[Bug]: VLESS Reverse Proxy (new format, PR #5101) routing broken on xray-core v26.5+ — works on v26.4.25

[psy-factor]

Describe the bug

After upgrading xray-core from v26.4.25 to any newer version (v26.5.x, v26.6.1), VLESS Reverse Proxy routing stops working on the bridge (outbound-initiating) side. The core starts without errors, but traffic is never routed through the reverse tunnel. Downgrading only the bridge server back to v26.4.25 restores full operation immediately without any config changes.

This issue was tested across 3x-ui panel versions v3.1.0, v3.2.0, v3.2.5, all of which generate the new VLESS Reverse Proxy format (not legacy "reverse" block). The portal side version does not matter — the regression is strictly on the bridge node.

---

Environment

Component | Version -- | -- xray-core (broken) | v26.5.x, v26.6.1 xray-core (works) | v26.4.25 Panel | 3x-ui v3.1.0, v3.2.0, v3.2.5 OS | Linux (amd64) Go | go1.26.3

---

How to reproduce

1. Set up a portal server with xray-core (any version).
2. Set up a bridge node using VLESS Reverse Proxy config (new format, "reverse": {"tag": "..."} inside the VLESS outbound client settings — as introduced in PR VLESS protocol: Add Reverse Proxy (4) Command and extremely simple config #5101).
3. Run bridge node with xray-core v26.6.1 → routing does not work, burstObservatory logs context deadline exceeded for the reverse outbound tag.
4. Downgrade only the bridge node to xray-core v26.4.25, keep config identical → routing works immediately.

---

Logs (bridge node, xray-core v26.6.1)

2026/06/01 19:11:21 WARNING - XRAY: core: Xray 26.6.1 started
2026/06/01 19:11:21 INFO - XRAY: infra/conf/serial: Reading config: &{Name:bin/config.json Format:json}
2026/06/01 19:11:21 DEBUG - XRAY: Xray 26.6.1 (Xray, Penetrates Everything.) 94ffd50 (go1.26.3 linux/amd64)
2026/06/01 19:12:04 WARNING - XRAY: app/observatory/burst: error ping https://www.google.com/generate_204 with 0_server_do_ams_9999<: Head "https://www.google.com/generate_204": context deadline exceeded (Client.Timeout exceeded while awaiting headers)

The burstObservatory continuously fails to probe via the reverse outbound tag (s0_server_do_ams_9999), indicating the reverse mux connection is either not established or not visible to the observatory scheduler.

---

Expected behavior

VLESS Reverse Proxy routing works on xray-core v26.5+ identically to v26.4.25 — bridge node establishes the reverse mux tunnel successfully and traffic is routed through it.

---

Related issues

• BurstObservatory fails to timely health-check dynamically registered outbound handlers (simplified reverse proxy) #5750 — BurstObservatory fails to timely health-check dynamically registered outbound handlers in simplified reverse proxy. The rproxy-* outbounds are registered via outbound.Manager.AddHandler() only on first bridge connection — after Observatory has already started — so Select() misses them for up to 10 minutes. This is likely the root cause of the routing failure observed here.
• BUG??? Reverse Proxy (Portal/Bridge) connection state desynchronization after restarts #5962 — Reverse Proxy connection state desynchronization after restarts (portal holds stale tunnel mappings, bridge fails to re-register).
• PR VLESS protocol: Add Reverse Proxy (4) Command and extremely simple config #5101 — The PR itself explicitly states: "反向代理子协议尚不稳定，未来肯定会 break，不保证跨版本兼容性" (reverse proxy sub-protocol is unstable, will break in the future, cross-version compatibility is not guaranteed). This warning appears to have materialised starting from v26.5.

---

Additional context

• Panel 3x-ui migrated to the new VLESS Reverse Proxy format starting from v3.0.2. The config generated is correct — the issue is in the core.
• The regression is version-bisected: v26.4.25 works, v26.5.x and v26.6.1 do not, with identical config.
• Temporary workaround: pin xray-core to v26.4.25 on the bridge node.

