VLESS+XHTTP behind Nginx (TLS 1.2/1.3) fails with splithttp: use of closed network connection

[aleksandr-miheichev]

Summary

Migrating from VLESS+REALITY to VLESS+XHTTP behind Nginx (no CDN) to allow automatic TLS 1.2 fallback when TLS 1.3 is throttled/blocked.
Connection does not establish; Xray reports a XHTTP accept error.

• Last repro: 2025-07-31 22:52:50–22:52:59 (client log shows +0300; server TZ is Europe/Berlin, UTC+02:00)

Environment

Component	Version
Nginx	1.29.0
3x-ui / Xray	v2.6.2 / v25.7.26
v2rayN	7.13.5
OS	Debian 12.11 (Bookworm)
Network constraints	TLS 1.3 to VPN endpoints is intermittently blocked; Cloudflare is heavily throttled

Topology: client —TLS(h2/h3)→ Nginx:443 —HTTP/2 (grpc_pass)→ Xray (VLESS+XHTTP) @ 127.0.0.1:57577
Goal: Keep TLS 1.3 when available; gracefully fall back to TLS 1.2 without CDN.

Expected

Client connects via VLESS+XHTTP through Nginx (TLS 1.2 or 1.3) and proxy works.

Actual

Client fails to connect. Xray logs XHTTP accept error (see Diagnostics).

Minimal configs (sanitized)

Nginx

server {
    listen 443 ssl http2;
    listen 443 quic reuseport;
    server_name example.ddns.net;

    ssl_certificate     /path/fullchain.pem;
    ssl_certificate_key /path/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;

    # XHTTP upstream to Xray
    # NOTE: exact-match vs prefix — also tried `location /apiv1/`
    location = /apiv1 {
        grpc_pass grpc://127.0.0.1:57577;
        grpc_set_header Host $host;
        grpc_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        grpc_read_timeout 3600s;
        grpc_send_timeout 3600s;
    }

    # Static site
    location / { root /var/www/html; index index.html; }
}

Xray inbound (VLESS+XHTTP)

{
  "listen": "127.0.0.1",
  "port": 57577,
  "protocol": "vless",
  "settings": {
    "clients": [{ "id": "<uuid>", "encryption": "none" }],
    "decryption": "none"
  },
  "streamSettings": {
    "network": "xhttp",
    "security": "none",
    "xhttpSettings": {
      "path": "/apiv1",
      "mode": "stream-up"
    }
  }
}

Client (v2rayN)

{
  "protocol": "vless",
  "settings": {
    "vnext": [{
      "address": "example.ddns.net",
      "port": 443,
      "users": [{ "id": "<uuid>", "encryption": "none" }]
    }]
  },
  "streamSettings": {
    "network": "xhttp",
    "security": "tls",
    "tlsSettings": {
      "serverName": "example.ddns.net",
      "alpn": ["h3","h2","http/1.1"],
      "fingerprint": "chrome"
    },
    "xhttpSettings": {
      "path": "/apiv1",
      "mode": "stream-up"
    }
  }
}

