invalid PROXY protocol version, "xver" only accepts 0, 1, 2

Error message

invalid PROXY protocol version, "xver" only accepts 0, 1, 2

What it means

Thrown by the REALITY builder when xver (PROXY protocol version for the target connection) exceeds 2. Only 0 (disabled), 1 (PROXY v1 text) and 2 (PROXY v2 binary) exist; the field is an int so negatives/other values signal a config mistake.

Source

Thrown at infra/conf/transport_security.go:92

				if s[0] == '@' && len(s) > 1 && s[1] == '@' && (runtime.GOOS == "linux" || runtime.GOOS == "android") {
					fullAddr := make([]byte, len(syscall.RawSockaddrUnix{}.Path)) // may need padding to work with haproxy
					copy(fullAddr, s[1:])
					s = string(fullAddr)
				}
			default:
				if _, err = strconv.Atoi(s); err == nil {
					s = "localhost:" + s
				}
				if _, _, err = net.SplitHostPort(s); err == nil {
					c.Type = "tcp"
				}
			}
		}
		if c.Type == "" {
			return nil, errors.New(`please fill in a valid value for "target"`)
		}
		if c.Xver > 2 {
			return nil, errors.New(`invalid PROXY protocol version, "xver" only accepts 0, 1, 2`)
		}
		if len(c.ServerNames) == 0 {
			return nil, errors.New(`empty "serverNames"`)
		}
		if c.PrivateKey == "" {
			return nil, errors.New(`empty "privateKey"`)
		}
		if config.PrivateKey, err = base64.RawURLEncoding.DecodeString(c.PrivateKey); err != nil || len(config.PrivateKey) != 32 {
			return nil, errors.New(`invalid "privateKey": `, c.PrivateKey)
		}
		if c.MinClientVer != "" {
			config.MinClientVer = make([]byte, 3)
			var u uint64
			for i, s := range strings.Split(c.MinClientVer, ".") {
				if i == 3 {
					return nil, errors.New(`invalid "minClientVer": `, c.MinClientVer)
				}
				if u, err = strconv.ParseUint(s, 10, 8); err != nil {

View on GitHub (pinned to 7d214f8b09)

Solutions

Set xver to 0, 1, or 2 (0 unless the target explicitly expects PROXY protocol).
Confirm the target service actually speaks PROXY protocol before setting 1/2.

Example fix

// before
"xver": 3
// after
"xver": 0

Defensive patterns

Strategy: validation

Validate before calling

if reality.Xver > 2 {
    return fmt.Errorf("xver %d invalid: only 0, 1, 2 allowed", reality.Xver)
}

Prevention

Treat xver as an enum {0,1,2}, not a free-form int.
Set 0 unless the target service is PROXY-protocol-aware.

When it happens

Trigger: Setting realitySettings.xver to 3 or higher.

Common situations: Confusing xver with a boolean or a protocol version like TLS 1.3; copy-paste from another server's HAProxy config where version numbers differ.

Related errors

AI-assisted analysis of XTLS/Xray-core@7d214f8b09 (2026-08-15). Data as JSON: /api/errors/6ef293876cf519c0. Report an issue: GitHub.