amnezia-vpn/amnezia-client

Fork 0

mirror of https://github.com/amnezia-vpn/amnezia-client.git synced 2026-10-15 05:42:07 +00:00

[GH-ISSUE #2704] [Android / XRay Reality] Connected but no traffic with fingerprint=chrome; changing to firefox fixes it #1228

New issue

Open

opened 2026-10-13 20:38:37 +00:00 by bsakaguchi · 6 comments

bsakaguchi commented

2026-10-13 20:38:37 +00:00

Owner

Originally created by @ValitovTimur on GitHub (Jun 6, 2026).
Original GitHub issue: https://github.com/amnezia-vpn/amnezia-client/issues/2704

Update: root trigger identified and workaround confirmed

Confirmed workaround: changing the XRay Reality fingerprint from chrome to firefox immediately restores traffic.

Broken configuration:

"realitySettings": {
  "fingerprint": "chrome"
}

Working configuration:

"realitySettings": {
  "fingerprint": "firefox"
}

No server-side changes were required.

This workaround has now been confirmed on my OPPO CPH2701 as well. Other users in this issue have reported the same general failure on Samsung, Redmi, and Infinix devices.

Important control result:

The original configuration with fingerprint: chrome still works correctly using standalone Xray-core 26.3.27 in Termux on the same phone.
The same configuration does not pass traffic through AmneziaVPN.
Changing only the fingerprint to firefox makes AmneziaVPN work immediately.

Therefore, the issue appears to be related specifically to the handling or implementation of the chrome Reality/uTLS fingerprint in the XRay version bundled with AmneziaVPN, rather than to the server, routing, DNS, or Android VPNService in general.

This is a workaround, not a complete fix: existing profiles using fingerprint: chrome can still silently fail while AmneziaVPN reports Connected.

Describe the bug

AmneziaVPN on Android shows Connected for a self-hosted XRay/VLESS/Reality profile, but the VPN tunnel is not actually usable.

The Android VPN interface is created, routes are installed, and Amnezia starts tun2Socks and XRay. However, real application traffic is blackholed: TCP connect succeeds, but HTTP/TLS payload does not receive any response.

The same XRay/VLESS/Reality configuration works correctly when launched manually with standalone xray-core inside Termux on the same phone. A different commercial VPN application also works correctly as a full-system VPN on the same device.

So this does not look like a server/config/network problem. It looks like an issue in AmneziaVPN Android's XRay/tun2socks/VPNService data-plane on this OPPO / Android 16 device.

The issue started suddenly on two identical OPPO phones on the same day.

To Reproduce

Steps to reproduce the behavior:

Install AmneziaVPN on OPPO CPH2701 / Android 16.
Add a self-hosted XRay / VLESS / Reality profile.
Disable app split tunneling.
Disable site/IP split tunneling.
Disable Android Private DNS.
Make sure Always-on VPN / kill switch is disabled.
Connect to the XRay server.
AmneziaVPN UI shows Connected.
Run diagnostics from Termux.

TCP connect succeeds:

nc -vz -w5 1.1.1.1 80
nc -vz -w5 1.1.1.1 443
nc -vz -w5 8.8.8.8 443

Example result:

Connection to 1.1.1.1 80 port [tcp/http] succeeded!
Connection to 1.1.1.1 443 port [tcp/https] succeeded!
Connection to 8.8.8.8 443 port [tcp/https] succeeded!

But HTTP/TLS payload does not work:

curl -4 -v --connect-timeout 10 --max-time 20 http://1.1.1.1

Result:

* Trying 1.1.1.1:80...
* Established connection to 1.1.1.1 from 10.0.42.2
> GET / HTTP/1.1
> Host: 1.1.1.1
> User-Agent: curl/...
> Accept: */*
* Request completely sent off
* Operation timed out after 15003 milliseconds with 0 bytes received

HTTPS also fails:

curl -4 -k -v --connect-timeout 10 --max-time 20 https://1.1.1.1/cdn-cgi/trace

Result:

* Trying 1.1.1.1:443...
* TLSv1.3 (OUT), TLS handshake, Client hello (1)
* Connection timed out after 10004 milliseconds

Raw HTTP over netcat shows the same behavior:

printf 'GET / HTTP/1.0\r\nHost: example.com\r\n\r\n' | nc -v -w10 93.184.216.34 80

Result:

Connection to 93.184.216.34 80 port [tcp/http] succeeded!
# No HTTP response received

UDP DNS also fails:

dig +time=3 +tries=1 @1.1.1.1 google.com

Result:

no servers could be reached

However, this is not only a DNS issue, because direct HTTP/HTTPS to IP addresses also stalls.