Diagnostics

Client logs (v2rayN/Xray) around failure

2025/07/31 22:52:50.487727 from DNS accepted udp:1.1.1.1:53 [xray.system.5a9c35f2-6b2b-4894-9385-ef6ceaa32829 -> proxy]
2025/07/31 22:52:50.627607 from udp:127.0.0.1:56352 accepted udp:8.8.8.8:53 [socks -> proxy]
2025/07/31 22:52:50.690950 from 127.0.0.1:50388 accepted http://149.154.167.50:80/api [socks -> proxy]
2025/07/31 22:52:50.690950 from 127.0.0.1:50389 accepted http://149.154.167.41:80/api [socks -> proxy]
2025/07/31 22:52:50.691486 from 127.0.0.1:50390 accepted http://149.154.167.51:80/api [socks -> proxy]
2025/07/31 22:52:50.692017 from 127.0.0.1:50386 accepted //149.154.167.41:443 [socks -> proxy]
2025/07/31 22:52:50.692017 from 127.0.0.1:50387 accepted //149.154.167.51:443 [socks -> proxy]
2025/07/31 22:52:50.692017 from 127.0.0.1:50385 accepted //149.154.167.50:443 [socks -> proxy]
2025/07/31 22:52:50.735863 [Warning] [1464814164] proxy/http: failed to read response from 149.154.167.41:80 > unexpected EOF
2025/07/31 22:52:50.740974 [Warning] [760656514] proxy/http: failed to read response from 149.154.167.50:80 > unexpected EOF
2025/07/31 22:52:50.741477 [Warning] [1443194376] proxy/http: failed to read response from 149.154.167.51:80 > unexpected EOF
2025/07/31 22:52:51.013159 from udp:127.0.0.1:56352 accepted udp:8.8.8.8:53 [socks -> proxy]
2025/07/31 22:52:51.152661 from udp:127.0.0.1:56352 accepted udp:8.8.8.8:53 [socks -> proxy]
2025/07/31 22:52:51.627269 from udp:127.0.0.1:56352 accepted udp:8.8.8.8:53 [socks -> proxy]
2025/07/31 22:52:51.794063 from 127.0.0.1:50394 accepted http://149.154.167.50:80/api [socks -> proxy]
2025/07/31 22:52:51.798827 from 127.0.0.1:50395 accepted http://149.154.167.41:80/api [socks -> proxy]
2025/07/31 22:52:51.799340 from 127.0.0.1:50396 accepted http://149.154.167.51:80/api [socks -> proxy]
2025/07/31 22:52:51.799340 from 127.0.0.1:50393 accepted //149.154.167.51:443 [socks -> proxy]
2025/07/31 22:52:51.799340 from 127.0.0.1:50392 accepted //149.154.167.41:443 [socks -> proxy]
2025/07/31 22:52:51.799843 from 127.0.0.1:50391 accepted //149.154.167.50:443 [socks -> proxy]
2025/07/31 22:52:51.843512 [Warning] [3644433874] proxy/http: failed to read response from 149.154.167.50:80 > unexpected EOF
2025/07/31 22:52:51.845076 [Warning] [2638330388] proxy/http: failed to read response from 149.154.167.41:80 > unexpected EOF
2025/07/31 22:52:51.846106 [Warning] [129847841] proxy/http: failed to read response from 149.154.167.51:80 > unexpected EOF
2025/07/31 22:52:52.334379 from DNS accepted udp:1.1.1.1:53 [xray.system.5a9c35f2-6b2b-4894-9385-ef6ceaa32829 -> proxy]
2025/07/31 22:52:52.629158 from udp:127.0.0.1:56352 accepted udp:8.8.8.8:53 [socks -> proxy]
2025/07/31 22:52:52.899997 from 127.0.0.1:50405 accepted http://149.154.167.41:80/api [socks -> proxy]
2025/07/31 22:52:52.899997 from 127.0.0.1:50404 accepted http://149.154.167.50:80/api [socks -> proxy]
2025/07/31 22:52:52.900521 from 127.0.0.1:50406 accepted http://149.154.167.51:80/api [socks -> proxy]
