XTLS/Xray-core · error

UDP is not enabled.

Error message

UDP is not enabled.

What it means

Thrown in handshake5 (proxy/socks/protocol.go:174) when a client sends CMD=0x03 (UDP ASSOCIATE) but the inbound's ServerConfig.UdpEnabled is false. The server replies with statusCmdNotSupport and rejects the request: the inbound was configured without UDP support.

Source

Thrown at proxy/socks/protocol.go:174

			buffer.Release()
			return nil, nil, errors.New("failed to read request").Base(err)
		}
		cmd = buffer.Byte(1)
		buffer.Release()
	}

	request := new(protocol.RequestHeader)
	if username != "" {
		request.User = &protocol.MemoryUser{Email: username}
	}
	switch cmd {
	case cmdTCPConnect, cmdTorResolve, cmdTorResolvePTR:
		// We don't have a solution for Tor case now. Simply treat it as connect command.
		request.Command = protocol.RequestCommandTCP
	case cmdUDPAssociate:
		if !s.config.UdpEnabled {
			writeSocks5Response(writer, statusCmdNotSupport, net.AnyIP, net.Port(0))
			return nil, nil, errors.New("UDP is not enabled.")
		}
		request.Command = protocol.RequestCommandUDP
	case cmdTCPBind:
		writeSocks5Response(writer, statusCmdNotSupport, net.AnyIP, net.Port(0))
		return nil, nil, errors.New("TCP bind is not supported.")
	default:
		writeSocks5Response(writer, statusCmdNotSupport, net.AnyIP, net.Port(0))
		return nil, nil, errors.New("unknown command ", cmd)
	}

	request.Version = socks5Version

	addr, port, err := addrParser.ReadAddressPort(nil, reader)
	if err != nil {
		return nil, nil, errors.New("failed to read address").Base(err)
	}
	request.Address = addr
	request.Port = port

View on GitHub (pinned to 7d214f8b09)

Solutions

1. Add "udp": true to the socks inbound settings in config.json and restart/reload Xray.
2. Verify the outbound(s) used by routing also support UDP (e.g. freedom, vmess, vless generally do).
3. If UDP must stay disabled, configure the client application to not use the proxy for UDP traffic.

Example fix

// before
{ "inbounds": [{ "port": 1080, "protocol": "socks", "settings": { "auth": "noauth" } }] }

// after
{ "inbounds": [{ "port": 1080, "protocol": "socks", "settings": { "auth": "noauth", "udp": true } }] }

// Client-side / deployment check: confirm the inbound allows UDP before issuing UDP ASSOCIATE
if appNeedsUDP && !inboundSettings.UDP {
    return fmt.Errorf("SOCKS inbound has udp=false; enable \"udp\": true or route UDP directly")
}

if err != nil && strings.Contains(err.Error(), "UDP is not enabled") {
    return fmt.Errorf("server rejected UDP ASSOCIATE: set \"udp\": true on the socks inbound")
}

When it happens

Trigger: Inbound socks config lacks "udp": true while the client (browser with DNS-over-proxy, game, VoIP app) issues UDP ASSOCIATE; also tproxy/transparent setups that rely on SOCKS UDP.

Common situations: Default inbound templates that omit the udp field; switching a client from TCP-only to full proxying; forgetting that the remote outbound also needs UDP capability for end-to-end UDP.

Related errors

• no matching auth method
• invalid username or password
• failed to create UDP listener
• SOCKS servers: "users" should have one member at most. Multi
• failed to parse Socks user

AI-assisted analysis of XTLS/Xray-core@7d214f8b09 (2026-08-15). Data as JSON: /api/errors/ed0846dd6a71e3bf. Report an issue: GitHub.