound User main due to expiration or traffic limit
2026/06/09 16:56:02 INFO - Remove Inbound User main due to expiration or traffic limit
2026/06/09 16:56:02 INFO - Remove Inbound User main due to expiration or traffic limit
2026/06/09 16:56:02 INFO - Remove Inbound User main due to expiration or traffic limit
2026/06/09 16:56:02 INFO - Remove Inbound User main due to expiration or traffic limit
2026/06/09 16:56:02 INFO - Remove Inbound User main due to expiration or traffic limit
2026/06/09 16:41:14 WARNING - XRAY: proxy/wireguard: Using kernel TUN.
2026/06/09 16:41:05 WARNING - XRAY: core: Xray 26.6.1 started
2026/06/09 16:41:03 WARNING - XRAY: infra/conf: REALITY: Listening on non-443 ports may get your IP blocked by the GFW
2026/06/09 16:41:03 WARNING - XRAY: infra/conf: REALITY: Listening on non-443 ports may get your IP blocked by the GFW
2026/06/09 16:41:03 WARNING - XRAY: common/errors: The feature gRPC transport (with unnecessary costs, etc.) is deprecated, not recommended for using and might be removed. Please migrate to XHTTP stream-up H2 as soon as possible.
2026/06/09 16:41:03 WARNING - XRAY: infra/conf: REALITY: Listening on non-443 ports may get your IP blocked by the GFW
2026/06/09 16:41:03 WARNING - XRAY: common/errors: The feature gRPC transport (with unnecessary costs, etc.) is deprecated, not recommended for using and might be removed. Please migrate to XHTTP stream-up H2 as soon as possible.
2026/06/09 16:41:03 WARNING - XRAY: infra/conf: REALITY: Listening on non-443 ports may get your IP blocked by the GFW
2026/06/09 16:41:03 WARNING - XRAY: common/errors: The feature gRPC transport (with unnecessary costs, etc.) is deprecated, not recommended for using and might be removed. Please migrate to XHTTP stream-up H2 as soon as possible.
2026/06/09 16:41:03 WARNING - XRAY: infra/conf: REALITY: Listening on non-443 ports may get your IP blocked by the GFW
2026/06/09 16:41:03 WARNING - XRAY: common/errors: The feature gRPC transport (with unnecessary costs, etc.) is deprecated, not recommended for using and might be removed. Please migrate to XHTTP stream-up H2 as soon as possible.
2026/06/09 16:41:03 WARNING - XRAY: infra/conf: REALITY: Listening on non-443 ports may get your IP blocked by the GFW
2026/06/09 16:41:03 WARNING - XRAY: common/errors: The feature gRPC transport (with unnecessary costs, etc.) is deprecated, not recommended for using and might be removed. Please migrate to XHTTP stream-up H2 as soon as possible.
2026/06/09 16:41:02 INFO - XRAY: infra/conf/serial: Reading config: &{Name:bin/config.json Format:json}
2026/06/09 16:41:02 INFO - Remove Inbound User main due to expiration or traffic limit
2026/06/09 16:41:02 INFO - Remove Inbound User main due to expiration or traffic limit
2026/06/09 16:41:02 INFO - Remove Inbound User main due to expiration or traffic limit
2026/06/09 16:41:02 INFO - Remove Inbound User main due to expiration or traffic limit
2026/06/09 16:41:02 INFO - Remove Inbound User main due to expiration or traffic limit
2026/06/09 16:41:02 INFO - Remove Inbound User main due to expiration or traffic limit
2026/06/09 16:40:01 ERROR - XRAY: transport/internet/websocket: failed to serve http for WebSocket > accept tcp [::]:20451: use of closed network connection
2026/06/09 16:25:40 WARNING - XRAY: proxy/wireguard: Using kernel TUN.
2026/06/09 16:25:34 WARNING - XRAY: core: Xray 26.6.1 started
2026/06/09 16:25:32 WARNING - XRAY: infra/conf: REALITY: Listening on non-443 ports may get your IP blocked by the GFW
2026/06/09 16:25:32 WARNING - XRAY: common/errors: The feature gRPC transport (with unnecessary costs, etc.) is deprecated, not recommended for using and might be removed. Please migrate to XHTTP stream-up H2 as soon as possible.
2026/06/09 16:25:32 WARNING - XRAY: infra/conf: REALITY: Listening on non-443 ports may get your IP blocked by the GFW
2026/06/09 16:25:32 WARNING - XRAY: common/errors: The feature gRPC transport (with unnecessary costs, etc.) is deprecated, not recommended for using and might be removed. Please migrate to XHTTP stream-up H2 as soon as possible.
