[Bug]: Install Latest 3x-ui, Add new inbound and client, use VLESS+TLS+REALITY, cannot connect to server.

[naico-wang]

Describe the bug

I set up a new VPS and installed the latest version of 3x-ui (v3.4.2). I followed the usual steps to create an inbound and then added a new client to it, but I was unable to connect to the Xray server.

When configuring the client in Shadowrocket, the TCP connection shows a ping value, but once connected, there is no internet access.

After rolling back to v3.4.1 and repeating the same steps, everything works as expected.

It also appears that if the inbound and clients were already created before upgrading to v3.4.2, the upgrade has no impact. The issue only affects newly created inbounds and clients after updating to v3.4.2.

How to reproduce the problem

1. add new inbound with vless+reality
2. add new client
3. scan the qrcode using shadowrocket on my iPhone

Expected behavior

I can visit ping0.cc

Actual behavior

Can't access internet

Relevant logs

Jun 30 21:54:17 VM-IfR1zRAIbJ systemd[1]: Started x-ui.service - x-ui Service.
Jun 30 21:54:17 VM-IfR1zRAIbJ x-ui[43250]: 2026/06/30 21:54:17 Starting x-ui 3.4.2
Jun 30 21:54:17 VM-IfR1zRAIbJ /usr/local/x-ui/x-ui[43250]: INFO - GC percent set to 75
Jun 30 21:54:17 VM-IfR1zRAIbJ /usr/local/x-ui/x-ui[43250]: INFO - Go memory soft limit not enforced: no explicit budget; soft limit left at Go default
Jun 30 21:54:17 VM-IfR1zRAIbJ /usr/local/x-ui/x-ui[43250]: INFO - Web server running HTTP on [::]:8443
Jun 30 21:54:18 VM-IfR1zRAIbJ /usr/local/x-ui/x-ui[43250]: INFO - XRAY: infra/conf/serial: Reading config: &{Name:bin/config.json Format:json}
Jun 30 21:54:18 VM-IfR1zRAIbJ /usr/local/x-ui/x-ui[43250]: INFO - Sub server running HTTP on [::]:2096
Jun 30 21:54:18 VM-IfR1zRAIbJ /usr/local/x-ui/x-ui[43250]: WARNING - XRAY: core: Xray 26.6.27 started
Jun 30 21:54:28 VM-IfR1zRAIbJ /usr/local/x-ui/x-ui[43250]: INFO - xray core supports the online-stats API; using connection-based onlines and access-log-free IP limit
Jun 30 21:54:49 VM-IfR1zRAIbJ systemd[1]: Stopping x-ui.service - x-ui Service...
Jun 30 21:54:49 VM-IfR1zRAIbJ x-ui[43250]: 2026/06/30 21:54:49 Shutting down servers.
Jun 30 21:54:49 VM-IfR1zRAIbJ systemd[1]: x-ui.service: Deactivated successfully.
Jun 30 21:54:49 VM-IfR1zRAIbJ systemd[1]: Stopped x-ui.service - x-ui Service.
Jun 30 21:54:49 VM-IfR1zRAIbJ systemd[1]: Started x-ui.service - x-ui Service.
Jun 30 21:54:49 VM-IfR1zRAIbJ x-ui[43860]: 2026/06/30 21:54:49 Starting x-ui 3.4.2
Jun 30 21:54:49 VM-IfR1zRAIbJ /usr/local/x-ui/x-ui[43860]: INFO - GC percent set to 75
Jun 30 21:54:49 VM-IfR1zRAIbJ /usr/local/x-ui/x-ui[43860]: INFO - Go memory soft limit not enforced: no explicit budget; soft limit left at Go default
Jun 30 21:54:50 VM-IfR1zRAIbJ /usr/local/x-ui/x-ui[43860]: INFO - Web server running HTTP on [::]:8443
Jun 30 21:54:50 VM-IfR1zRAIbJ /usr/local/x-ui/x-ui[43860]: INFO - Sub server running HTTP on [::]:2096
Jun 30 21:54:50 VM-IfR1zRAIbJ /usr/local/x-ui/x-ui[43860]: INFO - XRAY: infra/conf/serial: Reading config: &{Name:bin/config.json Format:json}
Jun 30 21:54:50 VM-IfR1zRAIbJ /usr/local/x-ui/x-ui[43860]: WARNING - XRAY: core: Xray 26.6.27 started
Jun 30 21:55:00 VM-IfR1zRAIbJ /usr/local/x-ui/x-ui[43860]: INFO - xray core supports the online-stats API; using connection-based onlines and access-log-free IP limit
Jun 30 21:55:15 VM-IfR1zRAIbJ /usr/local/x-ui/x-ui[43860]: INFO - naico-wang logged in successfully, Ip Address: 192.220.25.102
Jun 30 21:55:15 VM-IfR1zRAIbJ /usr/local/x-ui/x-ui[43860]: INFO - naico-wang logged in successfully
Jun 30 21:55:35 VM-IfR1zRAIbJ /usr/local/x-ui/x-ui[43860]: INFO - Received SIGHUP signal. Restarting servers...
Jun 30 21:55:35 VM-IfR1zRAIbJ /usr/local/x-ui/x-ui[43860]: INFO - WebSocket hub stopped
Jun 30 21:55:35 VM-IfR1zRAIbJ /usr/local/x-ui/x-ui[43860]: INFO - Web server running HTTP on [::]:8443
Jun 30 21:55:35 VM-IfR1zRAIbJ x-ui[43860]: 2026/06/30 21:55:35 Web server restarted successfully.
Jun 30 21:55:35 VM-IfR1zRAIbJ /usr/local/x-ui/x-ui[43860]: INFO - Sub server running HTTP on [::]:2096
Jun 30 21:55:35 VM-IfR1zRAIbJ x-ui[43860]: 2026/06/30 21:55:35 Sub server restarted successfully.
Jun 30 21:56:03 VM-IfR1zRAIbJ /usr/local/x-ui/x-ui[43860]: INFO - Received SIGHUP signal. Restarting servers...
Jun 30 21:56:03 VM-IfR1zRAIbJ /usr/local/x-ui/x-ui[43860]: INFO - WebSocket hub stopped
Jun 30 21:56:03 VM-IfR1zRAIbJ /usr/local/x-ui/x-ui[43860]: INFO - Web server running HTTP on [::]:8443
Jun 30 21:56:03 VM-IfR1zRAIbJ x-ui[43860]: 2026/06/30 21:56:03 Web server restarted successfully.
Jun 30 21:56:03 VM-IfR1zRAIbJ x-ui[43860]: 2026/06/30 21:56:03 Sub server restarted successfully.
Jun 30 21:56:27 VM-IfR1zRAIbJ systemd[1]: Stopping x-ui.service - x-ui Service...
Jun 30 21:56:27 VM-IfR1zRAIbJ x-ui[43860]: 2026/06/30 21:56:27 Shutting down servers.
Jun 30 21:56:27 VM-IfR1zRAIbJ systemd[1]: x-ui.service: Deactivated successfully.
Jun 30 21:56:27 VM-IfR1zRAIbJ systemd[1]: Stopped x-ui.service - x-ui Service.
Jun 30 21:56:27 VM-IfR1zRAIbJ systemd[1]: x-ui.service: Consumed 1.407s CPU time.

