Unable to setup Vless+GRPC+TLS using cloudflare with nginx as reverse proxy.

[nyinyiaung94]

Hello everyone,
I'm trying to setup xray as my title stated above and Im keep getting the following errors. I have verified that x-ray grpc is listening on the port 8000 using ss -lntp. I'm currently using XRAY v1.8.18 with 3x-ui. I have been trying this for like weeks now, Can anyone help me understand where I went wrong ?

Thanks in advance for any answer. :))

On Nginx Access log

"POST /holysheet.com/Tun HTTP/2.0" 502 166 "-" "grpc-go/1.64.0"

On Qv2ray Client

app/proxyman/outbound: failed to process outbound traffic > proxy/vless/outbound: connection ends > proxy/vless/outbound: failed to decode response header > proxy/vless/encoding: failed to read response version > transport/internet/grpc/encoding: failed to fetch hunk from gRPC tunnel > rpc error: code = Unavailable desc = unexpected HTTP status code received from server: 502 (Bad Gateway); transport: received unexpected content-type "text/plain; charset=UTF-8"

XRAY error log

app/proxyman/inbound: connection ends > proxy/dokodemo: connection ends > proxy/dokodemo: failed to transport request > read tcp 127.0.0.1:62789->127.0.0.1:44616: read: connection reset by peer

XRAY Configs is as follow:

{
"api": {
"services": [
"HandlerService",
"LoggerService",
"StatsService"
],
"tag": "api"
},
"burstObservatory": null,
"dns": null,
"fakedns": null,
"inbounds": [
{
"listen": "127.0.0.1",
"port": 62789,
"protocol": "dokodemo-door",
"settings": {
"address": "127.0.0.1"
},
"sniffing": null,
"streamSettings": null,
"tag": "api"
},
{
"listen": "127.0.0.1",
"port": 8000,
"protocol": "vless",
"settings": {
"clients": [
{
"email": "[email protected]",
"flow": "",
"id": "4f135f90-6121-45b4-a4cd-156ecbe81e8b"
}
],
"decryption": "none",
"fallbacks": []
},
"sniffing": {
"destOverride": [
"http",
"tls",
"quic",
"fakedns"
],
"enabled": true,
"metadataOnly": false,
"routeOnly": false
},
"streamSettings": {
"grpcSettings": {
"authority": "",
"multiMode": false,
"serviceName": "holysheet.com"
},
"network": "grpc",
"security": "tls",
"tlsSettings": {
"alpn": [
"h2",
"h3",
"http/1.1"
],
"certificates": [
{
"certificateFile": "/etc/letsencrypt/cert/fullchain.cer",
"keyFile": "/etc/letsencrypt/cert/priv.key",
"ocspStapling": 3600,
"oneTimeLoading": false,
"usage": "encipherment"
}
],
"cipherSuites": "",
"disableSystemRoot": false,
"enableSessionResumption": false,
"maxVersion": "1.3",
"minVersion": "1.2",
"rejectUnknownSni": false,
"serverName": "x.mydomain.com"
}
},
"tag": "inbound-127.0.0.1:8000"
}
],
"log": {
"access": "./access.log",
"dnsLog": false,
"error": "./error.log",
"loglevel": "debug"
},
"observatory": null,
"outbounds": [
{
"protocol": "freedom",
"settings": {
"domainStrategy": "UseIP"
},
"tag": "direct"
},
{
"protocol": "blackhole",
"settings": {},
"tag": "blocked"
}
],
"policy": {
"levels": {
"0": {
"statsUserDownlink": true,
"statsUserUplink": true
}
},
"system": {
"statsInboundDownlink": true,
"statsInboundUplink": true,
"statsOutboundDownlink": true,
"statsOutboundUplink": true
}
},
"reverse": null,
"routing": {
"domainStrategy": "AsIs",
"rules": [
{
"inboundTag": [
"api"
],
"outboundTag": "api",
"type": "field"
},
{
"ip": [
"geoip:private"
],
"outboundTag": "blocked",
"type": "field"
},
{
"outboundTag": "blocked",
"protocol": [
"bittorrent"
],
"type": "field"
}
]
},
"stats": {},
"transport": null
}