2026/06/09 16:25:32 WARNING - XRAY: infra/conf: REALITY: Listening on non-443 ports may get your IP blocked by the GFW
2026/06/09 16:25:32 WARNING - XRAY: common/errors: The feature gRPC transport (with unnecessary costs, etc.) is deprecated, not recommended for using and might be removed. Please migrate to XHTTP stream-up H2 as soon as possible.
2026/06/09 16:25:32 WARNING - XRAY: infra/conf: REALITY: Listening on non-443 ports may get your IP blocked by the GFW
2026/06/09 16:25:32 WARNING - XRAY: common/errors: The feature gRPC transport (with unnecessary costs, etc.) is deprecated, not recommended for using and might be removed. Please migrate to XHTTP stream-up H2 as soon as possible.
2026/06/09 16:25:32 WARNING - XRAY: infra/conf: REALITY: Listening on non-443 ports may get your IP blocked by the GFW
2026/06/09 16:25:32 WARNING - XRAY: common/errors: The feature gRPC transport (with unnecessary costs, etc.) is deprecated, not recommended for using and might be removed. Please migrate to XHTTP stream-up H2 as soon as possible.
2026/06/09 16:25:32 INFO - XRAY: infra/conf/serial: Reading config: &{Name:bin/config.json Format:json}
2026/06/09 16:25:32 INFO - Remove Inbound User main due to expiration or traffic limit
2026/06/09 16:25:32 INFO - Remove Inbound User main due to expiration or traffic limit
2026/06/09 16:25:32 INFO - Remove Inbound User main due to expiration or traffic limit
2026/06/09 16:25:32 INFO - Remove Inbound User main due to expiration or traffic limit
2026/06/09 16:25:32 INFO - Remove Inbound User main due to expiration or traffic limit
2026/06/09 16:25:32 INFO - Remove Inbound User main due to expiration or traffic limit
2026/06/09 16:24:06 WARNING - XRAY: core: Xray 26.6.1 started
2026/06/09 16:24:04 WARNING - XRAY: infra/conf: REALITY: Listening on non-443 ports may get your IP blocked by the GFW
2026/06/09 16:24:04 WARNING - XRAY: common/errors: The feature gRPC transport (with unnecessary costs, etc.) is deprecated, not recommended for using and might be removed. Please migrate to XHTTP stream-up H2 as soon as possible.
2026/06/09 16:24:04 WARNING - XRAY: infra/conf: REALITY: Listening on non-443 ports may get your IP blocked by the GFW
2026/06/09 16:24:04 WARNING - XRAY: common/errors: The feature gRPC transport (with unnecessary costs, etc.) is deprecated, not recommended for using and might be removed. Please migrate to XHTTP stream-up H2 as soon as possible.
2026/06/09 16:24:04 WARNING - XRAY: infra/conf: REALITY: Listening on non-443 ports may get your IP blocked by the GFW
2026/06/09 16:24:04 WARNING - XRAY: common/errors: The feature gRPC transport (with unnecessary costs, etc.) is deprecated, not recommended for using and might be removed. Please migrate to XHTTP stream-up H2 as soon as possible.
2026/06/09 16:24:04 WARNING - XRAY: infra/conf: REALITY: Listening on non-443 ports may get your IP blocked by the GFW
2026/06/09 16:24:04 WARNING - XRAY: common/errors: The feature gRPC transport (with unnecessary costs, etc.) is deprecated, not recommended for using and might be removed. Please migrate to XHTTP stream-up H2 as soon as possible.
2026/06/09 16:24:03 INFO - XRAY: infra/conf/serial: Reading config: &{Name:bin/config.json Format:json}
2026/06/09 16:24:03 INFO - Remove Inbound User main due to expiration or traffic limit
2026/06/09 16:24:03 INFO - Remove Inbound User main due to expiration or traffic limit
2026/06/09 16:24:03 INFO - Remove Inbound User main due to expiration or traffic limit
2026/06/09 16:24:03 INFO - Remove Inbound User main due to expiration or traffic limit
2026/06/09 16:24:03 INFO - Remove Inbound User main due to expiration or traffic limit
2026/06/09 16:24:03 INFO - Remove Inbound User main due to expiration or traffic limit
2026/06/09 16:10:30 INFO - mtproto: started mtg for inbound 35 on 0.0.0.0:20000
2026/06/09 16:10:30 INFO - mtproto: stopped mtg for inbound 35
2026/06/09 16:07:38 INFO - mtproto: started mtg for inbound 35 on 0.0.0.0:42217
2026/06/09 15:56:08 INFO - BSt7M4LYCl logged in successfully
2026/06/09 15:56:08 INFO - BSt7M4LYCl logged in successfully, Ip Address: 127.0.0.1