Screenshots

No response

3x-ui version

3.4.2

Xray-core version

26.6.27

How did you install 3x-ui?

install.sh script

Operating system

Debian13 and Debian 13

Which parts of the panel are affected?

Other

Browser (only if it is a UI bug)

No response

Is the panel behind a reverse proxy or CDN?

No — direct access

Before submitting

• I searched existing issues and this bug has not been reported.
• I am running the latest released version of 3x-ui (or have verified the bug still exists on it).
• This bug report is written in English.
• I have redacted any sensitive data (tokens, real domains, client UUIDs).

[github-actions]

Thank you for the detailed report.

What the symptom indicates

"TCP ping shows but no internet traffic" with a REALITY inbound is the characteristic signature of a server-side UUID authentication failure. When Xray-core cannot match the connecting UUID to any configured client, it falls back to transparently proxying the client to the configured REALITY destination — the TLS handshake completes (hence a working ping), but no traffic is actually proxied through the panel's outbound.

What was audited in v3.4.2

Two commits that touch VLESS/client handling were examined against v3.4.1:

1. WireGuard multi-client migration (internal/database/db.go, internal/web/service/client_inbound_apply.go): all new WireGuard code paths are gated on oldInbound.Protocol == model.WireGuard; the VLESS branch of addInboundClient is structurally unchanged.

2. vlessRoute subscription link rewriting (internal/sub/vless_route.go, internal/sub/service.go): applyVlessRoute modifies UUID bytes 6–7 only when a Host entry carries a vlessRoute field. For a freshly created VLESS+REALITY inbound with no subscription Host entries configured, genVlessLink takes the direct path (fmt.Sprintf("vless://%s@%s", uuid, ...)) and the UUID is used verbatim.

No change that obviously produces a UUID mismatch for a brand-new VLESS+REALITY inbound was found in the diff. Additional diagnostic data is needed to confirm where the mismatch occurs.

Diagnostics needed

Please provide the following:

1. Xray access log output — In the panel, go to Settings → Xray Config, enable access logging ("access": "/path/to/access.log" under log), restart the Xray service, then attempt a connection from Shadowrocket. Paste the relevant lines from the log. A UUID-mismatch failure shows a line like rejected [email protected] email: <empty> rather than your client's configured email.

2. The exact VLESS link text — From the panel, copy the share link for the affected client (not a screenshot; the raw vless://... URI). This lets us confirm whether the UUID in the link matches the UUID stored in the Xray config at bin/config.json.

3. Contents of bin/config.json — The generated Xray config (located next to the x-ui binary) shows the exact "id" value Xray is expecting under the inbound's clients array.

4. Client creation path — Was the client created inline inside the Inbound form (the "Add Inbound" modal with a client row), or separately via the "Clients" page after the inbound already existed?

5. Panel version confirmation — Output of x-ui version or the version shown in the panel footer.

Once the access log output and link text are available, the exact failure point will be deterministic.

[naico-wang]

Closed as wrong configuration.