And below is my Nginx Config

server {
listen 80;
listen [::]:80;

listen 443 ssl http2;
listen [::]:443 ssl http2;
ssl_certificate_key /root/cert/priv.key;
ssl_certificate /root/cert/fullchain.cer;

keepalive_requests 80000;
proxy_ssl_server_name on;

root /var/www/html;

index index.html index.htm index.nginx-debian.html;

server_name x.mydomain.com;

access_log /etc/nginx/access.log;
error_log /etc/nginx/error.log debug;

location / {
return 301 https://www.somewebsites.com;
}

location /holymoly/ {
proxy_pass https://localhost:2053;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection keep-alive;
proxy_set_header Host $host;
proxy_cache_bypass $http_upgrade;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}

location /gRPC {
grpc_pass grpc://127.0.0.1:8000;

proxy_buffer_size 512k;
proxy_buffers 4 256k;
proxy_busy_buffers_size 512k;
grpc_set_header Upgrade $http_upgrade;
grpc_set_header Connection "Upgrade";
grpc_set_header Connection keep-alive;
grpc_set_header Host $host;
grpc_set_header X-Real-IP $remote_addr;
grpc_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
grpc_set_header X-Forwarded-Proto $scheme;
proxy_ssl_server_name on;
grpc_ssl_certificate /etc/letsencrypt/cert/fullchain.cer;
grpc_ssl_certificate_key /etc/letsencrypt/cert/priv.key;

grpc_socket_keepalive on;

grpc_ssl_server_name on;
}

}

[MEM-917]

There are 2 problems with your set-up.

1. You have an ssl/tls enabled inbound and you are proxying the connection via nginx which has its own enabled ssl/tls.
2. ServiceName in xray and location in nginx must be the same.

The second one is easy. just use the same name for both of them.
For the first one, you must create a simple gRPC in xray w/o tls setting. Then remove the secondary certificate in gRPC directory in nginx and just pass the connections. In this method, all connection encodings and handshakes would be handled by nginx.

`

[nyinyiaung94]

Hello,
Thank you so much. You are a life saver. I removed tls settings from grpc inbound and it works now.
One more thing is,
when I use this grpc block, it works,

   location /holysheet.com {

          if ($content_type !~ "application/grpc") {
                  return 404;
           }
           client_max_body_size 0;
           client_body_timeout 1071906480m;
           grpc_read_timeout 1071906480m;
           grpc_pass grpc://127.0.0.1:8000;
   }

But I get 502 errors when I use this grpc block,

location /holysheet.com {
grpc_pass grpc://127.0.0.1:8000;
grpc_set_header Connection keep-alive;
grpc_set_header Host $host;
grpc_set_header X-Real-IP $remote_addr;
grpc_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
grpc_set_header X-Forwarded-Proto $scheme;
#Define stream identifier management
grpc_socket_keepalive on;
proxy_connect_timeout 60s;
proxy_send_timeout 60s;
proxy_read_timeout 60s;
grpc_send_timeout 60s;
grpc_read_timeout 60s;
proxy_buffer_size 512k;
proxy_buffers 4 256k;
proxy_busy_buffers_size 512k;

}

Do you think using the first block setting is okay ?

[MEM-917]

First of all, you're welcome.
Second, I don't know most of these parameters as they are for optimization and it's better to search the web to understand each one of them but as far as I know, the problem is the use of "proxy" command in gRPC directory. And for the first method which works just add the following lines to preserve the incoming IPs.

grpc_set_header	Host	$host;
grpc_set_header	X-Real-IP	$remote_addr;
grpc_set_header	X-Forwarded-For	proxy_add_x_forwarded_for;

[lxhao61]

V2Ray/Xray's gRPC only supports X-Real-IP, not X-Forwarded-For. Just keep X-Real-IP.

[MEM-917]

I just tested your proposition and you're correct. Without the X-Forwarded-For it works just fine. Thanks for clarification.

[nyinyiaung94]

Hello there,
My issue has been solved and it was working fine for a few months. Then it suddenly stopped working without me even touching the configs. Im inspecting nginx access and error logs and found this.

[09/Aug/2024:09:54:36 +0630] "POST /vlessgrpc/Tun HTTP/2.0" 200 457 "-" "grpc-go/1.36.0"
[09/Aug/2024:09:54:38 +0630] "POST /vlessgrpc/Tun HTTP/2.0" 200 124 "-" "grpc-go/1.36.0"
[09/Aug/2024:09:54:41 +0630] "POST /vlessgrpc/Tun HTTP/2.0" 200 278 "-" "grpc-go/1.36.0"
[20/Aug/2024:04:36:43 +0630] "POST /grpc.reflection.v1alpha.ServerReflection/ServerReflectionInfo HTTP/2.0" 404 162 "-" "grpcurl/dev-build (no version set) grpc-go/1.48.0"
[20/Aug/2024:04:36:43 +0630] "POST /grpc.reflection.v1alpha.ServerReflection/ServerReflectionInfo HTTP/2.0" 404 162 "-" "grpcurl/dev-build (no version set) grpc-go/1.48.0"
[31/Aug/2024:07:57:44 +0630] "POST /grpc.reflection.v1alpha.ServerReflection/ServerReflectionInfo HTTP/2.0" 404 162 "-" "grpcurl/dev-build (no version set) grpc-go/1.48.0"`

Could you suggest me what went wrong ?
Thank you in advance for any answer.