400 Bad Request > websocket: bad handshake transport/internet/websocket: failed to dial WebSocket

[YolineWu]

环境信息

• 所在系统：客户端archlinux 6.0.8-arch1-1、服务器centos 9
• v2ray版本：服务端和客户端都是V2Ray 5.1.0

场景：想提高一下稳定

使用: VMess-Websocket-TLS + nginx + cloudflare

先看看报错日志吧

客户端部分日志： -- 相关完整日志

2022/12/04 17:01:51 [Warning] [2145543115] app/proxyman/outbound: failed to process outbound traffic > proxy/vmess/outbound: failed to find an available destination > common/retry: [transport/internet/websocket: failed to dial WebSocket > transport/internet/websocket: failed to dial to (wss://<二级域名>.me/private): 400 Bad Request > websocket: bad handshake transport/internet/websocket: failed to dial WebSocket > transport/internet/websocket: failed to dial to (wss://<二级域名>.me/private): > dial tcp: lookup <二级域名>.me: operation was canceled] > common/retry: all retry attempts failed

客户端完整日志：
服务端的nginx和v2ray都没有日志输出

请附上你的配置

服务端配置：

{
  "log": {
    ...
  },
  "inbounds": [
    {
      "port": 4432,
      "listen": "127.0.0.1",
      "protocol": "vmess",
      "settings": {
        "clients": [
          {
            "id": "<uuid>",
            "alterId": 0
          }
        ]
      },
      "streamSettings": {
        "network": "ws",
        "security": "tls"
      }
    },
    {
      "port": 4433,
      "protocol": "vmess",
      "settings": {
        "clients": [
          {
            "id": "<uuid>",
            "alterId": 0
          }
        ]
      },
      "streamSettings": {
        "network": "ws",
        "wsSettings": {
          "path": "/private"
        },
        "security": "tls",
        "tlsSettings": {
          "certificates": [{
	        "certificateFile": "/home/nginx/cert/<二级域名>.me.crt.acme",
	        "keyFile": "/home/nginx/cert/<二级域名>.me.key.acme"
	      }]
        }
      }
    }
  ],
  "outbounds": [
    {
      "protocol": "freedom",
      "settings": {}
    },
    {
      "protocol": "blackhole",
      "settings": {},
      "tag": "blocked"
    }
  ],
  "routing": {
    "rules": [
      {
        "type": "field",
        "ip": [
          "geoip:private"
        ],
        "outboundTag": "blocked"
      }
    ]
  }
}

nginx配置：

server {
    listen 80;

    server_name <二级域名>.me;

    return 301 https://<二级域名>.me$request_uri;

}
server {
    #listen 80;
    listen 443 ssl;
    server_name <二级域名>.me;

    root /home/nginx/<webProject>;
    index index.html;

    charset utf-8;

    types_hash_max_size 4096;
    client_max_body_size 128M;

    ssl_certificate       /home/nginx/cert/<二级域名>.me.pem; // cloudflare的Origin Certificates
    ssl_certificate_key   /home/nginx/cert/<二级域名>.me.key;
    #ssl_certificate       /home/nginx/cert/<二级域名>.me.crt.acme;
    #ssl_certificate_key   /home/nginx/cert/<二级域名>.me.key.acme;
    ssl_session_timeout 1d;
    ssl_session_cache shared:MozSSL:10m;
    ssl_session_tickets off;
    ssl_protocols         TLSv1.2 TLSv1.3;
    ssl_ciphers           ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;

    location / {
        try_files $uri $uri/ /index.html;
    }

    location /test {
	return 200 '1111';
    }

    location /private { # 与 V2Ray 配置中的 path 保持一致
        if ($http_upgrade != "websocket") { # WebSocket协商失败时返回404
            return 404;
         }
        proxy_redirect off;
        proxy_pass http://127.0.0.1:4432;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        # Show real IP in v2ray access.log
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

客户端配置：

{
  "log": {
    ...
  },
  "dns": {
    "servers": [
      {
        "address": "arturo.ns.cloudflare.com",
        "port": 53,
        "domains": [
          "<二级域名>.me"
        ]
      },
      {
        "address": "holly.ns.cloudflare.com",
        "port": 53,
        "domains": [
          "<二级域名>.me"
        ]
      },
      {
        "address": "114.114.114.114",
        "port": 53,
        "domains": [
          "geosite:cn",
          "arturo.ns.cloudflare.com",
          "holly.ns.cloudflare.com"
        ],
        "expectIPs": [
          "geoip:cn"
        ]
      },
      {
        "address": "8.8.8.8",
        "port": 53,
        "domains": [
          "geosite:geolocation-!cn",
          "geosite:speedtest"
        ]
      },
      "1.1.1.1",
      "localhost"
    ]
  },
  "inbounds": [
     ...
  ],
  "outbounds": [
    {
      "protocol": "vmess",
      "settings": {
        "vnext": [
          {
            "address": "<服务器ip>",
            "port": 4433,
            "users": [
              {
                "id": "<uuid>",
                "alterId": 0
              }
            ]
          }
        ]
      },
      "streamSettings": {
        "network": "ws",
        "wsSettings": {
          "path": "/private"
        },
        "security": "tls",
        "tlsSettings": {
          "serverName": "<二级域名>.me"
        }
      },
      "tag": "proxy"
    },
    {
      "protocol": "vmess",
      "settings": {
        "vnext": [
          {
            "address": "<二级域名>.me",
            "port": 443,
            "users": [
              {
                "id": "<uuid>",
                "alterId": 0
              }
            ]
          }
        ]
      },
      "streamSettings": {
        "network": "ws",
        "wsSettings": {
          "path": "/private"
        },
        "security": "tls",
        "tlsSettings": {
          "serverName": "<二级域名>.me"
        }
      },
      "tag": "testProxy"
    },
    {
      "protocol": "freedom",
      "settings": {},
      "tag": "direct"
    },
    {
      "protocol": "blackhole",
      "settings": {},
      "tag": "blocked"
    }
  ],
  "routing": {
    "domainStrategy": "IPIfNonMatch",
    "rules": [
      {
        "type": "field",
        "inboundTag": "toDirect",
        "outboundTag": "direct"
      },
      {
        "type": "field",
        "inboundTag": "toProxy",
        "outboundTag": "proxy"
      },
      {
        "type": "field",
        "inboundTag": "toTestProxy",
        "outboundTag": "testProxy"
      },
      {
        "type": "field",
        "outboundTag": "direct",
        "domain": [
          "<二级域名>.me",
          "geosite:cn",
          "geoip:private",
          ...
        ]
      },
      {
        "type": "field",
        "outboundTag": "proxy",
        "domain": [
            ...
        ]
      },
      {
        "type": "field",
        "outboundTag": "direct",
        "ip": [
          "geoip:cn",
          "127.0.0.1"
        ]
      },
      {
        "type": "field",
        "outboundTag": "proxy",
        "ip": [
          "8.8.8.8"
        ]
      },
      {
        "type": "field",
        "outboundTag": "block",
        "protocol": [
          "bittorrent"
        ]
      }
    ]
  }
}

其他说明

• 网站能正常访问

[banxter]

hi,, i have the same problem and client dose not connect,, has anyone solved this problem?

[scncpazl]

我也一样，不晓得什么原因

[qianbinbin]

如果直连可以但 Cloudflare 不行的话，可能是因为通用证书不支持二级和以上域名
二级域名例如 foo.bar.example.com