2025/07/31 22:52:52.901033 from 127.0.0.1:50403 accepted //149.154.167.51:443 [socks -> proxy]
2025/07/31 22:52:52.901033 from 127.0.0.1:50401 accepted //149.154.167.50:443 [socks -> proxy]
2025/07/31 22:52:52.901033 from 127.0.0.1:50402 accepted //149.154.167.41:443 [socks -> proxy]
2025/07/31 22:52:52.944794 [Warning] [1969164175] proxy/http: failed to read response from 149.154.167.41:80 > unexpected EOF
2025/07/31 22:52:52.945316 [Warning] [197520847] proxy/http: failed to read response from 149.154.167.50:80 > unexpected EOF
2025/07/31 22:52:52.947362 [Warning] [3367819469] proxy/http: failed to read response from 149.154.167.51:80 > unexpected EOF
2025/07/31 22:52:53.029665 from DNS accepted udp:8.8.8.8:53 [xray.system.5a9c35f2-6b2b-4894-9385-ef6ceaa32829 -> proxy]
2025/07/31 22:52:53.156628 from DNS accepted udp:8.8.8.8:53 [xray.system.5a9c35f2-6b2b-4894-9385-ef6ceaa32829 -> proxy]
2025/07/31 22:52:53.726807 from DNS accepted udp:8.8.8.8:53 [xray.system.5a9c35f2-6b2b-4894-9385-ef6ceaa32829 -> proxy]
2025/07/31 22:52:53.768444 from DNS accepted udp:1.1.1.1:53 [xray.system.5a9c35f2-6b2b-4894-9385-ef6ceaa32829 -> proxy]
2025/07/31 22:52:53.790215 from DNS accepted udp:8.8.8.8:53 [xray.system.5a9c35f2-6b2b-4894-9385-ef6ceaa32829 -> proxy]
2025/07/31 22:52:53.861188 from DNS accepted udp:1.1.1.1:53 [xray.system.5a9c35f2-6b2b-4894-9385-ef6ceaa32829 -> proxy]
2025/07/31 22:52:54.153947 from udp:127.0.0.1:56352 accepted udp:8.8.8.8:53 [socks -> proxy]
2025/07/31 22:52:54.487983 from DNS accepted udp:8.8.8.8:53 [xray.system.5a9c35f2-6b2b-4894-9385-ef6ceaa32829 -> proxy]
2025/07/31 22:52:54.630921 from udp:127.0.0.1:56352 accepted udp:8.8.8.8:53 [socks -> proxy]
2025/07/31 22:52:54.788430 from DNS accepted udp:1.1.1.1:53 [xray.system.5a9c35f2-6b2b-4894-9385-ef6ceaa32829 -> proxy]
2025/07/31 22:52:54.997026 from 127.0.0.1:50417 accepted http://149.154.167.41:80/api [socks -> proxy]
2025/07/31 22:52:54.997026 from 127.0.0.1:50416 accepted http://149.154.167.50:80/api [socks -> proxy]
2025/07/31 22:52:54.997026 from 127.0.0.1:50418 accepted http://149.154.167.51:80/api [socks -> proxy]
2025/07/31 22:52:54.998058 from 127.0.0.1:50414 accepted //149.154.167.41:443 [socks -> proxy]
2025/07/31 22:52:54.998058 from 127.0.0.1:50413 accepted //149.154.167.50:443 [socks -> proxy]
2025/07/31 22:52:54.998058 from 127.0.0.1:50415 accepted //149.154.167.51:443 [socks -> proxy]
2025/07/31 22:52:55.013201 from udp:127.0.0.1:56352 accepted udp:8.8.8.8:53 [socks -> proxy]
2025/07/31 22:52:55.041111 [Warning] [1874827723] proxy/http: failed to read response from 149.154.167.41:80 > unexpected EOF
2025/07/31 22:52:55.041627 [Warning] [338341] proxy/http: failed to read response from 149.154.167.50:80 > unexpected EOF
2025/07/31 22:52:55.043682 [Warning] [2143327515] proxy/http: failed to read response from 149.154.167.51:80 > unexpected EOF
2025/07/31 22:52:55.153880 from udp:127.0.0.1:56352 accepted udp:8.8.8.8:53 [socks -> proxy]
