I've noticed some shadowsocks configs work fine on my phone with v2rayNG but not on my Linux laptop with xray

[a-pav]

This has been the case for a while now but wasn't an issue since I always could find another working config (which is usually some combination of vless these days).

But now I'm close to a point where those type of shadowsocks configs (which by the way, works super fine with low latency on my phone but not on my laptop,) are the only working configs I can get my hands on.

I'm using the latest version of v2rayNG and xray on my phone and laptop.

I wonder what could possibly be the cause?
My phone and laptop are connected to the same WiFi network. I export the full config from v2rayNG and run it unmodified with xray.

[mmmray]

I think you need to mention

• which GFW you are dealing with (country and maybe ISP if it makes a difference)
• and what the error/symptom on desktop is
• and how you're setting up xray on the laptop
• and what the xray versions in each case are

..in order to even allow for guessing

[mmmray]

[Info] [4044977537] app/proxyman/outbound: failed to process outbound traffic > proxy/freedom: failed to open connection to tcp:10.10.34.36:80 > common/retry: [dial tcp 10.10.34.36:80: connect: connection refused] > common/retry: all retry attempts failed

You have a DNS leak. https://dnsleaktest.com/ to confirm. That IP is injected DNS response by the iranian GFW for blocked sites.

[a-pav]

You're right. Thank you for helping me understand the issue better.
I don't know how I can prevent DNS leak in the curl command. But in Firefox, I have checked the option, Proxy DNS when using SOCKS v5, and still I get the same IP in the logs when attempting to open https://dnsleaktest.com/ for a test:
(Please note that the same setup works with VLESS configs without similar problem.)

Click

[Info] [2656978909] proxy/socks: TCP Connect request to tcp:dnsleaktest.com:443
tcp:127.0.0.1:59224 accepted tcp:dnsleaktest.com:443 [socks -> proxy]
[Info] [2656978909] app/dispatcher: sniffed domain: dnsleaktest.com
[Info] [2656978909] app/dispatcher: taking detour [proxy] for [tcp:dnsleaktest.com:443]
[Info] [2656978909] transport/internet/tcp: dialing TCP to tcp:<THE-SHADOWSOCKS-SERVER>:443
[Debug] transport/internet: dialing to tcp:<THE-SHADOWSOCKS-SERVER>:443
[Info] [2656978909] transport/internet/tcp: dialing TCP to tcp:<THE-SHADOWSOCKS-SERVER>:443
[Debug] transport/internet: dialing to tcp:<THE-SHADOWSOCKS-SERVER>:443
[Info] [2656978909] transport/internet/tcp: dialing TCP to tcp:<THE-SHADOWSOCKS-SERVER>:443
[Debug] transport/internet: dialing to tcp:<THE-SHADOWSOCKS-SERVER>:443
[Info] [2656978909] transport/internet/tcp: dialing TCP to tcp:<THE-SHADOWSOCKS-SERVER>:443
[Debug] transport/internet: dialing to tcp:<THE-SHADOWSOCKS-SERVER>:443
[Info] [2656978909] transport/internet/tcp: dialing TCP to tcp:<THE-SHADOWSOCKS-SERVER>:443
[Debug] transport/internet: dialing to tcp:<THE-SHADOWSOCKS-SERVER>:443
[Warning] [2656978909] app/proxyman/outbound: failed to process outbound traffic > proxy/shadowsocks: failed to find an available destination > common/retry: [dial tcp 10.10.34.36:443: connect: connection refused] > common/retry: all retry attempts failed
[Info] [2656978909] app/proxyman/inbound: connection ends > proxy/socks: connection ends > proxy/socks: failed to transport all TCP response > io: read/write on closed pipe

By the way, how can I make my xray setup on laptop do a similar job as v2rayNG on my phone?

[a-pav]

To showcase all the results I get in different scenarios, I post their respective logs below.
As I said, VLESS configs work on my laptop, (with both Firefox, and the curl command) while SS does not.

Click

I've put a comment above each log section noting what scenario produced it.

