Help with VLESS+REALITY with fallback to caddy

[janusn]

How to properly using VLESS+REALITY and caddy reverse proxy as a fallback? The proxy part of the following works but caddy does not. 🥲

How to fix it? Thanks in advance.

Environment:

• XRay version: v26.2.6
• XRay installed via docker image ghcr.io/mhsanaei/3x-ui
• Caddy version: v2.11.2
• Caddy installed via docker image caddy

XRay config.json:

{
  "inbounds": [
    {
      "listen": "0.0.0.0",
      "port": 443,
      "protocol": "vless",
      "settings": {
        "clients": [
          {
            "email": "someone",
            "flow": "xtls-rprx-vision",
            "id": "**"
          }
        ],
        "decryption": "none",
        "encryption": "none",
        "fallbacks": [
          {
            "alpn": "",
            "dest": "caddy:443",
            "name": "",
            "path": "",
            "xver": 0
          }
        ],
        "testseed": [
          900,
          500,
          900,
          256
        ]
      },
      "sniffing": {
        "destOverride": [
          "http",
          "tls",
          "quic",
          "fakedns"
        ],
        "enabled": true,
        "metadataOnly": false,
        "routeOnly": true
      },
      "streamSettings": {
        "network": "tcp",
        "realitySettings": {
          "maxClientVer": "",
          "maxTimediff": 0,
          "minClientVer": "",
          "mldsa65Seed": "",
          "privateKey": "**",
          "serverNames": [
            "www.oracle.com"
          ],
          "shortIds": [
            "8f1c6da3a5",
            "3bd367",
            "f5dd22ab8d0d30",
            "1b298464,1373",
            "4a3adfa07ff8",
            "7bce6b6af397c78c",
            "73"
          ],
          "show": false,
          "target": "www.oracle.com:443",
          "xver": 0
        },
        "security": "reality",
        "tcpSettings": {
          "acceptProxyProtocol": false,
          "header": {
            "type": "none"
          }
        }
      },
      "tag": "main"
    }
  ],
  "observatory": null,
  "outbounds": [
    {
      "protocol": "freedom",
      "settings": {
        "domainStrategy": "AsIs",
        "noises": [],
        "redirect": ""
      },
      "tag": "direct"
    },
    {
      "protocol": "blackhole",
      "settings": {},
      "tag": "blocked"
    }
  ]
}

Caddyfile:

{
	email someone@example.com
	acme_ca https://acme-v02.api.letsencrypt.org/directory

	log {
		format json {
			time_format iso8601
		}
	}

	servers {
		listener_wrappers {
			proxy_protocol
		}
	}

	metrics
}

www.example.com {
	tls {
		dns dynu {env.DUCKDNS_API_TOKEN} {
			own_domain {env.DUCKDNS_EXAMPLE_COM}
		}
	}
	handle {
		reverse_proxy * http://1.2.3.4:443
	}
}

[Chara-Freedom]

You don't need to write ""dest": "caddy:443"," according to the docs. There is just a port in the docs. The port is pointing to the local content, not 443.

[janusn]

Thanks for your reply.

Just to be clarified, caddy and 3x-ui are installed as 2 separated docker containers on my setup. Does specifying the port alone work on my case?

[Chara-Freedom]

Thanks for your reply.

Just to be clarified, caddy and 3x-ui are installed as 2 separated docker containers on my setup. Does specifying the port alone work on my case?

It works in my case. See the answer below. By the way as far as I know if you want to combine reality and fallback you actually need selfsteal reality. You need fallback if you don't use reality, but the selfsteal reality acts the same way as fallback and it is a bit easier to configure.

[Chara-Freedom]

I also have a similar guide where there is a selfsteal reality instead of fallbacks. It also uses a local port for Caddy.

[janusn]

Thanks for your reply.

With the following setup:

Internet <- www.example.com:443 -> NAT <- 1.2.3.1:443 -> XRay
And Caddy runs on 1.2.3.4:443 and 1.2.3.4:80

I have no problem visiting my own servers behind Caddy from the internet. However, the XRay inbounds works for a minute or 2. Then it fails. What gives?

the relevant part of the XRay config.json:

{

<snip>

  "inbounds": [
    {
      "listen": "0.0.0.0",
      "port": 443,
      "protocol": "vless",
      "settings": {
        "clients": [
          {
            "email": "someone",
            "flow": "xtls-rprx-vision",
            "id": "**",
            "password": ""
          }
        ],
        "decryption": "none",
        "encryption": "none",
        "testseed": [
          900,
          500,
          900,
          256
        ]
      },
      "sniffing": {
        "destOverride": [
          "http",
          "tls",
          "quic",
          "fakedns"
        ],
        "enabled": true,
        "metadataOnly": false,
        "routeOnly": true
      },
      "streamSettings": {
        "network": "tcp",
        "realitySettings": {
          "maxClientVer": "",
          "maxTimediff": 0,
          "minClientVer": "",
          "mldsa65Seed": "",
          "privateKey": "**",
          "serverNames": [
            "www.example.com"
          ],
          "shortIds": [
            "8f1c6da3a5",
            "3bd367",
            "f5dd22ab8d0d30",
            "1b298464,1373",
            "4a3adfa07ff8",
            "7bce6b6af397c78c",
            "73"
          ],
          "show": false,
          "target": "1.2.3.4:443",
          "xver": 0
        },
        "security": "reality",
        "tcpSettings": {
          "acceptProxyProtocol": false,
          "header": {
            "type": "none"
          }
        }
      },
      "tag": "inbound-443"
    }
  ],

<snip>

}

[janusn]

The Xray works when setting the inbounds.streamSettings.realitySettings.dest to "www.oracle.com" but not "1.2.3.4:443".

I think the reason it works for a minute above when switched to "1.2.3.4:443" is the result of the web browser caches ahead.

[janusn]

I have cracked the problem. I have to update the SNI in the TLS of the client configuration as well. Thanks a ton.