{
"api": {
"services": [
"HandlerService",
"LoggerService",
"StatsService"
],
"tag": "api"
},
"burstObservatory": {
"pingConfig": {
"connectivity": "http://connectivitycheck.platform.hicloud.com/generate_204",
"destination": "https://www.google.com/generate_204",
"interval": "30m",
"sampling": 2,
"timeout": "10s"
},
"subjectSelector": [
"cf_xhttp"
]
},
"dns": null,
"fakedns": null,
"inbounds": [
{
"listen": "127.0.0.1",
"port": 62789,
"protocol": "tunnel",
"settings": {
"address": "127.0.0.1"
},
"sniffing": null,
"streamSettings": null,
"tag": "api"
},
{
"listen": "0.0.0.0",
"port": 8443,
"protocol": "vless",
"settings": {
"clients": [
{
"email": "$Remark",
"flow": "",
"id": "$INBOUND_ID"
}
],
"decryption": "$IN_DEC",
"encryption": "$IN_ENC",
"selectedAuth": "X25519, not Post-Quantum"
},
"sniffing": {
"destOverride": [
"http",
"tls",
"quic",
"fakedns"
],
"enabled": false,
"metadataOnly": false,
"routeOnly": false
},
"streamSettings": {
"network": "xhttp",
"security": "tls",
"sockopt": {
"V6Only": false,
"acceptProxyProtocol": false,
"dialerProxy": "cf_xhttp",
"domainStrategy": "UseIP",
"interface": "",
"mark": 0,
"penetrate": false,
"tcpFastOpen": true,
"tcpKeepAliveIdle": 300,
"tcpKeepAliveInterval": 0,
"tcpMaxSeg": 1440,
"tcpMptcp": true,
"tcpUserTimeout": 10000,
"tcpWindowClamp": 600,
"tcpcongestion": "bbr",
"tproxy": "off"
},
"tlsSettings": {
"alpn": [
"h3",
"h2",
"http/1.1"
],
"certificates": [
{
"buildChain": false,
"certificateFile": "/root/cert/sometestdomain.com/fullchain.pem",
"keyFile": "/root/cert/sometestdomain.com/privkey.pem",
"oneTimeLoading": false,
"usage": "encipherment"
}
],
"cipherSuites": "",
"disableSystemRoot": false,
"echForceQuery": "none",
"echServerKeys": "",
"enableSessionResumption": true,
"maxVersion": "1.3",
"minVersion": "1.2",
"rejectUnknownSni": false,
"serverName": "$SNI"
},
"xhttpSettings": {
"headers": {},
"host": "$SNI",
"mode": "auto",
"noSSEHeader": false,
"path": "/",
"scMaxBufferedPosts": 30,
"scMaxEachPostBytes": "1000000",
"scStreamUpServerSecs": "20-80",
"seqKey": "",
"seqPlacement": "",
"sessionKey": "",
"sessionPlacement": "",
"uplinkChunkSize": 0,
"uplinkDataKey": "",
"uplinkDataPlacement": "",
"uplinkHTTPMethod": "",
"xPaddingBytes": "100-1000",
"xPaddingHeader": "",
"xPaddingKey": "",
"xPaddingMethod": "",
"xPaddingObfsMode": false,
"xPaddingPlacement": ""
}
},
"tag": "inbound-8443"
}
],
"log": {
"access": "./access.log",
"dnsLog": false,
"error": "./error.log",
"loglevel": "warning",
"maskAddress": ""
},
"metrics": {
"listen": "127.0.0.1:11111",
"tag": "metrics_out"
},
"observatory": null,
"outbounds": [
{
"protocol": "freedom",
"settings": {
"domainStrategy": "AsIs",
"noises": [],
"redirect": ""
},
"tag": "direct"
},
{
"protocol": "blackhole",
"settings": {},
"tag": "blocked"
},
{
"protocol": "wireguard",
"settings": {
"address": [
"$WG_PRIV_IP/32"
],
"domainStrategy": "ForceIP",
"mtu": 1000,
"noKernelTun": false,
"peers": [
{
"allowedIPs": [
"0.0.0.0/0",
"::/0"
],
"endpoint": "$WG_ENDPOINT",
"keepAlive": 5,
"preSharedKey": "$PSK",
"publicKey": "$WG_PUBKEY"
}
],
"secretKey": "$WG_PRIVKEY",
"workers": 2
},
"streamSettings": {
"sockopt": {
"addressPortStrategy": "none",
"dialerProxy": "",
"penetrate": true,
"tcpFastOpen": true,
"tcpKeepAliveInterval": 0,
"tcpMptcp": true
}
},
"tag": "WG"
},
{
"protocol": "freedom",
"settings": {
"fragment": {
"interval": "1-3",
"length": "10-15",
"maxSplit": "",
"packets": "tlshello"
},
"noises": [
{
"applyTo": "ip",
"delay": "10-16",
"packet": "10-20",
"type": "rand"
}
]
},
"streamSettings": {
"sockopt": {
"addressPortStrategy": "none",
"dialerProxy": "WG",
"penetrate": false,
"tcpFastOpen": false,
"tcpKeepAliveInterval": 0,
"tcpMptcp": false
}
},
"tag": "UP_Fragment"
},
{
"protocol": "vless",
"settings": {
"address": "$CF_IP",
"encryption": "none",
"flow": "",
"id": "$CF_UUID",
"port": 8443
},
"streamSettings": {