2025/07/31 22:52:55.653393 from DNS accepted udp:1.1.1.1:53 [xray.system.5a9c35f2-6b2b-4894-9385-ef6ceaa32829 -> proxy]
2025/07/31 22:52:56.013461 from udp:127.0.0.1:56352 accepted udp:8.8.8.8:53 [socks -> proxy]
2025/07/31 22:52:56.154374 from udp:127.0.0.1:56352 accepted udp:8.8.8.8:53 [socks -> proxy]
2025/07/31 22:52:56.335222 from DNS accepted udp:8.8.8.8:53 [xray.system.5a9c35f2-6b2b-4894-9385-ef6ceaa32829 -> proxy]
2025/07/31 22:52:57.015271 from udp:127.0.0.1:56352 accepted udp:8.8.8.8:53 [socks -> proxy]
2025/07/31 22:52:57.030448 from DNS accepted https://dns.google/dns-query [xray.system.5a9c35f2-6b2b-4894-9385-ef6ceaa32829 -> proxy]
2025/07/31 22:52:57.075305 [Error] app/dns: failed to retrieve response for d.docs.live.net. > Post "https://dns.google/dns-query": EOF
2025/07/31 22:52:57.075305 [Error] app/dns: failed to retrieve response for d.docs.live.net. > Post "https://dns.google/dns-query": EOF
2025/07/31 22:52:57.075305 from DNS accepted udp:1.1.1.1:53 [xray.system.5a9c35f2-6b2b-4894-9385-ef6ceaa32829 -> proxy]
2025/07/31 22:52:57.156662 from DNS accepted https://dns.google/dns-query [xray.system.5a9c35f2-6b2b-4894-9385-ef6ceaa32829 -> proxy]
2025/07/31 22:52:57.202051 [Error] app/dns: failed to retrieve response for mtalk.google.com. > Post "https://dns.google/dns-query": EOF
2025/07/31 22:52:57.202051 [Error] app/dns: failed to retrieve response for mtalk.google.com. > Post "https://dns.google/dns-query": EOF
2025/07/31 22:52:57.202051 [Error] app/dns: failed to retrieve response for puk2-collabhubrtc.officeapps.live.com. > Post "https://dns.google/dns-query": EOF
2025/07/31 22:52:57.202051 [Error] app/dns: failed to retrieve response for mtalk.google.com. > Post "https://dns.google/dns-query": EOF
2025/07/31 22:52:57.202051 [Error] app/dns: failed to retrieve response for mtalk.google.com. > Post "https://dns.google/dns-query": EOF
2025/07/31 22:52:57.202051 [Error] app/dns: failed to retrieve response for puk2-collabhubrtc.officeapps.live.com. > Post "https://dns.google/dns-query": EOF
2025/07/31 22:52:57.202051 from DNS accepted udp:1.1.1.1:53 [xray.system.5a9c35f2-6b2b-4894-9385-ef6ceaa32829 -> proxy]
2025/07/31 22:52:57.727437 from DNS accepted https://dns.google/dns-query [xray.system.5a9c35f2-6b2b-4894-9385-ef6ceaa32829 -> proxy]
2025/07/31 22:52:57.768327 from DNS accepted udp:8.8.8.8:53 [xray.system.5a9c35f2-6b2b-4894-9385-ef6ceaa32829 -> proxy]
2025/07/31 22:52:57.773314 [Error] app/dns: failed to retrieve response for www.google.com. > Post "https://dns.google/dns-query": EOF
2025/07/31 22:52:57.773314 [Error] app/dns: failed to retrieve response for www.google.com. > Post "https://dns.google/dns-query": EOF
2025/07/31 22:52:57.773314 from DNS accepted udp:1.1.1.1:53 [xray.system.5a9c35f2-6b2b-4894-9385-ef6ceaa32829 -> proxy]
2025/07/31 22:52:57.790269 from DNS accepted https://dns.google/dns-query [xray.system.5a9c35f2-6b2b-4894-9385-ef6ceaa32829 -> proxy]
2025/07/31 22:52:57.834219 [Error] app/dns: failed to retrieve response for chatgpt.com. > Post "https://dns.google/dns-query": EOF