[Meo597]

需提供完整配置和日志

[aliajboy]

@Meo597 we cannot share it as it is on production. and by the way, you don't need it! it just doesn't work. after upgrading from v26.4.25, the reverse setup doesn't work. I see that portal side inbounds show that bridge is connecting to it but the connection and routing in portal doesn't work and doesn't get connected. but when we downgrade the xray core, everything works perfectly. I am waiting a long time for an update to fix this problem, but it seems like you don't give any attention to this bug and it's been many releases but again we have this problem not fixed. as trump says "Thanks for your attention..."

[psy-factor]

Here are the configurations of the inbound and outbound servers.Here are the configurations of the inbound and outbound servers.
The logic is as follows:
I (the client) connect to the inbound server on port 3090.
The external server connects to the inbound server on port 666.
The reverse tag is s0_trx_666.
If both servers run 26.4.25, everything works perfectly. Russian traffic goes out directly from the inbound server, while foreign traffic is forwarded to the outbound server.
If I install core 26.6.1 on the outbound server, everything breaks.
The ping in the client doesn't go through and shows n/a. Russian traffic stops being routed directly on the inbound server. And the connection stops working entirely. If I switch the core back to 26.4.25, reconnect, then everything starts working perfectly again.

Configuration Inbound server

SysLog
2026/06/02 13:46:21 DEBUG - X-UI: WebSocket client connected: 2efdb2e2 (total: 1)
2026/06/02 13:46:21 DEBUG - X-UI: WebSocket client 2efdb2e2 registered from 192.168.1.12
2026/06/02 13:46:21 DEBUG - X-UI: WebSocket client disconnected: ed208f67 (total: 0)
2026/06/02 13:46:21 DEBUG - X-UI: WebSocket client disconnected: cc16218c (total: 1)
2026/06/02 13:44:11 WARNING - XRAY: app/observatory/burst: error ping https://www.google.com/generate_204 with s0_trx_666: Head "https://www.google.com/generate_204": context deadline exceeded (Client.Timeout exceeded while awaiting headers)
2026/06/02 13:44:05 WARNING - XRAY: [1035216583] app/dispatcher: non existing outTag: s0_trx_666
2026/06/02 13:44:05 WARNING - XRAY: core: Xray 26.4.25 started
2026/06/02 13:44:05 INFO - XRAY: infra/conf/serial: Reading config: &{Name:bin/config.json Format:json}