Control test: the XRay endpoint is reachable from the same phone when AmneziaVPN is disabled:

nc -vz -w5 <SERVER_IP> 443

Result:

succeeded

TLS/HTTP to the endpoint also works directly:

curl -4 -vk --connect-timeout 10 --max-time 20 \
  --resolve <SNI_DOMAIN>:443:<SERVER_IP> \
  https://<SNI_DOMAIN>/

Result:

TCP connects successfully.
TLS handshake succeeds.
HTTP response is received.

Control test with standalone xray-core:

I downloaded official xray-core Android arm64 binary in Termux:

xray version

Result:

Xray 26.3.27 ... android/arm64

Then I ran the same redacted XRay JSON config manually in Termux:

xray run -config xray_config.json

The redacted config has a local SOCKS inbound:

{
  "log": {
    "loglevel": "error"
  },
  "inbounds": [
    {
      "listen": "127.0.0.1",
      "port": 10808,
      "protocol": "socks",
      "settings": {
        "udp": true
      }
    }
  ],
  "outbounds": [
    {
      "protocol": "vless",
      "settings": {
        "vnext": [
          {
            "address": "<SERVER_IP>",
            "port": 443,
            "users": [
              {
                "id": "<REDACTED_UUID>",
                "flow": "xtls-rprx-vision",
                "encryption": "none"
              }
            ]
          }
        ]
      },
      "streamSettings": {
        "network": "tcp",
        "security": "reality",
        "realitySettings": {
          "fingerprint": "chrome",
          "serverName": "<REDACTED_SNI>",
          "publicKey": "<REDACTED_PUBLIC_KEY>",
          "shortId": "<REDACTED_SHORT_ID>",
          "spiderX": ""
        }
      }
    }
  ]
}

Then I tested traffic through the standalone XRay SOCKS proxy:

curl -4 -v --socks5-hostname 127.0.0.1:10808 \
  --connect-timeout 15 --max-time 30 \
  https://1.1.1.1/cdn-cgi/trace

Result:

TLS handshake succeeds.
HTTP/2 response is received.
Cloudflare trace shows the VPN server IP as the outgoing IP.

Also:

curl -4 -v --socks5-hostname 127.0.0.1:10808 \
  --connect-timeout 15 --max-time 30 \
  https://google.com

Result:

TLS handshake succeeds.
HTTP response is received.

This proves that:

The XRay server is working.
The VLESS/Reality parameters are correct.
The phone can reach the server.
xray-core itself works on the same affected Android device.
The failure appears only when AmneziaVPN tries to expose this as a full-system Android VPN via its VPNService / tun2socks layer.

Expected behavior

After AmneziaVPN shows Connected:

Browser traffic should go through the VPN.
DNS should resolve normally.
HTTP/HTTPS responses should be received.
Public IP should be the VPN server IP.

Log files

I can attach redacted log files.

Relevant Amnezia log excerpt:

Protocol: addAddress: 10.0.42.2/30
Protocol: addDnsServer: /1.0.0.1
Protocol: addDnsServer: /172.29.172.254
Protocol: addRoute: 0.0.0.0/0
Protocol: addRoute: 2000::/3
Protocol: setMtu: 1500
Xray: Run tun2Socks
Xray: Run XRay
Xray: xray 26.2.6
Protocol state changed: CONNECTED

So the UI state becomes CONNECTED, but the data-plane does not work.

I can also attach:

Amnezia Android logs with secrets redacted.
Termux diagnostic output with secrets redacted.
Redacted XRay JSON config.
Output showing standalone xray-core works with the same config.

