[Info] transport/internet/tcp: REALITY: processed invalid connection from <isp gate>:<random port> : failed to read client hello

[CharaVerKys]

error appear on server side, client just common connect error
obviously tried:

1. updating xray
2. restarting
3. updating certificate (expired), tho i think xray not require ssl at all, and do not auto search for cert

obviously config im using was fine, and i used xray-core for 4 month already
2023-2024 issues for this error might be unrelated, havent found anything useful for me

i live in russia :sadface:

from home isp after some time of using vpn error starting to appear, after turning off and waiting, i can use vpn again
seems like DPI now (changing?) traffic, instead of just rejecting outcoming traffic
-not solved, just used vpn a little, just for sites like fandom.com or anything else that wont open, so no discord 3+ hours talks or high quality long vids on youtube

my server was unavailable from shitty isp on my work, and i was getting this error on vpn without working period
tried moving server to different ip, now it loads (havent waited for dns update tho), now i at least can access my git server
but vpn still not work

i just asking if anyone encountered this behavior lately..
and maybe, just maybe some one can actually help 🙏
i also tried reading tcp dumb, only see that server do receive some data, and for port 443 it do receive client hello packet, but cant answer against shitty isp or dpi ;; cant say more without knowing xray protocol underlines

here my configs:

charaverk | ~/xray_serv ~$ cat conf.json 
{
    "log": {
        "loglevel": "debug"
    },
    "inbounds": [
        {
            "listen":"0.0.0.0",
            "port": 444, // tried different ports from 1024 range (but not 443 btw) 
            "protocol": "vless",
            "settings": {
                "clients": [
                    {
                        "id": "no change since worked", 
                        "flow": "xtls-rprx-vision"
                    }
                ],
                "decryption": "none"
            },
            "streamSettings": {
                "network": "tcp",
                "security": "reality",
                "realitySettings": {
                    "dest": "google.com:443", 
                    "privateKey": "tried regenerating", 
                    "serverNames":["google.com"],
                    "shortIds": [
                        "8symbolsid"
                        //"0123456789abcdef" // 0 to f, length is a multiple of 2, maximum length is 16
                    ]
                }
            },
            "sniffing": {
                "enabled": true,
                "destOverride": [
                    "http",
                    "tls",
                    "quic"
                ],
                "routeOnly": true
            }
        }
    ],
    "outbounds": [
        {
            "protocol": "freedom",
            "tag": "direct"
        }
    ]
}

charaverk | ~/repos ~$ cat ../Public/conf.json 
{
    "log": {
        "loglevel": "debug"
    },
    "inbounds": [
        {
            "listen": "127.0.0.1", 
            "port": 1080,
            "protocol": "socks",
            "settings": {
                "udp": true
            },
            "sniffing": {
                "enabled": true,
                "destOverride": [
                    "http",
                    "tls",
                    "quic"
                ],
                "routeOnly": true
            }
        },
        {
            "listen": "127.0.0.1", 
            "port": 8080,
            "protocol": "http",
            "settings": {
                "udp": true
            },
            "sniffing": {
                "enabled": true,
                "destOverride": [
                    "http",
                    "tls",
                    "quic"
                ],
                "routeOnly": true
            }
        }
    ],
    "outbounds": [
        {
            "protocol": "vless",
            "settings": {
                "vnext": [
                    {
                        "address": "was my domain whole time, than i tried just (old) ip, and than, obviously, on new ip",
                        "port": 444, 
                        "users": [
                            {
                                "id": "...", // Needs to match server side
                                "encryption": "none",
                                "flow": "xtls-rprx-vision"
                            }
                        ]
                    }
                ]
            },
            "streamSettings": {
                "network": "tcp",
                "security": "reality",
                "realitySettings": {
                    "fingerprint": "chrome", 
                    "serverName": "google.com", // A website that support TLS1.3 and h2. If your dest is `1.1.1.1:443`, then leave it empty
                    "publicKey": "corresponding 'password' ", // run `xray x25519` to generate. Public and private keys need to be corresponding.
                    "spiderX": "", // If your dest is `1.1.1.1:443`, then you can fill it with `/dns-query/` or just leave it empty
                    "shortId": "..." // Required
                }
            },
            "tag": "proxy"
        }
    ]
}

for work, i need vpn for sites with data and chatbot for search
-btw, offtopic: ais are horrible at codding, but for search, when you not know where to look, for basic things like 'if such functional already exist' or 'what may be used' they are fine, big time savers (assuming checking info and doing further research)

whole (literally) xray server log:

charaverk | ~/xray_serv ~$ sudo ./xray -c conf.json 
Xray 26.2.6 (Xray, Penetrates Everything.) 12ee51e (go1.25.7 linux/amd64)
A unified platform for anti-censorship.
2026/02/24 08:31:49.825393 [Info] infra/conf/serial: Reading config: &{Name:conf.json Format:json}
2026/02/24 08:31:49.825501 [Debug] app/log: Logger started
2026/02/24 08:31:49.825509 [Debug] app/proxyman/inbound: creating stream worker on 0.0.0.0:444
2026/02/24 08:31:49.825522 [Info] transport/internet/tcp: listening TCP on 0.0.0.0:444
2026/02/24 08:31:49.825526 [Warning] core: Xray 26.2.6 started
2026/02/24 08:32:09.896002 [Info] transport/internet/tcp: REALITY: processed invalid connection from <ip>:40696: failed to read client hello
... repeat this for every tries, just feel screen with same string ...

versions of server and client match
client sample:

2026/02/24 12:21:03.172498 [Info] [1061322188] proxy/socks: TCP Connect request to tcp:duckduckgo.com:443
2026/02/24 12:21:03.173051 [Info] [1061322188] app/dispatcher: sniffed domain: duckduckgo.com
2026/02/24 12:21:03.173188 [Info] [1061322188] app/dispatcher: default route for tcp:duckduckgo.com:443
2026/02/24 12:21:03.173206 [Info] [1061322188] transport/internet/tcp: dialing TCP to tcp:meeee:444
2026/02/24 12:21:03.173216 [Debug] [1061322188] transport/internet: dialing to tcp:mee:444
2026/02/24 12:21:03.173102 from tcp:127.0.0.1:59758 accepted tcp:duckduckgo.com:443 [proxy]
... fires several other connects...
// there should've been timeout, but i waited for 5+ min, and there none...

[CharaVerKys]

btw, work with random config
https://i.ibb.co/Y4GCK5Cb/Screenshot-from-2026-02-24-13-54-55.png
idk, should be just dpi/isp blocking incoming traffic from vps's data center

[ksnovich]

What does mean "work with random config" ? Did you fix issue with DPI? Can you explain please or show examples.

[CharaVerKys]

@ksnovich
have you followed screenshot?
nekoray, after scanning for available configs in list, give some working configs

when i tried last time extract xray config from nekoray and just use it with xray-core, it just not worked out, instead i bought server and used it for until this month, when i came back on workplace 3 weeks later, i started to getting this error on server side

not want to repeat what i already described above
it seems like they replace/reject some traffic on unknown for me rules