XTLS/Xray-core · error

server rejects request: {resp}

Error message

server rejects request: {resp}

What it means

Thrown by the Xray SOCKS5 client after sending CONNECT/UDP ASSOCIATE when the server's reply REP field (byte 1 of the response) is non-zero. The numeric value is the RFC 1928 reply code: 1 general failure, 2 rule not allowed, 3 network unreachable, 4 host unreachable, 5 connection refused, 6 TTL expired, 7 command not supported, 8 address type not supported.

Source

Thrown at proxy/socks/protocol.go:514

		common.Must2(b.Write([]byte{1, 0, 0, 0, 0, 0, 0 /* RFC 1928 */}))
	} else {
		if err := addrParser.WriteAddressPort(b, request.Address, request.Port); err != nil {
			return nil, err
		}
	}

	if err := buf.WriteAllBytes(writer, b.Bytes(), nil); err != nil {
		return nil, err
	}

	b.Clear()
	if _, err := b.ReadFullFrom(reader, 3); err != nil {
		return nil, err
	}

	resp := b.Byte(1)
	if resp != 0x00 {
		return nil, errors.New("server rejects request: ", resp)
	}

	b.Clear()

	address, port, err := addrParser.ReadAddressPort(b, reader)
	if err != nil {
		return nil, err
	}

	if request.Command == protocol.RequestCommandUDP {
		udpRequest := &protocol.RequestHeader{
			Version: socks5Version,
			Command: protocol.RequestCommandUDP,
			Address: address,
			Port:    port,
		}
		return udpRequest, nil
	}

View on GitHub (pinned to 7d214f8b09)

Solutions

1. Map the numeric code to the RFC 1928 table to identify the refusal reason first.
2. Code 2: adjust server routing/firewall rules to permit the destination.
3. Code 5/3/4: verify the target is reachable from the server itself (curl/nc from the server host).
4. Code 7: use a SOCKS5 server that supports UDP ASSOCIATE, or switch to a UDP-capable outbound.
5. Code 8: force IPv4 domain strategy in the outbound settings (domainStrategy: UseIPv4).

Example fix

// code 8 workaround: force IPv4 resolution on the socks outbound
// before
"streamSettings": {}, "settings": { "servers": [ { "address": "s", "port": 1080 } ] }

// after
"settings": { "servers": [ { "address": "s", "port": 1080 } ] },
"sendThrough": "0.0.0.0",
// plus routing/outbound domainStrategy set to UseIPv4 so only IPv4 ATYP is sent

if err := client.Process(ctx, link, dialer); err != nil {
	if msg := err.Error(); strings.Contains(msg, "server rejects request") {
		// parse trailing reply code (1..8) and branch: rule block vs unreachable vs no-UDP
	}
}

When it happens

Trigger: Server successfully completed negotiation but refused the request itself: target port blocked by server rules (code 2), target down (code 5), server cannot route IPv6 (code 8), or UDP ASSOCIATE unsupported (code 7).

Common situations: Server-side routing rules blocking the destination; destination service actually down; requesting IPv6 targets through an IPv4-only server; trying UDP through a TCP-only SOCKS5 server; server out of file descriptors presenting as code 1.

Related errors

• unexpected server version: {version}
• server rejects account: {code}
• failed to read auth methods
• no matching auth method
• failed to write auth response

AI-assisted analysis of XTLS/Xray-core@7d214f8b09 (2026-08-15). Data as JSON: /api/errors/00c22db15130cb3b. Report an issue: GitHub.