Sensitive fields are redacted:

UUID
publicKey
shortId
private/access keys
full connection URI
SNI/domain if needed
real server IP if needed

Screenshots

No screenshots are currently attached.

The issue is better demonstrated by logs and Termux diagnostic output.

Desktop (please complete the following information):

Not applicable.

The issue is on Android.

Smartphone (please complete the following information):

Device 1:

Device: OPPO CPH2701
Product: CPH2701RU
Device codename: OP5ECBL1
OS: Android 16 / ColorOS
SDK: 36
ABI: arm64-v8a, armeabi-v7a, armeabi
AmneziaVPN versions tested:
- 4.8.15.x / current version
- 4.8.11.4
- 4.8.10.0

Device 2:

Same OPPO model / same ColorOS generation
Same behavior

Server (please complete the following information):

Hosting: Hetzner VPS
Server OS: unknown / no admin access
Protocol: self-hosted XRay
Transport: TCP
Security: Reality
Proxy protocol: VLESS
Flow: xtls-rprx-vision
Same server works from other devices.
Same server works from the affected OPPO phone when using standalone xray-core in Termux with the same redacted config.

Additional context

The same behavior is reproduced on two identical OPPO phones.

It started on both phones on the same day.

Already tested:

Phone reboot: did not help.
AmneziaVPN reinstall: did not help.
AmneziaVPN 4.8.15.x/current: does not work.
AmneziaVPN 4.8.11.4: does not work.
AmneziaVPN 4.8.10.0: does not work.
Always-on VPN / kill switch disabled: did not help.
Android Private DNS disabled: did not help.
App split tunneling disabled: did not help.
App split tunneling allow-list mode: did not help.
Site/IP split tunneling disabled: did not help.
Manual exclusion of the real XRay endpoint IP: endpoint itself becomes reachable directly, but general VPN traffic still does not work.
The same server works on other devices.
The same config works with standalone xray-core on the affected phone.
Another commercial VPN app (for example BlancVPN) works correctly as a full-system VPN on the same phone.

This does not look like a generic server or XRay configuration problem.

The most likely failing component is AmneziaVPN Android's XRay full-tunnel data-plane, probably around one of these components:

Android VPNService integration
TUN handling
tun2socks
packet forwarding between Android TUN and XRay

The connection state is reported as CONNECTED because local VPN/XRay components start successfully, but packet payload forwarding through the VPN path is broken.