2026/06/09 15:14:33 INFO - Sub server running HTTPS on[::]:58572
2026/06/09 15:14:33 INFO - Telegram bot receiver started
2026/06/09 15:14:32 INFO - Tg notify enabled,run at @daily
2026/06/09 15:14:32 INFO - custom geo startup: no custom geofiles configured
2026/06/09 15:14:32 INFO - Web server running HTTPS on[::]:52699
2026/06/09 15:14:32 INFO - WebSocket hub stopped
2026/06/09 15:14:32 INFO - Stop Telegram receiver ...
2026/06/09 15:14:32 INFO - Telegram bot successfully stopped.
2026/06/09 15:14:32 INFO - Sending cancellation signal to Telegram bot...
2026/06/09 15:14:32 INFO - Received SIGHUP signal. Restarting servers...
2026/06/09 15:12:51 WARNING - XRAY: proxy/wireguard: Using kernel TUN.
2026/06/09 15:12:39 WARNING - XRAY: core: Xray 26.6.1 started
2026/06/09 15:12:37 WARNING - XRAY: infra/conf: REALITY: Listening on non-443 ports may get your IP blocked by the GFW
2026/06/09 15:12:37 WARNING - XRAY: common/errors: The feature gRPC transport (with unnecessary costs, etc.) is deprecated, not recommended for using and might be removed. Please migrate to XHTTP stream-up H2 as soon as possible.
2026/06/09 15:12:37 WARNING - XRAY: infra/conf: REALITY: Listening on non-443 ports may get your IP blocked by the GFW
2026/06/09 15:12:37 WARNING - XRAY: common/errors: The feature gRPC transport (with unnecessary costs, etc.) is deprecated, not recommended for using and might be removed. Please migrate to XHTTP stream-up H2 as soon as possible.
2026/06/09 15:12:37 WARNING - XRAY: infra/conf: REALITY: Listening on non-443 ports may get your IP blocked by the GFW
2026/06/09 15:12:37 WARNING - XRAY: common/errors: The feature gRPC transport (with unnecessary costs, etc.) is deprecated, not recommended for using and might be removed. Please migrate to XHTTP stream-up H2 as soon as possible.
2026/06/09 15:12:37 WARNING - XRAY: infra/conf: REALITY: Listening on non-443 ports may get your IP blocked by the GFW
2026/06/09 15:12:37 WARNING - XRAY: common/errors: The feature gRPC transport (with unnecessary costs, etc.) is deprecated, not recommended for using and might be removed. Please migrate to XHTTP stream-up H2 as soon as possible.
2026/06/09 15:12:37 INFO - XRAY: infra/conf/serial: Reading config: &{Name:bin/config.json Format:json}
2026/06/09 15:12:37 INFO - Remove Inbound User main due to expiration or traffic limit
2026/06/09 15:12:37 INFO - Remove Inbound User main due to expiration or traffic limit
2026/06/09 15:12:37 INFO - Remove Inbound User main due to expiration or traffic limit
2026/06/09 15:12:37 INFO - Remove Inbound User main due to expiration or traffic limit
2026/06/09 15:12:37 INFO - Remove Inbound User main due to expiration or traffic limit
2026/06/09 15:09:55 ERROR - XRAY: transport/internet/websocket: failed to serve http for WebSocket > accept tcp [::]:23279: use of closed network connection
2026/06/09 15:08:40 ERROR - XRAY: transport/internet/websocket: failed to serve http for WebSocket > accept tcp [::]:28716: use of closed network connection
2026/06/09 15:04:35 ERROR - XRAY: transport/internet/websocket: failed to serve http for WebSocket > accept tcp [::]:54540: use of closed network connection
2026/06/09 15:03:49 ERROR - XRAY: transport/internet/websocket: failed to serve http for WebSocket > accept tcp [::]:20817: use of closed network connection
2026/06/09 15:02:48 ERROR - XRAY: transport/internet/splithttp: failed to serve HTTP for XHTTP > accept tcp [::]:27826: use of closed network connection
2026/06/09 15:00:05 WARNING - XRAY: transport/internet/tls: ignoring invalid OCSP > common/ocsp: no OCSP server specified in cert
2026/06/09 15:00:05 WARNING - XRAY: transport/internet/tls: ignoring invalid OCSP > common/ocsp: no OCSP server specified in cert
2026/06/09 15:00:05 ERROR - XRAY: transport/internet/splithttp: failed to serve HTTP for XHTTP > accept tcp [::]:27826: use of closed network connection
