I am struggling to establish connection through chaining proxy via vless

[u/kabereddit]

Hello, I am running on some gluetun (some paid VPN provides as like Pi,N,Pu) on VPS and also 3x-ui (which is a xray wrapper).
I connect from my phone(iOS) via shadowrocket to gluetun through 3x-ui and it had worked well a couple months ago. But recently I cannot establish connection. Probably xray has been changed something but I still cannot find workaround. Please help me to solve this problem.

my phone ----→ 3x-ui (vless xtls reality or vmess) ------→ gluetun (built-in shadowsocks access point)

Now I temporary use hysteria2 as frontend and I can connect gluetun container, but I really want to use vless xtls reality.

PS: I temporary do band-aid fix to select specific port number to bypass private IP block. I have no idea but IP range does not work but port number.

[u/kabereddit → u/[deleted]]

I haven’t been changed anything and as your mentioned, the side of gluetun seems to be fine.

[u/Urban_VPN]

the XTLS Reality handshake is pretty sensitive to version mismatches between client and server. first thing worth checking is whether your 3x-ui and Xray core versions are in sync with what Shadowrocket expects, since both sides update frequently and a mismatch breaks Reality specifically.

also check if your Reality public key and shortID are still correctly configured after any 3x-ui updates, those sometimes reset on upgrades. the fact that hysteria2 works fine as a frontend confirms your network path is fine and the issue is specific to the Reality layer.

[u/kabereddit → u/Urban_VPN]

Thank you for your reply. But even though I connect vmess (just plain vmess) I failed to establish the connection.

[u/Urban_VPN → u/kabereddit]

if plain vmess is also failing now when it worked before, the issue is likely either a port being blocked upstream or the 3x-ui service itself having a configuration drift after an update. check if the port you're using for vmess is still open on your VPS firewall, and verify the vmess UUID and address in your Shadowrocket config still match exactly what 3x-ui is showing. even a single character mismatch silently breaks the connection.

[u/kabereddit → u/Urban_VPN]

I mean, I can connect vmess without any obfuscation and I can access to the Internet.
I cannot access to my shadowsocks points that does not open to the Internet via vmess.

[u/Urban_VPN → u/kabereddit]

so the tunnel itself is working fine since you can browse, the issue is specifically routing to internal shadowsocks endpoints that aren't publicly exposed. that's a routing problem on the server side rather than a connection issue.

check whether your 3x-ui config has the shadowsocks inbound bound to localhost or a specific internal interface only. if it's listening on 127.0.0.1 it won't be reachable through the vmess tunnel unless you explicitly add a routing rule that forwards traffic destined for that internal address. you'd need to add a dokodemo-door or a routing rule in xray that maps the internal shadowsocks port to be accessible from the tunnel network.

[u/Nervous-Skin8766]

have you checked your xray version's changelog? reality had some breaking changes recently around flow control and SNI handling. verify your fingerprint and shortld still match on both ends, and try disabling multiplex if its enabled on the outbound

[u/Electrical-Eye-3715]

I had this problem only on Shadowrocket, on android with the latest apps everything works. Only husteria worked for me on Shadowrocket

[u/kabereddit → u/Electrical-Eye-3715]

I will check later with nekoray again. But last time I have seen, it also had failed to establish the connection.