XHTTP/3 over CF on Windows

[gfw-killer]

Integrity requirements

• I confirm that I have read the documentation, understand the meaning of all the configuration items I wrote, and did not pile up seemingly useful options or default values.
• I provided the complete config and logs, rather than just providing the truncated parts based on my own judgment.
• I searched issues and did not find any similar issues.
• The problem can be successfully reproduced in the latest Release

Description

I have a XHTTP/2 config at server side and use CF H3 for client
It works in my Android device using v2rayNG
But has problems in Windows, it only works for loading a webpage(3 seconds after connecting to proxy server) and then will load nothing
I tested Windows 10(Personal device) and Windows Server 2022(Cloud) both had the same problem
Did more tests on both devices :
Same config but with H2 ALPN works
Same config but without CF(Direct connection from Client to Server) works well (Server listens H3 and is tuned for H3)
The problem is that if there is something wrong with Server or CF, then why there is no problem in non-Windows clients

Reproduction Method

-

Client config

{
  "log": {
    "loglevel": "debug",
    "dnsLog": false
  },
  "dns": {
    "servers": [
      "8.8.8.8"
    ]
  },
  "inbounds": [
    {
      "tag": "mixed",
      "port": 10808,
      "listen": "127.0.0.1",
      "protocol": "socks",
      "sniffing": {
        "enabled": true
      },
      "settings": {
        "auth": "noauth",
        "udp": true,
        "allowTransparent": true
      }
    }
  ],
  "outbounds": [
    {
      "tag": "proxy",
      "protocol": "vless",
      "settings": {
        "vnext": [
          {
            "address": "my.domain.com",
            "port": 443,
            "users": [
              {
                "id": "-",
                "encryption": "none",
                "flow": null
              }
            ]
          }
        ]
      },
      "streamSettings": {
        "network": "xhttp",
        "security": "tls",
        "tlsSettings": {
          "serverName": "my.domain.com",
          "fingerprint": "unsafe",
          "allowInsecure": true,
          "alpn": [
            "h3"
          ]
        },
        "xhttpSettings": {
          "mode": "packet-up",
          "path": "/",
          "host": "my.domain.com"
        }
      }
    },
    {
      "protocol": "dns",
      "tag": "dns-out"
    },
    {
      "protocol": "freedom",
      "tag": "DIRECT"
    },
    {
      "protocol": "blackhole",
      "tag": "BLOCK"
    }
  ],
  "routing": {
    "domainStrategy": "IPOnDemand",
    "rules": [
      {
        "port": "0-65535",
        "outboundTag": "proxy",
        "type": "field"
      }
    ]
  }
}

Server config

{
  "log": {
    "loglevel": "debug"
  },
  "inbounds": [
    {
      "tag": "xhttp",
      "listen": "0.0.0.0",
      "port": 443,
      "protocol": "vless",
      "settings": {
        "clients": [
          {
            "id": "-"
          }
        ],
        "decryption": "none"
      },
      "streamSettings": {
        "network": "xhttp",
        "xhttpSettings": {
          "mode": "packet-up",
          "path": "/"
        },
        "security": "tls",
        "tlsSettings": {
          "certificates": [
            {
              "usage": "encipherment",
              "certificate": [
                "-----BEGIN CERTIFICATE-----",
                "MIIBfzCCASWgAwIBAgIQOi/jBgnANkQuGUIeSIFa/TAKBggqhkjOPQQDAjAmMREw",
                "DwYDVQQKEwhYcmF5IEluYzERMA8GA1UEAxMIWHJheSBJbmMwHhcNMjUwNDA0MTcz",
                "ODMwWhcNMjUwNzAzMTgzODMwWjAmMREwDwYDVQQKEwhYcmF5IEluYzERMA8GA1UE",
                "AxMIWHJheSBJbmMwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAT5l3RiAuJ0XELv",
                "nJkrhTc99CCuOqu3vwFdU2VyNenrHnRjOqhNVajHog1wGT/EVo6sUMTItVvfyVZe",
                "lTvM9l0wozUwMzAOBgNVHQ8BAf8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwEw",
                "DAYDVR0TAQH/BAIwADAKBggqhkjOPQQDAgNIADBFAiAF116fvoIJbl4e1hpy30cV",
                "Wvku0sx9yBrFztSKw3iLSgIhANn4TnKjglDdAqlO3RMPvIsmrSQRFiEHZQQ+N17C",
                "+L71",
                "-----END CERTIFICATE-----"
              ],
              "key": [
                "-----BEGIN RSA PRIVATE KEY-----",
                "MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgQw1g5h7wdceli+jV",
                "Y87yKYq8KOR9LCFLuuj4HBkWpW2hRANCAAT5l3RiAuJ0XELvnJkrhTc99CCuOqu3",
                "vwFdU2VyNenrHnRjOqhNVajHog1wGT/EVo6sUMTItVvfyVZelTvM9l0w",
                "-----END RSA PRIVATE KEY-----"
              ]
            }
          ]
        }
      }
    }
  ],
  "outbounds": [
    {
      "protocol": "freedom",
      "tag": "direct"
    },
    {
      "protocol": "blackhole",
      "tag": "block"
    }
  ],
  "routing": {
    "rules": [
      {
        "inboundTag": ["xhttp"],
        "outboundTag": "direct"
      }
    ]
  }
}

Client log

Xray 25.3.6 (Xray, Penetrates Everything.) 2cba2c4 (go1.24.1 windows/amd64)
A unified platform for anti-censorship.
2025/04/04 13:55:20.781431 Using default config:  C:\Users\Administrator\Desktop\config.json
2025/04/04 13:55:20.781431 [Info] infra/conf/serial: Reading config: &{Name:C:\Users\Administrator\Desktop\config.json Format:json}
2025/04/04 13:55:20.787092 [Debug] app/log: Logger started
2025/04/04 13:55:20.787092 [Info] app/dns: DNS: created UDP client initialized for 8.8.8.8:53
2025/04/04 13:55:20.788427 [Debug] app/proxyman/inbound: creating stream worker on 127.0.0.1:10808
2025/04/04 13:55:20.788427 [Info] transport/internet/tcp: listening TCP on 127.0.0.1:10808
2025/04/04 13:55:20.792583 [Info] transport/internet/udp: listening UDP on 127.0.0.1:10808
2025/04/04 13:55:20.792919 [Warning] core: Xray 25.3.6 started
2025/04/04 13:55:28.488739 [Debug] [3758665270] proxy/socks: Not Socks request, try to parse as HTTP request
2025/04/04 13:55:28.490028 [Info] [3758665270] proxy/http: request to Method [CONNECT] Host [duckduckgo.com:443] with URL [//duckduckgo.com:443]
2025/04/04 13:55:28.490868 [Info] [3758665270] app/dispatcher: taking detour [proxy] for [tcp:duckduckgo.com:443]
2025/04/04 13:55:28.491348 [Debug] [3758665270] transport/internet/splithttp: XMUX: creating xmuxClient because xmuxClients is empty
2025/04/04 13:55:28.501141 [Info] [3758665270] transport/internet/splithttp: XHTTP is dialing to udp:X.X.X.X:443, mode packet-up, HTTP version 3, host my.domain.com
2025/04/04 13:55:28.501141 [Debug] [3758665270] transport/internet: dialing to udp:X.X.X.X:443
2025/04/04 13:55:28.529793 [Info] [3758665270] proxy/vless/outbound: tunneling request to tcp:duckduckgo.com:443 via X.X.X.X:443
2025/04/04 13:55:28.886826 [Debug] [359724962] proxy/socks: Not Socks request, try to parse as HTTP request
2025/04/04 13:55:28.910414 [Info] [359724962] proxy/http: request to Method [CONNECT] Host [links.duckduckgo.com:443] with URL [//links.duckduckgo.com:443]
2025/04/04 13:55:28.910414 [Info] [359724962] app/dispatcher: taking detour [proxy] for [tcp:links.duckduckgo.com:443]
2025/04/04 13:55:28.910414 [Info] [359724962] transport/internet/splithttp: XHTTP is dialing to udp:X.X.X.X:443, mode packet-up, HTTP version 3, host my.domain.com
2025/04/04 13:55:28.910576 [Info] [359724962] proxy/vless/outbound: tunneling request to tcp:links.duckduckgo.com:443 via X.X.X.X:443
2025/04/04 13:58:27.660505 [Debug] [2769028046] proxy/socks: Not Socks request, try to parse as HTTP request
2025/04/04 13:58:27.662391 [Info] [2769028046] proxy/http: request to Method [CONNECT] Host [edge.microsoft.com:443] with URL [//edge.microsoft.com:443]
2025/04/04 13:58:27.662391 [Info] [2769028046] app/dispatcher: taking detour [proxy] for [tcp:edge.microsoft.com:443]
2025/04/04 13:58:27.662391 [Info] [2769028046] transport/internet/splithttp: XHTTP is dialing to udp:X.X.X.X:443, mode packet-up, HTTP version 3, host my.domain.com
2025/04/04 13:58:27.662391 [Info] [2769028046] proxy/vless/outbound: tunneling request to tcp:edge.microsoft.com:443 via X.X.X.X:443
2025/04/04 13:58:29.061607 [Info] [359724962] app/proxyman/outbound: app/proxyman/outbound: failed to process outbound traffic > proxy/vless/outbound: connection ends > proxy/vless/outbound: failed to transfer response payload > timeout: no recent network activity
2025/04/04 13:58:29.067168 [Debug] [2769028046] transport/internet: dialing to udp:X.X.X.X:443
2025/04/04 13:58:29.070082 [Debug] [359724962] transport/internet: dialing to udp:X.X.X.X:443
2025/04/04 13:58:29.070082 [Debug] [2769028046] transport/internet: dialing to udp:X.X.X.X:443
2025/04/04 13:58:29.070798 [Info] [3758665270] app/proxyman/outbound: app/proxyman/outbound: failed to process outbound traffic > proxy/vless/outbound: connection ends > proxy/vless/outbound: failed to transfer response payload > timeout: no recent network activity
2025/04/04 13:58:29.072030 [Info] [3758665270] app/proxyman/inbound: connection ends > proxy/http: connection ends > io: read/write on closed pipe
2025/04/04 13:58:29.072463 [Info] [359724962] app/proxyman/inbound: connection ends > proxy/http: connection ends > io: read/write on closed pipe

Server log

Xray 25.3.6 (Xray, Penetrates Everything.) 2cba2c4 (go1.24.1 windows/amd64)
... (no abnormal log, everything is normal at server side)

[Fangliding]

手机和电脑的网络环境可能不同

[gfw-killer]

I believe it's an Issue, idk why you turned it to a discussion

[gfw-killer]

@RPRX Do you have any idea on this Issue?
Some people believe mKCP options (readBufferSize and writeBufferSize) can solve this Issue
@yuhan6665 As you are working on Datagram transport, you could be able solve this issue, have a look please
Thank you

[i-eat-helicopter]

This problem also exists on the amd64/arm64 Linux, and directly compiled binaries for Android. It probably has nothing to do with ISP QoS, as it can be reproduced on a client on the same network as the VPS.