{
"api": {
"services": [
"HandlerService",
"LoggerService",
"StatsService"
],
"tag": "api"
},
"burstObservatory": {
"pingConfig": {
"connectivity": "http://connectivitycheck.platform.hicloud.com/generate_204",
"destination": "https://www.google.com/generate_204",
"interval": "1m",
"sampling": 2,
"timeout": "5s"
},
"subjectSelector": [
"s0_trx_it_666",
"s0_trx_ams_666",
]
},
"inbounds": [
{
"listen": "127.0.0.1",
"port": 62789,
"protocol": "tunnel",
"settings": {
"address": "127.0.0.1"
},
"tag": "api"
},
{
"listen": "0.0.0.0",
"port": 4049,
"protocol": "mixed",
"settings": {
"auth": "noauth",
"ip": "127.0.0.1",
"udp": false
},
"sniffing": {
"destOverride": [
"http",
"tls",
"quic",
"fakedns"
],
"enabled": true
},
"tag": "inbound-4049"
},
{
"listen": "0.0.0.0",
"port": 666,
"protocol": "vless",
"settings": {
"clients": [
{
"email": "eth-usa",
"id": "bb93",
"reverse": {
"tag": "s0_trx_666"
}
},
],
"decryption": "none"
},
"sniffing": {
"destOverride": [
"http",
"tls",
"quic",
"fakedns"
],
"enabled": true,
"metadataOnly": false,
"routeOnly": false
},
"streamSettings": {
"network": "tcp",
"security": "tls",
"tcpSettings": {
"acceptProxyProtocol": false,
"header": {
"type": "none"
}
},
"tlsSettings": {
"alpn": [
"http/1.1"
],
"certificates": [
{
"buildChain": false,
"certificateFile": "/root/cert/trx.inbound.domain/fullchain.pem",
"keyFile": "/root/cert/trx.inbound.domain/privkey.pem",
"oneTimeLoading": false,
"usage": "encipherment"
}
],
"cipherSuites": "",
"disableSystemRoot": false,
"echServerKeys": "",
"enableSessionResumption": false,
"maxVersion": "1.3",
"minVersion": "1.2",
"rejectUnknownSni": false,
"serverName": "trx.inbound.domain"
}
},
"tag": "inbound-666"
},
{
"listen": "0.0.0.0",
"port": 3090,
"protocol": "vless",
"settings": {
"clients": [
{
"email": "mtproto-vless",
"id": "7ad6"
}
],
"decryption": "none"
},
"sniffing": {
"destOverride": [
"http",
"tls",
"quic",
"fakedns"
],
"enabled": true,
"metadataOnly": false,
"routeOnly": false
},
"streamSettings": {
"network": "tcp",
"security": "tls",
"tcpSettings": {
"acceptProxyProtocol": false,
"header": {
"type": "none"
}
},
"tlsSettings": {
"alpn": [
"http/1.1"
],
"certificates": [
{
"buildChain": false,
"certificateFile": "/root/cert/trx.inbound.domain/fullchain.pem",
"keyFile": "/root/cert/trx.inbound.domain/privkey.pem",
"oneTimeLoading": false,
"usage": "encipherment"
}
],
"cipherSuites": "",
"disableSystemRoot": false,
"echServerKeys": "",
"enableSessionResumption": false,
"maxVersion": "1.3",
"minVersion": "1.2",
"rejectUnknownSni": false,
"serverName": "trx.inbound.domain"
}
},
"tag": "inbound-3090"
}
],
"log": {
"access": "none",
"dnsLog": false,
"error": "",
"loglevel": "warning",
"maskAddress": ""
},
"metrics": {
"listen": "127.0.0.1:11111",
"tag": "metrics_out"
},
"outbounds": [
{
"protocol": "freedom",
"settings": {
"domainStrategy": "ForceIPv4",
"noises": [],
"redirect": ""
},
"tag": "direct"
},
{
"protocol": "blackhole",
"settings": {},
"tag": "blocked"
}
],
"policy": {
"levels": {
"0": {
"statsUserDownlink": true,
"statsUserUplink": true
}
},
"system": {
"statsInboundDownlink": true,
"statsInboundUplink": true,
"statsOutboundDownlink": true,
"statsOutboundUplink": true
}
},
"routing": {
"balancers": [
{
"fallbackTag": "",
"selector": [
"s0_trx__666",
"s0_trx_ams_666"
],
"strategy": {
"type": "roundRobin"
},
"tag": "mtproto-balance"
},
{
"fallbackTag": "s0_trx_ams_666",
"selector": [
"s0_trx_ams_666"
],
"strategy": {
"type": "leastLoad"
},
"tag": "AMS"
}
],
"domainStrategy": "IPIfNonMatch",
"rules": [
{
"inboundTag": [
"api"
],
"outboundTag": "api",
"type": "field"
},
{
"ip": [
"geoip:private"
],
"outboundTag": "blocked",
"type": "field"
},
{
"outboundTag": "blocked",
"protocol": [
"bittorrent"
],
"type": "field"
},
{
"ip": [
"ext:geoip_RU.dat:ru"
],
"outboundTag": "direct",
"type": "field"
},
{
"domain": [
"ext:geosite_RU.dat:ru-available-only-inside",
"regexp:.\.ru$",
"regexp:.\.su$",
"regexp:.*\.xn--p1ai$"
],
"outboundTag": "direct",
"type": "field"
},
{
"balancerTag": "mtproto-balance",
"inboundTag": [
"inbound-666"
],
"type": "field"
},
{
"inboundTag": [
"inbound-3090"
],
"outboundTag": "s0_trx_666",
"type": "field"
},
{
"balancerTag": "mtproto-balance",
"inboundTag": [
"inbound-4048"
],
"type": "field"
}
]
},
"stats": {}
}

---

Configuration outside server.

