Skip to content

[Bug] VLESS-xhttp 协议在通过 Cloudflare Tunnel/Nginx 转发时连接失败,而 Shadowrocket, v2rayN,Throne ,xray 裸核均正常 #2709

Description

@fscarmen

验证步骤

  • 我已经阅读了 文档,了解所有我编写的配置文件项的含义,而不是大量堆砌看似有用的选项或默认值。
  • 我仔细看过 文档 并未解决问题
  • 我已在 Issue Tracker 中寻找过我要提出的问题,并且没有找到
  • 我是中文用户,而非其他语言用户
  • 我已经使用最新的 Alpha 分支版本测试过,问题依旧存在
  • 我提供了可以在本地重现该问题的服务器、客户端配置文件与流程,而不是一个脱敏的复杂客户端配置文件。
  • 我提供了可用于重现我报告的错误的最简配置,而不是依赖远程服务器或者堆砌大量对于复现无用的配置等。
  • 我提供了完整的日志,而不是出于对自身智力的自信而仅提供了部分认为有用的部分。
  • 我直接使用 Mihomo 命令行程序重现了错误,而不是使用其他工具或脚本。

操作系统

MacOS, Linux

系统版本

Ubuntu 24.04.4 LTS

Mihomo 版本

Mihomo Meta v1.19.23 linux amd64 with go1.26.2 Wed Apr 8 01:07:42 UTC 2026
Use tags: with_gvisor

配置文件

log-level: debug
mixed-port: 7890
socks-port: 1080
allow-left: true
ipv6: false

proxies:
  - name: "🇺🇸 alice vless-xhttp"
    type: vless
    server: cf.090227.xyz
    port: 443
    uuid: 0130f6e0-8236-4689-af6a-52d1bcfe7aa8
    udp: true
    tls: true
    network: xhttp
    alpn:
      - h2
    servername: argox_json.formyvmess.tk
    client-fingerprint: chrome
    encryption: ""
    xhttp-opts:
      path: "/argox-xh"
      host: argox_json.formyvmess.tk

proxy-groups:
  - name: "proxy"
    type: select
    proxies:
      - "🇺🇸 alice vless-xhttp"

rules:
  - MATCH,proxy

描述

在使用 VLESS + xhttp 网络传输协议时,Mihomo 客户端无法与服务端建立连接。

  • 故障现象: 当 Mihomo 尝试连接时,后端的 Nginx 没有任何访问日志产生。
  • 对比测试: 使用完全相同的配置(UUID/路径/SNI),Shadowrocket(小火箭),Throne,v2rayN ,xray 裸核,均可以正常连接,且 Nginx 日志显示其使用的是 HTTP/2.0 请求。

重现方式

1. 服务端: Xray Inbound (关键部分,证书文件自签,argox_json.formyvmess.tk 是 Cloudflare Tunnel 域名)

{
    "log": {
        "access": "/root/access.log",
        "error": "/root/error.log",
        "loglevel": "debug"
    },
    "inbounds": [
        {
            "tag": "🇺🇸 alice vless-xhttp",
            "protocol": "vless",
            "port": 30007,
            "listen": "127.0.0.1",
            "settings": {
                "clients": [
                    {
                        "id": "0130f6e0-8236-4689-af6a-52d1bcfe7aa8"
                    }
                ],
                "decryption": "none"
            },
            "streamSettings": {
                "network": "xhttp",
                "security": "tls",
                "tlsSettings": {
                    "serverName": "argox_json.formyvmess.tk",
                    "certificates": [
                        {
                            "certificateFile": "/etc/argox/cert/cert.pem",
                            "keyFile": "/etc/argox/cert/private.key"
                        }
                    ]
                },
                "xhttpSettings": {
                    "mode": "auto",
                    "path": "/argox-xh"
                }
            }
        }
    ],
    "dns": {
        "servers": [
            "https+local://8.8.8.8/dns-query"
        ]
    }
}

2. 服务端: Nginx 核心配置

user  root;
worker_processes  auto;

# 开启全局错误日志,级别设为 notice
error_log  /var/log/nginx/error.log notice;
pid        /var/run/nginx.pid;

events {
    worker_connections  1024;
}

http {
    # 定义详细的日志格式,方便调试 CDN 和 xhttp 流量
    log_format full_debug '$remote_addr - $remote_user [$time_local] "$request" '
                          '$status $body_bytes_sent "$http_referer" '
                          '"$http_user_agent" "CF-IP: $http_x_forwarded_for" '
                          'rt=$request_time urt=$upstream_response_time';

    # 开启全局访问日志
    access_log /var/log/nginx/access.log full_debug;

    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;
    
    sendfile           on;
    keepalive_timeout 65;

    server {
        listen              8080 ssl;
        http2               on;
        server_name          argox_json.formyvmess.tk;
        ssl_certificate      /etc/argox/cert/cert.pem;
        ssl_certificate_key /etc/argox/cert/private.key;
        ssl_protocols        TLSv1.2 TLSv1.3;
        ssl_ciphers          HIGH:!aNULL:!MD5;
        ssl_session_cache    shared:SSL:10m;
        ssl_session_timeout 10m;