2025/07/31 22:52:57.834219 [Error] app/dns: failed to retrieve response for chatgpt.com. > Post "https://dns.google/dns-query": EOF
2025/07/31 22:52:57.834219 from DNS accepted udp:1.1.1.1:53 [xray.system.5a9c35f2-6b2b-4894-9385-ef6ceaa32829 -> proxy]
2025/07/31 22:52:57.861451 from DNS accepted udp:8.8.8.8:53 [xray.system.5a9c35f2-6b2b-4894-9385-ef6ceaa32829 -> proxy]
2025/07/31 22:52:58.084890 from 127.0.0.1:50426 accepted http://149.154.167.41:80/api [socks -> proxy]
2025/07/31 22:52:58.084890 from 127.0.0.1:50425 accepted http://149.154.167.50:80/api [socks -> proxy]
2025/07/31 22:52:58.085463 from 127.0.0.1:50427 accepted http://149.154.167.51:80/api [socks -> proxy]
2025/07/31 22:52:58.085463 from 127.0.0.1:50424 accepted //149.154.167.51:443 [socks -> proxy]
2025/07/31 22:52:58.086011 from 127.0.0.1:50421 accepted //149.154.167.50:443 [socks -> proxy]
2025/07/31 22:52:58.086011 from 127.0.0.1:50422 accepted //149.154.167.41:443 [socks -> proxy]
2025/07/31 22:52:58.128719 [Warning] [923244709] proxy/http: failed to read response from 149.154.167.50:80 > unexpected EOF
2025/07/31 22:52:58.132798 [Warning] [4027968345] proxy/http: failed to read response from 149.154.167.41:80 > unexpected EOF
2025/07/31 22:52:58.132798 [Warning] [1257689578] proxy/http: failed to read response from 149.154.167.51:80 > unexpected EOF
2025/07/31 22:52:58.155200 from udp:127.0.0.1:56352 accepted udp:8.8.8.8:53 [socks -> proxy]
2025/07/31 22:52:58.488527 from DNS accepted https://dns.google/dns-query [xray.system.5a9c35f2-6b2b-4894-9385-ef6ceaa32829 -> proxy]
2025/07/31 22:52:58.532991 [Error] app/dns: failed to retrieve response for prod.ipprotectionauth.goog. > Post "https://dns.google/dns-query": EOF
2025/07/31 22:52:58.532991 [Error] app/dns: failed to retrieve response for prod.ipprotectionauth.goog. > Post "https://dns.google/dns-query": EOF
2025/07/31 22:52:58.532991 from DNS accepted udp:1.1.1.1:53 [xray.system.5a9c35f2-6b2b-4894-9385-ef6ceaa32829 -> proxy]
2025/07/31 22:52:58.630921 from udp:127.0.0.1:56352 accepted udp:8.8.8.8:53 [socks -> proxy]
2025/07/31 22:52:58.789280 from DNS accepted udp:8.8.8.8:53 [xray.system.5a9c35f2-6b2b-4894-9385-ef6ceaa32829 -> proxy]
2025/07/31 22:52:58.948572 from DNS accepted udp:1.1.1.1:53 [xray.system.5a9c35f2-6b2b-4894-9385-ef6ceaa32829 -> proxy]
2025/07/31 22:52:59.016792 from udp:127.0.0.1:50400 accepted udp:8.8.8.8:53 [socks -> proxy]
+0300 2025-07-31 22:52:59 ERROR [2979593369 8.37s] dns: exchange failed for www.msftconnecttest.com. IN A: context canceled
+0300 2025-07-31 22:52:59 ERROR [68194896 9.99s] dns: exchange failed for s15.upd.kaspersky.com. IN AAAA: context canceled
+0300 2025-07-31 22:52:59 ERROR [4097416218 9.85s] dns: exchange failed for dc1.ksn.kaspersky-labs.com. IN AAAA: context canceled
+0300 2025-07-31 22:52:59 ERROR [403066859 9.99s] dns: exchange failed for s15.upd.kaspersky.com. IN A: context canceled