SysLog
2026/06/02 06:51:25 DEBUG - X-UI: WebSocket client connected: 8e7f3eb1 (total: 1)
2026/06/02 06:51:25 DEBUG - X-UI: WebSocket client 8e7f3eb1 registered from 212.34.0.0
2026/06/02 06:51:25 DEBUG - X-UI: WebSocket client disconnected: ed83131f (total: 0)
2026/06/02 06:51:25 DEBUG - X-UI: WebSocket client disconnected: 7d8ba608 (total: 1)
2026/06/02 06:36:46 DEBUG - XRAY: [2943590896] app/proxyman/inbound: connection ends > proxy/vless/inbound: failed to dial to localhost:8080 > common/retry: [dial tcp 127.0.0.1:8080: connect: connection refused] > common/retry: all retry attempts failed
2026/06/02 06:35:57 WARNING - XRAY: core: Xray 26.6.1 started
2026/06/02 06:35:56 DEBUG - X-UI: xray metrics unavailable: Get

{
"api": {
"services": [
"HandlerService",
"LoggerService",
"StatsService"
],
"tag": "api"
},
"inbounds": [
{
"listen": "127.0.0.1",
"port": 62789,
"protocol": "tunnel",
"settings": {
"address": "127.0.0.1"
},
"tag": "api"
},
{
"listen": "0.0.0.0",
"port": 443,
"protocol": "vless",
"settings": {
"clients": [
{
"email": "x07quk85",
"id": "746c6a"
}
],
"decryption": "none",
"fallbacks": [
{
"alpn": "",
"dest": "8080",
"name": "",
"path": "",
"xver": 0
}
]
},
"sniffing": {
"destOverride": [
"http",
"tls",
"quic",
"fakedns"
],
"enabled": true,
"metadataOnly": false,
"routeOnly": false
},
"streamSettings": {
"network": "tcp",
"security": "tls",
"tcpSettings": {
"acceptProxyProtocol": false,
"header": {
"type": "none"
}
},
"tlsSettings": {
"alpn": [
"h2",
"http/1.1"
],
"certificates": [
{
"buildChain": false,
"certificateFile": "/root/cert/domain.com/fullchain.pem",
"keyFile": "/root/cert/domain.com/privkey.pem",
"oneTimeLoading": false,
"usage": "encipherment"
}
],
"cipherSuites": "",
"disableSystemRoot": false,
"echForceQuery": "none",
"echServerKeys": "",
"enableSessionResumption": false,
"maxVersion": "1.3",
"minVersion": "1.2",
"rejectUnknownSni": false,
"serverName": "domain.com"
}
},
"tag": "inbound-443"
},
{
"listen": "0.0.0.0",
"port": 10443,
"protocol": "vless",
"settings": {
"clients": [
{
"email": "z5oygujp",
"id": "e2c0a4"
}
],
"decryption": "none"
},
"sniffing": {
"destOverride": [
"http",
"tls",
"quic",
"fakedns"
],
"enabled": true,
"metadataOnly": false,
"routeOnly": false
},
"streamSettings": {
"network": "tcp",
"realitySettings": {
"maxClientVer": "",
"maxTimediff": 0,
"minClientVer": "",
"mldsa65Seed": "",
"privateKey": "cKyBZyu",
"serverNames": [
"icloud.com"
],
"shortIds": [
"81c2",
"28d02c840603cd72",
"368776",
"bb0639d0e6af",
"4cca5212",
"b60dca7b88",
"bb",
"9a487a1e6c1ca5"
],
"show": false,
"target": "icloud.com:443",
"xver": 0
},
"security": "reality",
"tcpSettings": {
"acceptProxyProtocol": false,
"header": {
"type": "none"
}
}
},
"tag": "inbound-10443"
}
],
"log": {
"access": "none",
"dnsLog": false,
"error": "",
"loglevel": "warning",