Originally created by @ValitovTimur on GitHub (Jun 6, 2026). Original GitHub issue: https://github.com/amnezia-vpn/amnezia-client/issues/2704 ## Update: root trigger identified and workaround confirmed **Confirmed workaround:** changing the XRay Reality fingerprint from `chrome` to `firefox` immediately restores traffic. Broken configuration: ```json "realitySettings": { "fingerprint": "chrome" } ``` Working configuration: ```json "realitySettings": { "fingerprint": "firefox" } ``` No server-side changes were required. This workaround has now been confirmed on my OPPO CPH2701 as well. Other users in this issue have reported the same general failure on Samsung, Redmi, and Infinix devices. Important control result: * The original configuration with `fingerprint: chrome` still works correctly using standalone Xray-core 26.3.27 in Termux on the same phone. * The same configuration does not pass traffic through AmneziaVPN. * Changing only the fingerprint to `firefox` makes AmneziaVPN work immediately. Therefore, the issue appears to be related specifically to the handling or implementation of the `chrome` Reality/uTLS fingerprint in the XRay version bundled with AmneziaVPN, rather than to the server, routing, DNS, or Android VPNService in general. This is a workaround, not a complete fix: existing profiles using `fingerprint: chrome` can still silently fail while AmneziaVPN reports `Connected`. **Describe the bug** AmneziaVPN on Android shows `Connected` for a self-hosted XRay/VLESS/Reality profile, but the VPN tunnel is not actually usable. The Android VPN interface is created, routes are installed, and Amnezia starts `tun2Socks` and `XRay`. However, real application traffic is blackholed: TCP connect succeeds, but HTTP/TLS payload does not receive any response. The same XRay/VLESS/Reality configuration works correctly when launched manually with standalone `xray-core` inside Termux on the same phone. A different commercial VPN application also works correctly as a full-system VPN on the same device. So this does not look like a server/config/network problem. It looks like an issue in AmneziaVPN Android's XRay/tun2socks/VPNService data-plane on this OPPO / Android 16 device. The issue started suddenly on two identical OPPO phones on the same day. --- **To Reproduce** Steps to reproduce the behavior: 1. Install AmneziaVPN on OPPO CPH2701 / Android 16. 2. Add a self-hosted XRay / VLESS / Reality profile. 3. Disable app split tunneling. 4. Disable site/IP split tunneling. 5. Disable Android Private DNS. 6. Make sure Always-on VPN / kill switch is disabled. 7. Connect to the XRay server. 8. AmneziaVPN UI shows `Connected`. 9. Run diagnostics from Termux. TCP connect succeeds: ```bash nc -vz -w5 1.1.1.1 80 nc -vz -w5 1.1.1.1 443 nc -vz -w5 8.8.8.8 443 ``` Example result: ```text Connection to 1.1.1.1 80 port [tcp/http] succeeded! Connection to 1.1.1.1 443 port [tcp/https] succeeded! Connection to 8.8.8.8 443 port [tcp/https] succeeded! ``` But HTTP/TLS payload does not work: ```bash curl -4 -v --connect-timeout 10 --max-time 20 http://1.1.1.1 ``` Result: ```text * Trying 1.1.1.1:80... * Established connection to 1.1.1.1 from 10.0.42.2 > GET / HTTP/1.1 > Host: 1.1.1.1 > User-Agent: curl/... > Accept: */* * Request completely sent off * Operation timed out after 15003 milliseconds with 0 bytes received ``` HTTPS also fails: ```bash curl -4 -k -v --connect-timeout 10 --max-time 20 https://1.1.1.1/cdn-cgi/trace ``` Result: ```text * Trying 1.1.1.1:443... * TLSv1.3 (OUT), TLS handshake, Client hello (1) * Connection timed out after 10004 milliseconds ``` Raw HTTP over netcat shows the same behavior: ```bash printf 'GET / HTTP/1.0\r\nHost: example.com\r\n\r\n' | nc -v -w10 93.184.216.34 80 ``` Result: ```text Connection to 93.184.216.34 80 port [tcp/http] succeeded! # No HTTP response received ``` UDP DNS also fails: ```bash dig +time=3 +tries=1 @1.1.1.1 google.com ``` Result: ```text no servers could be reached ``` However, this is not only a DNS issue, because direct HTTP/HTTPS to IP addresses also stalls. Control test: the XRay endpoint is reachable from the same phone when AmneziaVPN is disabled: ```bash nc -vz -w5 <SERVER_IP> 443 ``` Result: ```text succeeded ``` TLS/HTTP to the endpoint also works directly: ```bash curl -4 -vk --connect-timeout 10 --max-time 20 \ --resolve <SNI_DOMAIN>:443:<SERVER_IP> \ https://<SNI_DOMAIN>/ ``` Result: - TCP connects successfully. - TLS handshake succeeds. - HTTP response is received. Control test with standalone `xray-core`: I downloaded official `xray-core` Android arm64 binary in Termux: ```bash xray version ``` Result: ```text Xray 26.3.27 ... android/arm64 ``` Then I ran the same redacted XRay JSON config manually in Termux: ```bash xray run -config xray_config.json ``` The redacted config has a local SOCKS inbound: ```json { "log": { "loglevel": "error" }, "inbounds": [ { "listen": "127.0.0.1", "port": 10808, "protocol": "socks", "settings": { "udp": true } } ], "outbounds": [ { "protocol": "vless", "settings": { "vnext": [ { "address": "<SERVER_IP>", "port": 443, "users": [ { "id": "<REDACTED_UUID>", "flow": "xtls-rprx-vision", "encryption": "none" } ] } ] }, "streamSettings": { "network": "tcp", "security": "reality", "realitySettings": { "fingerprint": "chrome", "serverName": "<REDACTED_SNI>", "publicKey": "<REDACTED_PUBLIC_KEY>", "shortId": "<REDACTED_SHORT_ID>", "spiderX": "" } } } ] } ``` Then I tested traffic through the standalone XRay SOCKS proxy: ```bash curl -4 -v --socks5-hostname 127.0.0.1:10808 \ --connect-timeout 15 --max-time 30 \ https://1.1.1.1/cdn-cgi/trace ``` Result: - TLS handshake succeeds. - HTTP/2 response is received. - Cloudflare trace shows the VPN server IP as the outgoing IP. Also: ```bash curl -4 -v --socks5-hostname 127.0.0.1:10808 \ --connect-timeout 15 --max-time 30 \ https://google.com ``` Result: - TLS handshake succeeds. - HTTP response is received. This proves that: - The XRay server is working. - The VLESS/Reality parameters are correct. - The phone can reach the server. - `xray-core` itself works on the same affected Android device. - The failure appears only when AmneziaVPN tries to expose this as a full-system Android VPN via its VPNService / tun2socks layer. --- **Expected behavior** After AmneziaVPN shows `Connected`: - Browser traffic should go through the VPN. - DNS should resolve normally. - HTTP/HTTPS responses should be received. - Public IP should be the VPN server IP. --- **Log files** I can attach redacted log files. Relevant Amnezia log excerpt: ```text Protocol: addAddress: 10.0.42.2/30 Protocol: addDnsServer: /1.0.0.1 Protocol: addDnsServer: /172.29.172.254 Protocol: addRoute: 0.0.0.0/0 Protocol: addRoute: 2000::/3 Protocol: setMtu: 1500 Xray: Run tun2Socks Xray: Run XRay Xray: xray 26.2.6 Protocol state changed: CONNECTED ``` So the UI state becomes `CONNECTED`, but the data-plane does not work. I can also attach: - Amnezia Android logs with secrets redacted. - Termux diagnostic output with secrets redacted. - Redacted XRay JSON config. - Output showing standalone `xray-core` works with the same config. Sensitive fields are redacted: - UUID - publicKey - shortId - private/access keys - full connection URI - SNI/domain if needed - real server IP if needed --- **Screenshots** No screenshots are currently attached. The issue is better demonstrated by logs and Termux diagnostic output. --- **Desktop (please complete the following information):** Not applicable. The issue is on Android. --- **Smartphone (please complete the following information):** Device 1: - Device: OPPO CPH2701 - Product: CPH2701RU - Device codename: OP5ECBL1 - OS: Android 16 / ColorOS - SDK: 36 - ABI: arm64-v8a, armeabi-v7a, armeabi - AmneziaVPN versions tested: - 4.8.15.x / current version - 4.8.11.4 - 4.8.10.0 Device 2: - Same OPPO model / same ColorOS generation - Same behavior --- **Server (please complete the following information):** - Hosting: Hetzner VPS - Server OS: unknown / no admin access - Protocol: self-hosted XRay - Transport: TCP - Security: Reality - Proxy protocol: VLESS - Flow: xtls-rprx-vision - Same server works from other devices. - Same server works from the affected OPPO phone when using standalone `xray-core` in Termux with the same redacted config. --- **Additional context** The same behavior is reproduced on two identical OPPO phones. It started on both phones on the same day. Already tested: - Phone reboot: did not help. - AmneziaVPN reinstall: did not help. - AmneziaVPN 4.8.15.x/current: does not work. - AmneziaVPN 4.8.11.4: does not work. - AmneziaVPN 4.8.10.0: does not work. - Always-on VPN / kill switch disabled: did not help. - Android Private DNS disabled: did not help. - App split tunneling disabled: did not help. - App split tunneling allow-list mode: did not help. - Site/IP split tunneling disabled: did not help. - Manual exclusion of the real XRay endpoint IP: endpoint itself becomes reachable directly, but general VPN traffic still does not work. - The same server works on other devices. - The same config works with standalone `xray-core` on the affected phone. - Another commercial VPN app (for example BlancVPN) works correctly as a full-system VPN on the same phone. This does not look like a generic server or XRay configuration problem. The most likely failing component is AmneziaVPN Android's XRay full-tunnel data-plane, probably around one of these components: - Android VPNService integration - TUN handling - tun2socks - packet forwarding between Android TUN and XRay The connection state is reported as `CONNECTED` because local VPN/XRay components start successfully, but packet payload forwarding through the VPN path is broken.