2026/06/09 14:59:38 WARNING - XRAY: transport/internet/tls: ignoring invalid OCSP > common/ocsp: no OCSP server specified in cert
2026/06/09 14:59:38 WARNING - XRAY: transport/internet/tls: ignoring invalid OCSP > common/ocsp: no OCSP server specified in cert
2026/06/09 14:59:38 ERROR - XRAY: transport/internet/splithttp: failed to serve HTTP for XHTTP > accept tcp [::]:27826: use of closed network connection
2026/06/09 14:59:01 WARNING - XRAY: transport/internet/tls: ignoring invalid OCSP > common/ocsp: no OCSP server specified in cert
2026/06/09 14:59:01 WARNING - XRAY: transport/internet/tls: ignoring invalid OCSP > common/ocsp: no OCSP server specified in cert
2026/06/09 14:59:01 ERROR - XRAY: transport/internet/splithttp: failed to serve HTTP for XHTTP > accept tcp [::]:27826: use of closed network connection
2026/06/09 14:58:13 WARNING - XRAY: transport/internet/tls: ignoring invalid OCSP > common/ocsp: no OCSP server specified in cert
2026/06/09 14:58:13 WARNING - XRAY: transport/internet/tls: ignoring invalid OCSP > common/ocsp: no OCSP server specified in cert
2026/06/09 14:53:07 INFO - Sub server running HTTPS on[::]:58572
2026/06/09 14:53:07 INFO - Telegram bot receiver started
2026/06/09 14:53:07 INFO - Tg notify enabled,run at @daily
2026/06/09 14:53:07 INFO - custom geo startup: no custom geofiles configured
2026/06/09 14:53:07 INFO - Web server running HTTPS on[::]:52699
2026/06/09 14:53:06 INFO - WebSocket hub stopped
2026/06/09 14:53:06 INFO - Stop Telegram receiver ...
2026/06/09 14:53:06 INFO - Telegram bot successfully stopped.
2026/06/09 14:53:06 INFO - Sending cancellation signal to Telegram bot...
2026/06/09 14:53:06 INFO - Received SIGHUP signal. Restarting servers...
2026/06/09 14:32:09 WARNING - XRAY: proxy/wireguard: Using kernel TUN.
2026/06/09 14:32:08 WARNING - XRAY: core: Xray 26.6.1 started
2026/06/09 14:32:06 WARNING - XRAY: infra/conf: ====== SECURITY WARNING ======
2026/06/09 14:32:06 WARNING - XRAY: common/errors: The feature WebSocket transport (with ALPN http/1.1, etc.) is deprecated, not recommended for using and might be removed. Please migrate to XHTTP H2 & H3 as soon as possible.
2026/06/09 14:32:06 WARNING - XRAY: infra/conf: ====== SECURITY WARNING ======
2026/06/09 14:32:06 WARNING - XRAY: common/errors: The feature WebSocket transport (with ALPN http/1.1, etc.) is deprecated, not recommended for using and might be removed. Please migrate to XHTTP H2 & H3 as soon as possible.
2026/06/09 14:32:06 WARNING - XRAY: infra/conf: ====== SECURITY WARNING ======
2026/06/09 14:32:06 WARNING - XRAY: common/errors: The feature WebSocket transport (with ALPN http/1.1, etc.) is deprecated, not recommended for using and might be removed. Please migrate to XHTTP H2 & H3 as soon as possible.
2026/06/09 14:32:06 WARNING - XRAY: infra/conf: ====== SECURITY WARNING ======
2026/06/09 14:32:06 WARNING - XRAY: common/errors: The feature WebSocket transport (with ALPN http/1.1, etc.) is deprecated, not recommended for using and might be removed. Please migrate to XHTTP H2 & H3 as soon as possible.
2026/06/09 14:32:06 INFO - XRAY: infra/conf/serial: Reading config: &{Name:bin/config.json Format:json}
2026/06/09 14:32:06 INFO - Remove Inbound User main due to expiration or traffic limit
2026/06/09 14:32:06 INFO - Remove Inbound User main due to expiration or traffic limit
2026/06/09 14:32:06 INFO - Remove Inbound User main due to expiration or traffic limit
2026/06/09 14:32:06 INFO - Remove Inbound User main due to expiration or traffic limit
2026/06/09 14:32:06 INFO - Remove Inbound User main due to expiration or traffic limit
2026/06/09 14:32:06 WARNING - XRAY: infra/conf: ====== SECURITY WARNING ======
2026/06/09 14:32:06 WARNING - XRAY: common/errors: The feature WebSocket transport (with ALPN http/1.1, etc.) is deprecated, not recommended for using and might be removed. Please migrate to XHTTP H2 & H3 as soon as possible.