"network": "xhttp",
"security": "tls",
"sockopt": {
"addressPortStrategy": "none",
"dialerProxy": "UP_Fragment",
"penetrate": false,
"tcpFastOpen": true,
"tcpKeepAliveInterval": 0,
"tcpMptcp": true
},
"tlsSettings": {
"alpn": [
"h3",
"h2",
"http/1.1"
],
"echConfigList": "",
"fingerprint": "firefox",
"pinnedPeerCertSha256": "",
"serverName": "$UP_SNI",
"verifyPeerCertByName": ""
},
"xhttpSettings": {
"host": "$UP_SNI",
"mode": "stream-one",
"noGRPCHeader": false,
"path": "/",
"scMinPostsIntervalMs": "30",
"xmux": {
"cMaxReuseTimes": 0,
"hKeepAlivePeriod": 0,
"hMaxRequestTimes": "600-900",
"hMaxReusableSecs": "1800-3000",
"maxConcurrency": "16-32",
"maxConnections": 0
}
}
},
"tag": "cf_xhttp"
}
],
"policy": {
"levels": {
"0": {
"statsUserDownlink": true,
"statsUserUplink": true
}
},
"system": {
"statsInboundDownlink": true,
"statsInboundUplink": true,
"statsOutboundDownlink": true,
"statsOutboundUplink": true
}
},
"reverse": null,
"routing": {
"domainStrategy": "AsIs",
"rules": [
{
"inboundTag": [
"api"
],
"outboundTag": "api",
"type": "field"
},
{
"ip": [
"geoip:private",
"ext:geoip_IR.dat:ir"
],
"outboundTag": "blocked",
"type": "field"
},
{
"domain": [
"ext:geosite_IR.dat:category-ads-all",
"ext:geosite_RU.dat:category-ads-all",
"ext:geosite_IR.dat:malware",
"ext:geosite_IR.dat:phishing",
"ext:geosite_IR.dat:cryptominers",
"ext:geosite_IR.dat:ir",
"regexp:.*\\.ir$",
"regexp:.*\\.xn--mgba3a4f16a$"
],
"outboundTag": "blocked",
"type": "field"
},
{
"outboundTag": "blocked",
"protocol": [
"bittorrent"
],
"type": "field"
},
{
"inboundTag": [
"inbound-8443"
],
"outboundTag": "cf_xhttp",
"type": "field"
}
]
},
"stats": {},
"transport": null
}
Integrity requirements
Description
Hi.
First of all thanks for all the great people who contribute to this project.
I want to report a bug. The last new versions of Xray Core (v26.4.15 & v26.4.17) have some sort of (maybe routing?) problem.
This is my setup:
Client ----> (Middle Server)Inbound8443 (VLESS_XHTTP_TLS) ----> (MainServer)CloudFlare (VLESS_XHTTP_TLS) ----> Fragment ----> WireGuard (Main Uplink to Free Internet)
So in order to connect to my MainServer which is behind CF, I first need to connect to a WG connection.
It is a chain proxy. CF's dialer is Fragment and Fragment's dialer is the WG connection.
Everything worked fine until Xray Core v26.4.13. But these last versions have a problem in which I get EOF. But when I skip CF and consecutively the Fragment, and select WG as my OutboundTag it WORKS FINE. But I need to make it go through CF to keep my IP and keep anonymity. As I said everything works fine in v26.4.13 and my connection goes through (CF-->Fragment-->WG) but when I upgrade the core, it starts giving me EOF errors. Checking the access.log shows nothing abnormal; I'm able to connect to my middle server and it shows it is being routed through my CF outbound. I doubled checked not to route my traffic through "blackhole". Interesting thing is it works for a 2-3 seconds when I restart the core and again it keeps giving me EOF.
So this leads to conclusion that something has changed since v26.4.13 that keeps terminating the connection.
I'd be grateful if you could analyze it.
PS:
I was looking at the commit after v26.4.13; Can it be because of this feature??? (Direct/Freedom outbound: Add ipsBlocked (supports IP, CIDR, "geoip:", "ext:") and apply a default safe policy#5947)
I see some IPs:
"0.0.0.0/8", "10.0.0.0/8", "100.64.0.0/10", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.2.0/24", "192.88.99.0/24", "192.168.0.0/16", "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "224.0.0.0/3", "::/127", "fc00::/7", "fe80::/10", "ff00::/8",and my $WG_PRIV_IP is a 10.0.0.0/8 IP. (I don't have the access to the WG server to change the IP)
Reproduction Method
Already Explained.
Client config
Details
Server config
Details
Client log
Not Needed
Server log
Not Needed