bsakaguchi commented

2026-10-13 20:38:37 +00:00

Author

Owner

@abramovtv commented on GitHub (Jun 6, 2026):

The same problem on Samsung Galaxy S26 Ultra

@abramovtv commented on GitHub (Jun 6, 2026): The same problem on Samsung Galaxy S26 Ultra

bsakaguchi commented

2026-10-13 20:38:38 +00:00

Author

Owner

@Pawel-Rog commented on GitHub (Jun 6, 2026):

XRay dead too. Redmi

@Pawel-Rog commented on GitHub (Jun 6, 2026): XRay dead too. Redmi

bsakaguchi commented

2026-10-13 20:38:38 +00:00

Author

Owner

@SinTeZWh1te commented on GitHub (Jun 6, 2026):

Same problem.
Infinix Note 30 Pro.
Android 14.

@SinTeZWh1te commented on GitHub (Jun 6, 2026): Same problem. Infinix Note 30 Pro. Android 14.

bsakaguchi commented

2026-10-13 20:38:38 +00:00

Author

Owner

@SinTeZWh1te commented on GitHub (Jun 24, 2026):

Changing fingerprint solved problem

@SinTeZWh1te commented on GitHub (Jun 24, 2026): Changing fingerprint solved problem

bsakaguchi commented

2026-10-13 20:38:39 +00:00

Author

Owner

@ValitovTimur commented on GitHub (Jun 24, 2026):

Confirmed. Thanks, @SinTeZWh1te.

Changing only the Reality fingerprint from:

chrome

to:

firefox

immediately fixed the problem on my OPPO CPH2701 as well. No server-side changes were required.

I have updated the issue description with the confirmed workaround and control-test results.

The original chrome configuration still works with standalone Xray-core 26.3.27 in Termux on the same phone, but does not pass traffic through AmneziaVPN. This strongly narrows the problem down to AmneziaVPN's handling of the chrome Reality/uTLS fingerprint or the bundled XRay version.

Please keep this issue open: firefox is a working workaround, but profiles using chrome can still fail silently while the application reports Connected.

@ValitovTimur commented on GitHub (Jun 24, 2026): Confirmed. Thanks, @SinTeZWh1te. Changing only the Reality fingerprint from: ```text chrome ``` to: ```text firefox ``` immediately fixed the problem on my OPPO CPH2701 as well. No server-side changes were required. I have updated the issue description with the confirmed workaround and control-test results. The original `chrome` configuration still works with standalone Xray-core 26.3.27 in Termux on the same phone, but does not pass traffic through AmneziaVPN. This strongly narrows the problem down to AmneziaVPN's handling of the `chrome` Reality/uTLS fingerprint or the bundled XRay version. Please keep this issue open: `firefox` is a working workaround, but profiles using `chrome` can still fail silently while the application reports `Connected`.

bsakaguchi commented

2026-10-13 20:38:39 +00:00

Author

Owner

@sharkmax888 commented on GitHub (Aug 15, 2026):

I reproduced this on AmneziaVPN 5.0.0.5 for Windows: the same VLESS REALITY configuration reports connected but blackholes DNS and payload traffic with the chrome uTLS fingerprint. Changing only the fingerprint to firefox restores DNS, HTTPS browsing, and traffic through the VPS. I opened draft PR #2989 with a compatibility workaround for new, imported, and existing profiles. This does not claim to fix the underlying bindings/Xray/uTLS cause.

@sharkmax888 commented on GitHub (Aug 15, 2026): I reproduced this on AmneziaVPN 5.0.0.5 for Windows: the same VLESS REALITY configuration reports connected but blackholes DNS and payload traffic with the `chrome` uTLS fingerprint. Changing only the fingerprint to `firefox` restores DNS, HTTPS browsing, and traffic through the VPS. I opened draft PR #2989 with a compatibility workaround for new, imported, and existing profiles. This does not claim to fix the underlying bindings/Xray/uTLS cause.

No labels

pull-request

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

amnezia-vpn/amnezia-client#1228

No description provided.

Rows
Columns