"maskAddress": ""
},
"metrics": {
"listen": "127.0.0.1:11111",
"tag": "metrics_out"
},
"outbounds": [
{
"protocol": "freedom",
"settings": {
"domainStrategy": "ForceIPv4",
"noises": [],
"redirect": ""
},
"tag": "direct"
},
{
"protocol": "blackhole",
"settings": {},
"tag": "blocked"
},
{
"protocol": "vless",
"settings": {
"address": "trx.inbound.domain",
"encryption": "none",
"flow": "",
"id": "bb931",
"port": 666,
"reverse": {
"sniffing": {
"destOverride": [
"http",
"tls",
"quic",
"fakedns"
],
"enabled": true,
"metadataOnly": false,
"routeOnly": false
},
"tag": "s0_trx_666"
}
},
"streamSettings": {
"network": "tcp",
"security": "tls",
"tcpSettings": {
"header": {
"type": "none"
}
},
"tlsSettings": {
"alpn": [
"http/1.1"
],
"echConfigList": "",
"fingerprint": "chrome",
"pinnedPeerCertSha256": "",
"serverName": "trx.inbound.domain",
"verifyPeerCertByName": ""
}
},
"tag": "trx-eth-usa"
}
],
"policy": {
"levels": {
"0": {
"statsUserDownlink": true,
"statsUserUplink": true
}
},
"system": {
"statsInboundDownlink": true,
"statsInboundUplink": true,
"statsOutboundDownlink": true,
"statsOutboundUplink": true
}
},
"routing": {
"domainStrategy": "IPIfNonMatch",
"rules": [
{
"inboundTag": [
"api"
],
"outboundTag": "api",
"type": "field"
},
{
"ip": [
"geoip:private"
],
"outboundTag": "blocked",
"type": "field"
},
{
"outboundTag": "blocked",
"protocol": [
"bittorrent"
],
"type": "field"
},
{
"domain": [
"geosite:category-ads-all",
"ext:geosite_RU.dat:category-ads-all",
"ext:geosite_IR.dat:malware",
"ext:geosite_IR.dat:phishing",
"ext:geosite_IR.dat:cryptominers",
"ext:geosite_RU.dat:ru-available-only-inside",
"regexp:.\.ru$",
"regexp:.\.su$",
"regexp:.*\.xn--p1ai$"
],
"outboundTag": "blocked",
"type": "field"
}
]
},
"stats": {}
}

[Meo597]

your outside server's direct outbound is missing finalRules
should allow ip !geoip:private

See:

• https://xtls.github.io/en/config/outbounds/freedom.html
• https://xtls.github.io/en/document/level-2/vless_reverse.html

[psy-factor]

This rule has no effect on anything. I removed geoip:private from both servers, switched the core to 26.6.1, and after restarting the outbound server EVERYTHING completely stopped working again. No ping, no direct routing on the inbound server, none of the rules for inbound-3090.

[Meo597]

show me your outside server's direct outbound config with finalrules

[psy-factor]

Adding an explicit allow rule to finalRules on the egressing freedom outbound fixed it - reverse proxy now works on 26.6.1:
{
"tag": "direct",
"protocol": "freedom",
"settings": {
"domainStrategy": "ForceIPv4",
"finalRules": [
{ "action": "allow", "network": "tcp,udp", "ip": ["!geoip:private"] }
]
}
}
So the new default safety policy was blocking all reverse-proxy egress until an explicit allow was added. Thanks - confirmed working on my side.