hysteria2 obfs (Salamander) #5712
Description
Integrity requirements
- I have read all the comments in the issue template and ensured that this issue meet the requirements.
- I confirm that I have read the documentation, understand the meaning of all the configuration items I wrote, and did not pile up seemingly useful options or default values.
- I provided the complete config and logs, rather than just providing the truncated parts based on my own judgment.
- I searched issues and did not find any similar issues.
- The problem can be successfully reproduced in the latest Release
Description
When using Hysteria2 as the server with obfs: salamander enabled, and Xray-core as the client with udpmasks: salamander in the Hysteria2 outbound, the connection fails with a timeout error on the client side. Packets appear to reach the server machine, but Hysteria2 logs show nothing (even in debug mode). Disabling obfs on the Hysteria2 server makes everything work fine.
This seems like a potential compatibility issue between the Salamander implementations in Hysteria2 and Xray-core.
Reproduction Method
- Set up Hysteria2 server with obfs enabled:
obfs:
type: salamander
salamander:
password: "your_password_here"
- Set up Xray-core outbound for Hysteria2 with udpmasks:
"udpmasks": [
{
"type": "salamander",
"settings": {
"password": "your_password_here" // Same as server
}
}
]
Overall scheme: VLESS + Reality inbound, Hysteria2 outbound.
3. Attempt to connect: Client times out.
Client config
{
"log": {
"loglevel": "warning"
},
"routing": {
"domainStrategy": "IPIfNonMatch",
"rules": [
{
"type": "field",
"ip": [
"geoip:private"
],
"outboundTag": "direct"
},
{
"type": "field",
"domain": [
"geosite:category-ads-all"
],
"outboundTag": "block"
}
]
},
"inbounds": [
{
"listen": "127.0.0.1",
"port": 10809,
"protocol": "http",
"sniffing": {
"enabled": true,
"destOverride": ["http", "tls", "quic"]
}
}
],
"outbounds": [
{
"tag": "proxy",
"protocol": "vless",
"settings": {
"vnext": [
{
"address": "ADDR",
"port": 443,
"users": [
{
"id": "ID",
"encryption": "none"
}
]
}
]
},
"streamSettings": {
"network": "tcp",
"security": "reality",
"realitySettings": {
"show": false,
"fingerprint": "chrome",
"serverName": "SNI",
"publicKey": "PUBLIC KEY",
"shortId": "SHORT ID",
"spiderX": "/"
}
}
},
{
"tag": "direct",
"protocol": "freedom"
},
{
"tag": "block",
"protocol": "blackhole"
}
],
"dns": {
"servers": [
"1.1.1.1",
"8.8.8.8",
"localhost"
]
}
}
Server config
{
"log": {
"loglevel": "debug"
},
"dns": {
"servers": [
"https+local://1.1.1.1/dns-query",
"localhost"
]
},
"routing": {
"domainStrategy": "IPIfNonMatch",
"rules": [
{
"ip": [
"geoip:private"
],
"outboundTag": "block"
},
{
"ip": [
"geoip:cn"
],
"outboundTag": "block"
},
{
"domain": [
"geosite:category-ads-all"
],
"outboundTag": "block"
}
]
},
"inbounds": [
{
"tag": "reality",
"listen": "127.0.0.1",
"port": 10001,
"protocol": "vless",
"settings": {
"clients": [
{
"id": "ID",
"email": "reality-user"
}
],
"decryption": "none",
"fallbacks": [
{
"dest": "127.0.0.1:8444",
"xver": 1
}
]
},
"streamSettings": {
"network": "tcp",
"security": "reality",
"realitySettings": {
"show": false,
"dest": "127.0.0.1:8443",
"serverNames": ["SNI", "www.SNI"],
"privateKey": "PRIVATE KEY",
"shortIds": ["SHORT ID"]
},
"sockopt": {
"acceptProxyProtocol": true
}
},
"sniffing": {
"enabled": true,
"destOverride": ["http", "tls", "quic"]
}
}
],
"outbounds": [
{
"tag": "proxy",
"protocol": "hysteria",
"settings": {
"version": 2,
"address": "ADDR",
"port": 443
},
"streamSettings": {
"network": "hysteria",
"security": "tls",
"tlsSettings": {
"serverName": "SNI",
"fingerprint": "chrome",
"alpn": ["h3"]
},
"hysteriaSettings": {
"version": 2,
"auth": "AUTH PASSWORD",
"up": "100 mbps",
"down": "200 mbps"
},
"udpmasks": [
{
"type": "salamander",
"settings": {
"password": "PASSWORD"
}
}
]
}
},
{
"tag": "direct",
"protocol": "freedom"
},
{
"tag": "block",
"protocol": "blackhole"
}
],
"routing": {
"rules": [
{
"type": "field",
"inboundTag": ["reality"],
"outboundTag": "proxy"
}
]
}
}
Client log
2026/02/21 03:51:06.488000 from 127.0.0.1:42732 accepted http://ifconfig.me/ [proxy]
2026/02/21 03:51:13.545698 [Warning] [2894305569] proxy/http: failed to read response from ifconfig.me > unexpected EOF
Server log
Feb 21 00:25:20 compute-vm-2-2-20-ssd-1771514652551 xray[43085]: 2026/02/21 00:25:20.223735 [Info] [2277118454] app/proxyman/outbound: app/proxyman/outbound: failed to process outbound traffic > proxy/hysteria: failed to find an available destination > transport/internet/hysteria: RoundTrip err > timeout: no recent network activity