From d1f3ec048db1520d856fef440e0d02ae38d9a2ee Mon Sep 17 00:00:00 2001 From: Skride Date: Thu, 16 Jul 2026 23:51:50 +0400 Subject: [PATCH 1/3] REALITY: Reject targets that get the server IP blocked (CN/RU/IR) *.ru, *.ir, *.cn and apple/icloud/microsoft domains are increasingly abused as REALITY targets. The server IP never matches the domain's real IPs, so national DPI (GFW in China, TSPU/RKN in Russia, filtering in Iran) blocks such server IPs in bulk within days. Reject these targets at config load so a node fails fast instead of silently getting blocked. --- infra/conf/transport_security.go | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/infra/conf/transport_security.go b/infra/conf/transport_security.go index 21f3702a61e7..86d8db20b3e5 100644 --- a/infra/conf/transport_security.go +++ b/infra/conf/transport_security.go @@ -1,7 +1,6 @@ package conf import ( - "context" "encoding/base64" "encoding/hex" "encoding/json" @@ -159,8 +158,10 @@ func (c *REALITYConfig) Build() (proto.Message, error) { } for _, sn := range config.ServerNames { - if strings.Contains(sn, "apple") || strings.Contains(sn, "icloud") { - errors.LogWarning(context.Background(), `REALITY: Choosing apple, icloud, etc. as the target may get your IP blocked by the GFW`) + host := strings.ToLower(sn) + if strings.HasSuffix(host, ".ru") || strings.HasSuffix(host, ".ir") || strings.HasSuffix(host, ".cn") || + strings.Contains(host, "apple") || strings.Contains(host, "icloud") || strings.Contains(host, "microsoft") { + return nil, errors.New(`REALITY: "`, sn, `" must not be used as the target: such domains get the server's IP blocked, choose a proper dest`) } } From bd35a570cc2fa76015c30385989276d00d5b3de0 Mon Sep 17 00:00:00 2001 From: RPRX <63339210+RPRX@users.noreply.github.com> Date: Thu, 16 Jul 2026 20:40:29 +0000 Subject: [PATCH 2/3] Update transport_security.go --- infra/conf/transport_security.go | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/infra/conf/transport_security.go b/infra/conf/transport_security.go index 86d8db20b3e5..d349bb7687de 100644 --- a/infra/conf/transport_security.go +++ b/infra/conf/transport_security.go @@ -1,6 +1,7 @@ package conf import ( + "context" "encoding/base64" "encoding/hex" "encoding/json" @@ -158,10 +159,10 @@ func (c *REALITYConfig) Build() (proto.Message, error) { } for _, sn := range config.ServerNames { - host := strings.ToLower(sn) - if strings.HasSuffix(host, ".ru") || strings.HasSuffix(host, ".ir") || strings.HasSuffix(host, ".cn") || - strings.Contains(host, "apple") || strings.Contains(host, "icloud") || strings.Contains(host, "microsoft") { - return nil, errors.New(`REALITY: "`, sn, `" must not be used as the target: such domains get the server's IP blocked, choose a proper dest`) + sn = strings.ToLower(sn) + if strings.HasSuffix(sn, ".ru") || strings.HasSuffix(sn, ".ir") || strings.HasSuffix(sn, ".cn") || + strings.Contains(sn, "apple") || strings.Contains(sn, "icloud") || strings.Contains(sn, "microsoft") { + errors.LogWarning(context.Background(), `REALITY: Choosing "`, sn, `" as the target may get your server's IP blocked by the GFW`) } } From ef5904d34193dbe9516b17ee3e8e905e3ee88616 Mon Sep 17 00:00:00 2001 From: RPRX <63339210+RPRX@users.noreply.github.com> Date: Thu, 16 Jul 2026 20:59:59 +0000 Subject: [PATCH 3/3] Update transport_security.go --- infra/conf/transport_security.go | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/infra/conf/transport_security.go b/infra/conf/transport_security.go index d349bb7687de..ec45d5555d62 100644 --- a/infra/conf/transport_security.go +++ b/infra/conf/transport_security.go @@ -113,8 +113,10 @@ func (c *REALITYConfig) Build() (proto.Message, error) { config.MinClientVer[i] = byte(u) } } + errors.LogWarning(context.Background(), `REALITY: Changing "minClientVer" will increase the likelihood of your server's IP being blocked by the GFW`) } else { - config.MinClientVer = []byte{26, 3, 27} // change it at your own risk: https://github.com/XTLS/Xray-core/pull/6181#issuecomment-4567373533 + config.MinClientVer = []byte{26, 3, 27} // change it at your own risk: https://github.com/XTLS/Xray-core/commit/af7eb68028732a8ee3c0e5d6ab2b8a657bb2e770 + errors.LogWarning(context.Background(), `REALITY: The default minimal client version is Xray-core v26.3.27, other clients may be refused to connect`) } if c.MaxClientVer != "" { config.MaxClientVer = make([]byte, 3) @@ -162,7 +164,7 @@ func (c *REALITYConfig) Build() (proto.Message, error) { sn = strings.ToLower(sn) if strings.HasSuffix(sn, ".ru") || strings.HasSuffix(sn, ".ir") || strings.HasSuffix(sn, ".cn") || strings.Contains(sn, "apple") || strings.Contains(sn, "icloud") || strings.Contains(sn, "microsoft") { - errors.LogWarning(context.Background(), `REALITY: Choosing "`, sn, `" as the target may get your server's IP blocked by the GFW`) + errors.LogWarning(context.Background(), `REALITY: Choosing "`, sn, `" as the target will increase the likelihood of your server's IP being blocked by the GFW`) } }