请教：nginx分流到xray reality无法连接

[Cathgao]

使用nginx的upstream根据域名将433端口分流到后端。
xray使用reality，偷itunes.apple.com的握手
naiveproxy可以正常代理，但xray客户端报错

配置文件

nginx:

map $ssl_preread_server_name $filtered_sni_name {    
     tun.***.top proxy;
    }
upstream proxy {
    server 127.0.0.1:10038;
}
server {
    listen 443      reuseport;
    listen [::]:443 reuseport;
    ssl_preread on;
    proxy_pass $filtered_sni_name;
    proxy_protocol  on;
    set_real_ip_from 127.0.0.1;
}

xray server:

{
  "inbounds": [
    {
      "port": 10038,
      "protocol": "vless",
      "tag": "VLESSReality",
      "settings": {
        "clients": [
          {
            "id": "<>",
            "flow": "xtls-rprx-vision"
          }
        ],
        "decryption": "none",
        "fallbacks": [
          {
            "dest": "31300",
            "xver": 1
          }
        ]
      },
      "streamSettings": {
        "network": "tcp",
        "security": "reality",
        "tcpSettings": {
          "acceptProxyProtocol": true
        },
        "realitySettings": {
          "show": false,
          "dest": "itunes.apple.com:443",
          "xver": 0,
          "serverNames": [
            "itunes.apple.com"
          ],
          "privateKey": "<>",
          "publicKey": "<>",
          "maxTimeDiff": 70000,
          "shortIds": [
            "",
            "<>"
          ]
        }
      }
    }
  ]
}

客户端：

[WoChen5770]

tcpSettings--->sockopt 试试？

[Cathgao]

还是不行

[hkfires]

你只有一个域名，不需要map，不需要ssl预取，443端口也不需要reuseport，你可以用最简配置先看看能不能通，再慢慢在上边添加其他功能吧

stream {
    upstream reality_backend {
        server 127.0.0.1:10038;
    }
    server {
        listen 443;
        listen [::]:443;
        proxy_pass reality_backend;
        proxy_protocol on;
    }
}

[Cathgao]

并非只有一个子域，我没放上来而已。折腾了会配置文件弄好了