# [Failure] Firefox with SS config, opening https://dnsleaktest.com/
[Info] [2656978909] proxy/socks: TCP Connect request to tcp:dnsleaktest.com:443
tcp:127.0.0.1:59224 accepted tcp:dnsleaktest.com:443 [socks -> proxy]
[Info] [2656978909] app/dispatcher: sniffed domain: dnsleaktest.com
[Info] [2656978909] app/dispatcher: taking detour [proxy] for [tcp:dnsleaktest.com:443]
[Info] [2656978909] transport/internet/tcp: dialing TCP to tcp:<SHADOWSOCKS-SERVER>:443
[Debug] transport/internet: dialing to tcp:<SHADOWSOCKS-SERVER>:443
[Info] [2656978909] transport/internet/tcp: dialing TCP to tcp:<SHADOWSOCKS-SERVER>:443
[Debug] transport/internet: dialing to tcp:<SHADOWSOCKS-SERVER>:443
[Info] [2656978909] transport/internet/tcp: dialing TCP to tcp:<SHADOWSOCKS-SERVER>:443
[Debug] transport/internet: dialing to tcp:<SHADOWSOCKS-SERVER>:443
[Info] [2656978909] transport/internet/tcp: dialing TCP to tcp:<SHADOWSOCKS-SERVER>:443
[Debug] transport/internet: dialing to tcp:<SHADOWSOCKS-SERVER>:443
[Info] [2656978909] transport/internet/tcp: dialing TCP to tcp:<SHADOWSOCKS-SERVER>:443
[Debug] transport/internet: dialing to tcp:<SHADOWSOCKS-SERVER>:443
[Warning] [2656978909] app/proxyman/outbound: failed to process outbound traffic > proxy/shadowsocks: failed to find an available destination > common/retry: [dial tcp 10.10.34.36:443: connect: connection refused] > common/retry: all retry attempts failed
[Info] [2656978909] app/proxyman/inbound: connection ends > proxy/socks: connection ends > proxy/socks: failed to transport all TCP response > io: read/write on closed pipe

# [Failure] curl with SS config, youtube.com
[Info] [4044977537] proxy/socks: TCP Connect request to tcp:10.10.34.36:80
[Info] [4044977537] app/dispatcher: sniffed domain: youtube.com
[Info] [4044977537] app/dispatcher: taking detour [direct] for [tcp:youtube.com:80]
[Info] [4044977537] transport/internet/tcp: dialing TCP to tcp:10.10.34.36:80
[Debug] transport/internet: dialing to tcp:10.10.34.36:80
tcp:127.0.0.1:38722 accepted tcp:10.10.34.36:80 [socks -> direct]
[Info] [4044977537] transport/internet/tcp: dialing TCP to tcp:10.10.34.36:80
[Debug] transport/internet: dialing to tcp:10.10.34.36:80
[Info] [4044977537] transport/internet/tcp: dialing TCP to tcp:10.10.34.36:80
[Debug] transport/internet: dialing to tcp:10.10.34.36:80
[Info] [4044977537] transport/internet/tcp: dialing TCP to tcp:10.10.34.36:80
[Debug] transport/internet: dialing to tcp:10.10.34.36:80
[Info] [4044977537] transport/internet/tcp: dialing TCP to tcp:10.10.34.36:80
[Debug] transport/internet: dialing to tcp:10.10.34.36:80
[Info] [4044977537] app/proxyman/outbound: failed to process outbound traffic > proxy/freedom: failed to open connection to tcp:10.10.34.36:80 > common/retry: [dial tcp 10.10.34.36:80: connect: connection refused] > common/retry: all retry attempts failed
[Info] [4044977537] app/proxyman/inbound: connection ends > proxy/socks: connection ends > proxy/socks: failed to transport all TCP response > io: read/write on closed pipe

