XTLS/Xray-core · info

XUDP rejected UDP/443 traffic

Error message

XUDP rejected UDP/443 traffic

What it means

An info-level error deliberately constructed (AtInfo) by the outbound handler when a UDP connection targeting port 443 (typical QUIC traffic) arrives at a handler with mux enabled and the udp443 policy set to 'reject'. It is fed through the mux test() closure, so it is reported as 'failed to process mux outbound traffic' with this message as the cause, and the connection is intentionally terminated. This is policy behavior, not a malfunction.

Source

Thrown at app/proxyman/outbound/handler.go:224

	}
	if ob.Target.Network == net.Network_UDP && ob.OriginalTarget.Address != nil && ob.OriginalTarget.Address != ob.Target.Address {
		link.Reader = &buf.EndpointOverrideReader{Reader: link.Reader, Dest: ob.Target.Address, OriginalDest: ob.OriginalTarget.Address}
		link.Writer = &buf.EndpointOverrideWriter{Writer: link.Writer, Dest: ob.Target.Address, OriginalDest: ob.OriginalTarget.Address}
	}
	if h.mux != nil {
		test := func(err error) {
			if err != nil {
				err := errors.New("failed to process mux outbound traffic").Base(err)
				session.SubmitOutboundErrorToOriginator(ctx, err)
				errors.LogInfo(ctx, err.Error())
				common.Interrupt(link.Writer)
				common.Interrupt(link.Reader)
			}
		}
		if ob.Target.Network == net.Network_UDP && ob.Target.Port == 443 {
			switch h.udp443 {
			case "reject":
				test(errors.New("XUDP rejected UDP/443 traffic").AtInfo())
				return
			case "skip":
				goto out
			}
		}
		if h.xudp != nil && ob.Target.Network == net.Network_UDP {
			if !h.xudp.Enabled {
				goto out
			}
			test(h.xudp.Dispatch(ctx, link))
			return
		}
		if h.mux.Enabled {
			test(h.mux.Dispatch(ctx, link))
			return
		}
	}
out:

View on GitHub (pinned to 7d214f8b09)

Solutions

1. If QUIC passthrough is wanted, remove the udp443 option or set it to 'skip' so UDP/443 bypasses mux instead of being killed.
2. If rejection is intended but noisy, expect these info logs and optionally lower log level to warning to silence them.
3. Alternatively block QUIC at the client/browser (e.g. chrome://flags disable QUIC) so traffic never reaches the proxy.

Example fix

// before
"streamSettings": { "udp443": "reject" }

// after
"streamSettings": { "udp443": "skip" } // or remove the field entirely

// Policy check before dispatching QUIC-looking traffic to a mux handler
if isUDP && port == 443 && muxEnabled(handler) && udp443Policy(handler) == "reject" {
    return sendICMPPortUnreachable(conn) // or answer locally; do not forward into the handler
}

// This is intentional policy: detect and treat as silent drop
if err := dispatch(ctx, link); err != nil {
    if strings.Contains(err.Error(), "XUDP rejected UDP/443") {
        return nil // expected rejection, not a failure to report
    }
    return err
}

When it happens

Trigger: ob.Target.Network == net.Network_UDP && ob.Target.Port == 443 while h.mux != nil and the handler's udp443 setting equals the string "reject". The connection is then interrupted and dispatch returns.

Common situations: Users add udp443:'reject' (or a template/ GUI default does) to stop QUIC so browsers fall back to TCP and can be routed/sniffed; browsers like Chrome then trigger this on every QUIC attempt, flooding logs. Also seen when users confuse it with xudp settings and wonder why YouTube/HTTP3 breaks.

Related errors

• failed to process mux outbound traffic
• failed to create mux client worker
• failed to create portal worker
• empty worker list
• no mux client worker available

AI-assisted analysis of XTLS/Xray-core@7d214f8b09 (2026-08-15). Data as JSON: /api/errors/b91bda4a9639a595. Report an issue: GitHub.