Unable to setup VLESS+gRPC using Cloudflare CDN and nginx as reverse-proxy. invalid request version

[Akiyamov]

I'm trying to setup a VLESS proxy with gRPC as transport. To get connections from nginx xray is using unix socket and connections from nginx go to server if sent with proper curl header or with nekobox url test. Yet xray responds to this with next:

Aug 26 11:27:07 vps_name xray[91218]: 2024/08/26 11:27:07 @ rejected  proxy/vless/encoding: invalid request version
Aug 26 11:27:07 vps_name xray[91218]: 2024/08/26 11:27:07 [Info] [206540154] proxy/vless/inbound: firstLen = 360
Aug 26 11:27:07 vps_name xray[91218]: 2024/08/26 11:27:07 [Info] [206540154] app/proxyman/inbound: connection ends > proxy/vless/inbound: invalid request from @ > proxy/vless/encoding: invalid request version

And nekobox logs shows Get "http://cp.cloudflare.com/": unexpected status: 502 Bad Gateway if i try to make url test.

To setup server i used this example and following this blogpost installed nginx-full from apt.
My domain also uses punycode, CF can understand it without a problem, but for nginx and nekobox i changed it to english. Since they're connecting it means that this part is okay.

Versions

• Xray: Xray 1.8.23 (Xray, Penetrates Everything.) 4c82ef8 (go1.22.5 linux/amd64)
• Nginx: nginx version: nginx/1.18.0
• Nekobox: 4.0-beta3

Xray config

{
    "log": {
        "loglevel": "debug"
    },
    "routing": {
        "rules": [],
        "domainStrategy": "AsIs"
    },
    "inbounds": [
        {
            "protocol": "vless",
            "listen": "/dev/shm/Xray-VLESS-gRPC.socket,0666",
            "sniffing": {
                "enabled": true,
                "destOverride": [
                    "http",
                    "tls"
                ]
            },
            "settings": {
                "clients": [
                    {
                        "id": ""
                    }
                ],
                "decryption": "none"
            },
            "streamSettings": {
                "netwrok": "grpc",
                "grpcSettings": {
                    "serviceName": "TestChatGRPC"
                }
            }
        }
    ],
    "outbounds": [
        {
            "protocol": "freedom",
            "tag": "direct"
        }
    ]
}

nginx config

server {
        listen 80 http2 so_keepalive=on;
        listen 443 ssl http2 so_keepalive=on;
        root /var/www/html;

        ssl_certificate /opt/xray/ssl_cf.pem;
        ssl_certificate_key /opt/xray/ssl_cf.key;
        ssl_protocols TLSv1.2 TLSv1.3;


        index index.html index.htm index.nginx-debian.html;

        server_name ;

        client_header_timeout 52w;
        keepalive_timeout 52w;
        location / {
                try_files $uri $uri/ =404;
}
                location /TestChatGRPC {
                if ($content_type !~ "application/grpc") {
                        return 404;
                }
                client_max_body_size 0;
                client_body_buffer_size 512k;
                grpc_set_header Host    $host;
                grpc_set_header X-Real-IP       $remote_addr;
                client_body_timeout 52w;
                grpc_read_timeout 52w;
                grpc_pass unix:/dev/shm/Xray-VLESS-gRPC.socket;
        }
}

Nekobox config

Cloudflare

I found this #1797. But person there just left a sniffing part in wrong position but even if i delete sniffing nothing changes so problem is somewhere else but i can't really understand where.

[Akiyamov]

Don't use sing-box + xray outside of TCP/RAW connection.