# [Success] Firefox with VLESS config, opening https://dnsleaktest.com/
[Info] [3854900543] proxy/socks: TCP Connect request to tcp:dnsleaktest.com:443
[Info] [3854900543] app/dispatcher: sniffed domain: dnsleaktest.com
[Info] transport/internet/udp: establishing new connection for udp:1.1.1.1:53
[Info] app/dispatcher: taking detour [proxy] for [udp:1.1.1.1:53]
DNS accepted udp:1.1.1.1:53 [xray.system.<REDACTED-ID> -> proxy]
[Info] transport/internet/websocket: creating connection to tcp:<VLESS-SERVER>:80
[Info] proxy/vless/outbound: tunneling request to udp:1.1.1.1:53 via <VLESS-SERVER>:80
[Info] app/dns: failed to lookup ip for domain dnsleaktest.com at server UDP:1.1.1.1:53 > context deadline exceeded
tcp:127.0.0.1:60986 accepted tcp:dnsleaktest.com:443 [socks >> proxy]
[Info] features/routing/dns: resolve ip for dnsleaktest.com > app/dns: returning nil for domain dnsleaktest.com > multierr: context deadline exceeded |
[Info] [3854900543] app/dispatcher: default route for tcp:dnsleaktest.com:443
[Info] [3854900543] transport/internet/websocket: creating connection to tcp:<VLESS-SERVER>:80
[Info] [3854900543] proxy/vless/outbound: tunneling request to tcp:dnsleaktest.com:443 via <VLESS-SERVER>:80
[Info] app/dns: UDP:1.1.1.1:53 got answer: dnsleaktest.com. TypeAAAA -> [] 8.809810186s
[Info] app/dns: UDP:1.1.1.1:53 got answer: dnsleaktest.com. TypeA -> [23.239.16.110] 8.809830938s
[Info] transport/internet/udp: failed to handle UDP input > io: read/write on closed pipe

# [Success] curl with VLESS config, youtube.com
[Info] [431329653] proxy/socks: TCP Connect request to tcp:10.10.34.36:80
[Info] [431329653] app/dispatcher: sniffed domain: youtube.com
[Info] [431329653] app/dispatcher: default route for tcp:youtube.com:80
[Info] [431329653] transport/internet/websocket: creating connection to tcp:<VLESS-SERVER>:80
[Info] [431329653] proxy/vless/outbound: tunneling request to tcp:youtube.com:80 via <VLESS-SERVER>:80
tcp:127.0.0.1:33242 accepted tcp:10.10.34.36:80 [socks >> proxy]
[Info] [431329653] app/proxyman/inbound: connection ends > proxy/socks: connection ends > context canceled

[mmmray]

generally, curl can do it with -x socks5h://..., note socks5h instead of socks5

From your second-most-recent log file:

[Warning] [2656978909] app/proxyman/outbound: failed to process outbound traffic > proxy/shadowsocks: failed to find an available destination > common/retry: [dial tcp 10.10.34.36:443: connect: connection refused] > common/retry: all retry attempts failed

This line shows that the shadowsocks server itself was DNS-blocked. in this case it is probably easiest to hardcode the server's IP into the config instead of its domain name, the ultimate solution to DNS issues.

in general it's not surprising at all that SS does not work in Iran, nobody I know uses that protocol there anymore, and publicly leaked configs of all kinds are generally blocked really quickly.

[mmmray]

By the way, how can I make my xray setup on laptop do a similar job as v2rayNG on my phone?

I think the discrepancy between your phone and your laptop might be because your phone uses a DoH server for resolving DNS, and your laptop uses plain UDP. You can set up DoH on your laptop (really depends on the details), but it seems easier to just hardcode IPs in the config.

[a-pav]

This line shows that the shadowsocks server itself was DNS-blocked. in this case it is probably easiest to hardcode the server's IP into the config instead of its domain name, the ultimate solution to DNS issues.

That did the trick! Thank you so much!

in general it's not surprising at all that SS does not work in ...

I'm surprised too! Shadowsocks was never really the best method to get over GFW here, but this config I have is producing super steady tests in v2rayNG (~400ms) and now works on my laptop too! Again, thanks to you.

I think the discrepancy between your phone and your laptop might be because your phone uses a DoH server for resolving DNS, and your laptop uses plain UDP.

I'm sorry if the initial information was incomplete, but later I've realized that besides v2rayNG tests, the SS config only works with Telegram app (in my case, it's Telegram X) and fails with other apps like New Pipe and Fennec Fdroid. I didn't test anything else but even setting network.trr.mode to 3 in about:config of Fennec didn't resolve the case. Whatever DoH v2rayNG is using, seems to be working in my area, which itself is surprising as well!

[mmmray]

the SS config only works with Telegram app (in my case, it's Telegram X)

it's possible that the server operator set it up this way, on purpose. it means less traffic and therefore less likelihood that it gets blocked. I have thought about doing this kind of thing myself for public configs.

[a-pav]

But now (after hardcoding the IP) it's working with everything on my laptop! Is that expected? Let me hardcode the IP in the phone as well...