+0300 2025-07-31 22:52:59 ERROR [403066859 9.99s] dns: exchange failed for s15.upd.kaspersky.com. IN A: context canceled
+0300 2025-07-31 22:52:59 ERROR [2979593369 8.37s] dns: exchange failed for www.msftconnecttest.com. IN A: context canceled
+0300 2025-07-31 22:52:59 ERROR [68194896 9.99s] dns: exchange failed for s15.upd.kaspersky.com. IN AAAA: context canceled
+0300 2025-07-31 22:52:59 ERROR [4097416218 9.85s] dns: exchange failed for dc1.ksn.kaspersky-labs.com. IN AAAA: context canceled
+0300 2025-07-31 22:52:59 ERROR [3078668643 9.85s] dns: exchange failed for dc1.ksn.kaspersky-labs.com. IN A: context canceled
+0300 2025-07-31 22:52:59 ERROR [4138561327 3.99s] dns: exchange failed for s15.upd.kaspersky.com. IN A: context canceled
+0300 2025-07-31 22:52:59 ERROR [2979593369 8.37s] dns: exchange failed for www.msftconnecttest.com. IN A: context canceled
+0300 2025-07-31 22:52:59 ERROR [3078668643 9.85s] dns: exchange failed for dc1.ksn.kaspersky-labs.com. IN A: context canceled
+0300 2025-07-31 22:52:59 ERROR [3086356022 4.85s] dns: exchange failed for dc1.ksn.kaspersky-labs.com. IN A: context canceled
+0300 2025-07-31 22:52:59 ERROR [2979593369 8.37s] dns: exchange failed for www.msftconnecttest.com. IN A: context canceled
+0300 2025-07-31 22:52:59 ERROR [3531778107 10.0s] dns: exchange failed for p18.upd.kaspersky.com. IN A: context canceled
+0300 2025-07-31 22:52:59 ERROR [4138561327 3.99s] dns: exchange failed for s15.upd.kaspersky.com. IN A: context canceled
+0300 2025-07-31 22:52:59 ERROR [2979593369 8.37s] dns: exchange failed for www.msftconnecttest.com. IN A: context canceled
+0300 2025-07-31 22:52:59 ERROR [3086356022 4.85s] dns: exchange failed for dc1.ksn.kaspersky-labs.com. IN A: context canceled
+0300 2025-07-31 22:52:59 ERROR [403066859 9.99s] dns: exchange failed for s15.upd.kaspersky.com. IN A: context canceled
+0300 2025-07-31 22:52:59 ERROR [68194896 9.99s] dns: exchange failed for s15.upd.kaspersky.com. IN AAAA: context canceled
+0300 2025-07-31 22:52:59 ERROR [3078668643 9.85s] dns: exchange failed for dc1.ksn.kaspersky-labs.com. IN A: context canceled
+0300 2025-07-31 22:52:59 ERROR [3086356022 4.85s] dns: exchange failed for dc1.ksn.kaspersky-labs.com. IN A: context canceled
+0300 2025-07-31 22:52:59 ERROR [3086356022 4.85s] dns: exchange failed for dc1.ksn.kaspersky-labs.com. IN A: context canceled
+0300 2025-07-31 22:52:59 ERROR [4138561327 3.99s] dns: exchange failed for s15.upd.kaspersky.com. IN A: context canceled
+0300 2025-07-31 22:52:59 ERROR [1246952863 10.0s] dns: exchange failed for p18.upd.kaspersky.com. IN AAAA: context deadline exceeded
+0300 2025-07-31 22:52:59 ERROR [4097416218 9.85s] dns: exchange failed for dc1.ksn.kaspersky-labs.com. IN AAAA: context canceled

What I’ve tried (checklist)

• Match path across client/Nginx/Xray (/apiv1)
• Switch location = /apiv1 → location /apiv1/
• Update Xray-core / panel to latest available
• Verified cert chain & SNI match

Attachments

• config 3x-ui.json
• v2rayN config.json
• nginx.txt