        # xhttp 专用路径调试
        location ~ ^/argox-xh {
            # 如果你想把 xhttp 的日志单独分出来,可以取消下面这行的注释
            # access_log /var/log/nginx/argox_xh.log full_debug;

            proxy_pass                  https://127.0.0.1:30007;
            proxy_http_version          2;
            proxy_ssl_server_name       on;
            proxy_ssl_name              argox_json.formyvmess.tk;
            proxy_ssl_verify            off;
            proxy_set_header            Host argox_json.formyvmess.tk;
            proxy_set_header            X-Real-IP $remote_addr;
            proxy_set_header            X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header            X-Forwarded-Proto $scheme;
            proxy_redirect              off;
            proxy_buffering             off;
            proxy_request_buffering     off;
            proxy_max_temp_file_size    0;
            chunked_transfer_encoding   on;
            tcp_nodelay                 on;
            proxy_read_timeout          1h;
            proxy_send_timeout          1h;
            client_max_body_size        0;
            client_body_timeout         1h;
        }
    }
}

3. Cloudflare Tunnel配置

tunnel: b5cdce05-dce6-4dfa-abf2-20f17eeafb71
credentials-file: /etc/argox/tunnel.json

ingress:
  - hostname: argox_json.formyvmess.tk
    service: https://localhost:8080
    originRequest:
      noTLSVerify: true
      http2Origin: true
      originServerName: argox_json.formyvmess.tk
      httpHostHeader: argox_json.formyvmess.tk
  - service: http_status:404

4. 客户端: Mihomo 代理配置

  - name: "🇺🇸 alice vless-xhttp"
    type: vless
    server: cf.090227.xyz
    port: 443
    uuid: 0130f6e0-8236-4689-af6a-52d1bcfe7aa8
    udp: true
    tls: true
    network: xhttp
    alpn:
      - h2
    servername: argox_json.formyvmess.tk
    client-fingerprint: chrome
    encryption: ""
    xhttp-opts:
      path: "/argox-xh"
      host: argox_json.formyvmess.tk

日志与对比分析

成功连接日志 (Shadowrocket)

Nginx 可以捕获到 HTTP/2.0 的 GET 请求,握手成功:

127.0.0.1 - - [15/Apr/2026:06:32:10 +0100] "GET /argox-xh/ce0c4378... HTTP/2.0" 200 0 "-" "Mozilla/5.0" "CF-IP: 12X.XXX.XX.254"

失败连接日志 (Mihomo)

  • Nginx 端: 完全没有产生任何日志。
  • Mihomo 端: [此处请粘贴你 Mihomo 开启 debug 级别后的报错日志,例如 TLS handshake timeout 或 connection reset]

日志

xhttp-opts.mode
模式,参数:auto,stream-one,stream-up 和 packet-up

我4个都试过,日志均是一样
Image

Shadowrocket 链接:

vless://OjAxMzBmNmUwLTgyMzYtNDY4OS1hZjZhLTUyZDFiY2ZlN2FhOEBza2subW9lOjQ0Mw?path=/argox-xh&remarks=%F0%9F%87%BA%F0%9F%87%B8%20alice%20vless-xhttp&obfsParam=%7B%22Host%22:%22argox_json.formyvmess.tk%22%7D&obfs=xhttp&tls=1&peer=argox_json.formyvmess.tk&alpn=h2,http/1.1&h2=1&mode=auto

v2rayN / Throne 链接:

vless://0130f6e0-8236-4689-af6a-52d1bcfe7aa8@cf.090227.xyz:443?encryption=none&security=tls&sni=argox_json.formyvmess.tk&alpn=h2%2Chttp%2F1.1&insecure=0&allowInsecure=0&type=xhttp&host=argox_json.formyvmess.tk&path=%2Fargox-xh&mode=auto#%F0%9F%87%BA%F0%9F%87%B8%20alice%20vless-xhttp

xray 裸核

{
  "log": {
    "loglevel": "debug"
  },
  "inbounds": [
    {
      "port": 2080,
      "protocol": "socks",
      "settings": {
        "udp": true
      }
    }
  ],
  "outbounds": [
    {
      "protocol": "vless",
      "settings": {
        "vnext": [
          {
            "address": "cf.090227.xyz",
            "port": 443,
            "users": [
              {
                "id": "0130f6e0-8236-4689-af6a-52d1bcfe7aa8",
                "encryption": "none"
              }
            ]
          }
        ]
      },
      "streamSettings": {
        "network": "xhttp",
        "security": "tls",
        "tlsSettings": {
          "serverName": "argox_json.formyvmess.tk",
          "fingerprint": "chrome"
        },
        "xhttpSettings": {
          "mode": "auto",
          "path": "/argox-xh"
        }
      }
    }
  ]
}

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions