疑似xHTTP可以在eduroam下被识别/阻断，原理不明

[MD-11F-RR]

背景
不是用于翻墙，我拿来做安全的反向代理/VPN等等。
eduroam是学校提供的一个WiFi，需要通过一定的身份认证便可以使用。连接上之后就是一个正常的网络。问题只出现在eduroam的网络下。

配置
总共有两台服务器A和B。A服务器有一个PHP网站，域名解析到CDN后HTTPS回源，并且配置有xHTTP+TLS。B没有网站也没有域名解析，配置了xHTTP+Reality用A服务器的证书。

现象
在eduroam的网络下使用域名可以正常访问A服务器的网站，并且可以ping通AB服务器。但是无法使用XTLS进行代理。客户端info如下。

2025/06/11 14:02:48.004572 [Info] [2463764075] proxy/socks: TCP Connect request to tcp:www.google.com:443
2025/06/11 14:02:48.006342 [Info] [2463764075] app/dispatcher: sniffed domain: www.google.com
2025/06/11 14:02:48.006342 [Info] [2463764075] app/dispatcher: taking detour [proxy] for [tcp:www.google.com:443]
2025/06/11 14:02:48.006342 from tcp:127.0.0.1:11014 accepted tcp:www.google.com:443 [socks -> proxy]
2025/06/11 14:02:48.006342 [Debug] [2463764075] transport/internet/splithttp: XMUX: creating xmuxClient because xmuxClients is empty
2025/06/11 14:02:48.006342 [Info] [2463764075] transport/internet/splithttp: XHTTP is dialing to tcp:***.***.***.***:443, mode stream-up, HTTP version 2, host some.redacted.domain
2025/06/11 14:02:48.006342 [Debug] [2463764075] transport/internet: dialing to tcp:***.***.***.***:443
2025/06/11 14:02:58.521940 [Info] [581627255] proxy/socks: TCP Connect request to tcp:www.google.com:443
2025/06/11 14:02:58.524229 [Info] [581627255] app/dispatcher: sniffed domain: www.google.com
2025/06/11 14:02:58.524229 [Info] [581627255] app/dispatcher: taking detour [proxy] for [tcp:www.google.com:443]
2025/06/11 14:02:58.524229 from tcp:127.0.0.1:11024 accepted tcp:www.google.com:443 [socks -> proxy]
2025/06/11 14:02:58.524229 [Info] [581627255] transport/internet/splithttp: XHTTP is dialing to tcp:***.***.***.***:443, mode stream-up, HTTP version 2, host some.redacted.domain
2025/06/11 14:03:04.007448 [Info] [2463764075] app/proxyman/inbound: connection ends > proxy/socks: connection ends > context canceled
2025-06-11 14:03:09 当前延迟: -1 ms，none
2025/06/11 14:03:14.535305 [Info] [581627255] app/proxyman/inbound: connection ends > proxy/socks: connection ends > context canceled
2025/06/11 14:05:18.283547 [Info] [2463764075] transport/internet/splithttp: failed to GET https://some.redacted.domain/redacted_path/c5f047d5-a8da-44bd-a961-cc15355ac089 > Get "https://some.redacted.domain/redacted_path/c5f047d5-a8da-44bd-a961-cc15355ac089": read tcp 134.130.38.17:11015->***.***.***.***:443: wsarecv: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.
2025/06/11 14:05:18.283547 [Info] [581627255] transport/internet/splithttp: failed to GET https://some.redacted.domain/redacted_path/4bf31359-049f-4b26-88f4-9d73d7e7ccc9 > Get "https://some.redacted.domain/redacted_path/4bf31359-049f-4b26-88f4-9d73d7e7ccc9": read tcp 134.130.38.17:11015->***.***.***.***:443: wsarecv: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.
2025/06/11 14:05:18.283547 [Debug] [581627255] transport/internet: dialing to tcp:***.***.***.***:443
2025/06/11 14:07:48.512354 [Info] [581627255] proxy/vless/outbound: tunneling request to tcp:www.google.com:443 via ***.***.***.***:443
2025/06/11 14:07:48.512354 [Info] [2463764075] proxy/vless/outbound: tunneling request to tcp:www.google.com:443 via ***.***.***.***:443

服务端似乎收到了客户端的请求，但是无法传输下行数据。服务端有关info如下

Jun 11 12:02:45 Some_Hostname xray[4181]: 2025/06/11 12:02:45.238845 [Debug] [3420389614] proxy/dokodemo: processing connection from: ***.***.***.***:11010
Jun 11 12:02:45 Some_Hostname xray[4181]: 2025/06/11 12:02:45.239300 [Info] [3420389614] proxy/dokodemo: received request for ***.***.***.***:11010
Jun 11 12:02:45 Some_Hostname xray[4181]: 2025/06/11 12:02:45.240017 [Info] [3420389614] app/dispatcher: sniffed domain: some.redacted.name
Jun 11 12:02:45 Some_Hostname xray[4181]: 2025/06/11 12:02:45.240027 [Info] [3420389614] app/dispatcher: taking detour [direct] for [tcp:some.redacted.name:4431]
Jun 11 12:02:45 Some_Hostname xray[4181]: 2025/06/11 12:02:45.240077 [Info] [3420389614] transport/internet/tcp: dialing TCP to tcp:127.0.0.1:4431
Jun 11 12:02:45 Some_Hostname xray[4181]: 2025/06/11 12:02:45.240114 [Debug] [3420389614] transport/internet: dialing to tcp:127.0.0.1:4431
Jun 11 12:02:45 Some_Hostname xray[4181]: 2025/06/11 12:02:45.240103 from ***.***.***.***:11010 accepted tcp:127.0.0.1:4431 [dokodemo-in -> direct]
Jun 11 12:02:45 Some_Hostname xray[4181]: 2025/06/11 12:02:45.240180 [Info] [3420389614] proxy/freedom: connection opened to tcp:127.0.0.1:4431, local endpoint ***.***.***.***:52875, remote endpoint 127.0.0.1:4431
Jun 11 12:02:45 Some_Hostname xray[4181]: 2025/06/11 12:02:45.240190 [Info] [3420389614] proxy: CopyRawConn splice
Jun 11 12:02:46 Some_Hostname xray[4181]: 2025/06/11 12:02:46.846620 [Debug] [2497999616] proxy/dokodemo: processing connection from: ***.***.***.***:11015
Jun 11 12:02:46 Some_Hostname xray[4181]: 2025/06/11 12:02:46.846647 [Info] [2497999616] proxy/dokodemo: received request for ***.***.***.***:11015
Jun 11 12:02:46 Some_Hostname xray[4181]: 2025/06/11 12:02:46.848361 [Info] [2497999616] app/dispatcher: sniffed domain: some.redacted.name
Jun 11 12:02:46 Some_Hostname xray[4181]: 2025/06/11 12:02:46.848487 [Info] [2497999616] app/dispatcher: taking detour [direct] for [tcp:some.redacted.name:4431]
Jun 11 12:02:46 Some_Hostname xray[4181]: 2025/06/11 12:02:46.848609 [Info] [2497999616] transport/internet/tcp: dialing TCP to tcp:127.0.0.1:4431
Jun 11 12:02:46 Some_Hostname xray[4181]: 2025/06/11 12:02:46.848727 [Debug] [2497999616] transport/internet: dialing to tcp:127.0.0.1:4431
Jun 11 12:02:46 Some_Hostname xray[4181]: 2025/06/11 12:02:46.848862 [Info] [2497999616] proxy/freedom: connection opened to tcp:127.0.0.1:4431, local endpoint ***.***.***.***:47665, remote endpoint 127.0.0.1:4431
Jun 11 12:02:46 Some_Hostname xray[4181]: 2025/06/11 12:02:46.848993 [Info] [2497999616] proxy: CopyRawConn splice
Jun 11 12:02:46 Some_Hostname xray[4181]: 2025/06/11 12:02:46.848495 from ***.***.***.***:11015 accepted tcp:127.0.0.1:4431 [dokodemo-in -> direct]
Jun 11 12:03:01 Some_Hostname xray[4181]: 2025/06/11 12:03:01.243559 [Info] [3420389614] app/proxyman/inbound: connection ends > proxy/dokodemo: connection ends > context canceled
Jun 11 12:03:02 Some_Hostname xray[4181]: 2025/06/11 12:03:02.851448 [Info] [2497999616] app/proxyman/inbound: connection ends > proxy/dokodemo: connection ends > context canceled

备注

1. 似乎这个eduroam有挺多挺奇怪的阻断的，比如阻断了非标端口。使用V2RAYN的TCPping功能可以ping通443端口，但是其他非标端口例如8000就ping不通。不知道还有没有其他阻断。
2. 手机端会提示TLS handshake timeout
3. 好像也阻断了第三方DNS，例如1.1.1.1。如果使用win11手动配置1.1.1.1作为DNS，然后nslookup命令会得到timeout的结果。但是默认提供的DNS可以正常工作，Mozilla直连下也可以使用DNS over HTTPS
4. 即便直接连接CDN服务器的443端口，（就是address直接填我的域名），也是同样的错误。但是网站是打得开的。
5. 我不觉得这是为了阻止代理，而是一些基于安全上进行的一些阻断，例如不允许bt下载等。但是如果我能直接打开https网页，那xtls也应该可以使用。我更好奇在这个过程中是出现了什么错误导致无法使用。

[leonardo0216]

I have the exact same problem. It started about 5 days ago, xhttp+tls through Cloudflare. Although the domain I'm using works fine, it doesn't with xhttp. The logs show the same things as yours. I would also like to understand why this is happening.

[MD-11F-RR]

there was a suggestion from someone, and maybe you can try it out. He suggested that we can use something simple. To be exact, we can try using vmess only, without any TLS encryption. However, I am currently busy on other stuffs and did not have time to try out, so you can have a try if you have time.

The interesting question will be of course, how does the network filter managed to do this in the first place. I do not think they are targeting xhttp in the first place, as this is not a need. They might be targeting something else like torrenting, etc. and this is just collateral damage.

[leonardo0216]

I have this problem in Russia.