Screenshots

No response

3x-ui version

3.3.0

Xray-core version

26.6.1

How did you install 3x-ui?

install.sh script

Operating system

Ubuntu 24.04.5 LTS

Which parts of the panel are affected?

Subscription (share links / Clash / JSON)

Browser (only if it is a UI bug)

No response

Is the panel behind a reverse proxy or CDN?

Yes — Nginx

Before submitting

• I searched existing issues and this bug has not been reported.
• I am running the latest released version of 3x-ui (or have verified the bug still exists on it).
• This bug report is written in English.
• I have redacted any sensitive data (tokens, real domains, client UUIDs).

[github-actions]

Thanks for the detailed report. After tracing this through the source, the link generation behavior you're seeing is actually by design — here's what the code does and what to use for VLESS+Reality+externalProxy.

---

How Force TLS works in externalProxy

The forceTls field on each external proxy entry is a security override for the generated client link. The logic is identical in the share-link generator (frontend/src/lib/xray/inbound-link.ts), the backend subscription service (sub/subService.go:buildExternalProxyURLLinks), and the Clash/JSON config builders:

Force TLS value	Security in generated link	Effect on Reality
same	inherits inbound's actual security	Reality is preserved → security=reality with all pbk/fp/sni/sid/spx params
tls	forced to TLS	Reality is replaced by TLS; realitySettings is deleted in Clash/JSON configs
none	forced to none	Reality is stripped; realitySettings deleted in Clash/JSON configs

This is intentional: tls and none exist for CDN / reverse-proxy front-end scenarios where the external endpoint terminates a different security layer and then forwards traffic to your Reality origin internally.

---

For VLESS + TCP + Reality: use same

forceTls: same on your external proxy entry is the correct choice. When selected, the panel generates a fully valid Reality share link with all required parameters:

vless://<uuid>@<ep.dest>:<ep.port>?type=tcp&encryption=none&security=reality&pbk=...&fp=...&sni=...&sid=...&spx=...&flow=...#remark

This is confirmed in genVlessLink (lines 373-390 of inbound-link.ts) — when security === 'reality', the code sets security=reality and fills in all Reality-specific params from stream.realitySettings.

---

On the connection drop with same on a custom port

The logs show a repeated Xray-core warning:

REALITY: Listening on non-443 ports may get your IP blocked by the GFW

Reality is designed primarily around port 443 to mimic TLS traffic to a legitimate site. When it runs on a non-standard port (like 20020 in your case), the GFW or network firewalls may actively block or drop the handshake. This is an Xray-core limitation, not a panel link-generation bug. See the xray-core documentation for Reality port recommendations.

---

Summary

• Link generation for VLESS+Reality+externalProxy is working correctly.
• Use Force TLS: same to preserve Reality security in the generated link.
• tls and none intentionally override security — they're not meant for Reality-only inbounds.
• The connection drop on non-443 is an Xray-core / network-level issue unrelated to the panel.

If you believe there is still an actual bug after trying forceTls: same on port 443, please re-open with a share link (with sensitive values redacted) showing the incorrect output, and we can investigate further.

[MHSanaei]

This is by design rather than a bug. The externalProxy "Force TLS" field has three modes: use "same" to keep the inbound''s own security (Reality/TLS) in the generated link; "tls" and "none" are for CDN/reverse-proxy scenarios where the edge terminates TLS. Set Force TLS to "same" and the VLESS+TCP+Reality link is generated with the correct security type. Please reopen with a redacted link if you still see incorrect output with Force TLS = same.