{"record":{"id":"00c22db15130cb3b","repo":"XTLS/Xray-core","slug":"server-rejects-request-resp","errorCode":null,"errorMessage":"server rejects request: {resp}","messagePattern":"server rejects request: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"proxy/socks/protocol.go","lineNumber":514,"sourceCode":"\t\tcommon.Must2(b.Write([]byte{1, 0, 0, 0, 0, 0, 0 /* RFC 1928 */}))\n\t} else {\n\t\tif err := addrParser.WriteAddressPort(b, request.Address, request.Port); err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t}\n\n\tif err := buf.WriteAllBytes(writer, b.Bytes(), nil); err != nil {\n\t\treturn nil, err\n\t}\n\n\tb.Clear()\n\tif _, err := b.ReadFullFrom(reader, 3); err != nil {\n\t\treturn nil, err\n\t}\n\n\tresp := b.Byte(1)\n\tif resp != 0x00 {\n\t\treturn nil, errors.New(\"server rejects request: \", resp)\n\t}\n\n\tb.Clear()\n\n\taddress, port, err := addrParser.ReadAddressPort(b, reader)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tif request.Command == protocol.RequestCommandUDP {\n\t\tudpRequest := &protocol.RequestHeader{\n\t\t\tVersion: socks5Version,\n\t\t\tCommand: protocol.RequestCommandUDP,\n\t\t\tAddress: address,\n\t\t\tPort:    port,\n\t\t}\n\t\treturn udpRequest, nil\n\t}","sourceCodeStart":496,"sourceCodeEnd":532,"githubUrl":"https://github.com/XTLS/Xray-core/blob/7d214f8b094f75322fa3990f8aadad1c912f24f5/proxy/socks/protocol.go#L496-L532","documentation":"Thrown by the Xray SOCKS5 client after sending CONNECT/UDP ASSOCIATE when the server's reply REP field (byte 1 of the response) is non-zero. The numeric value is the RFC 1928 reply code: 1 general failure, 2 rule not allowed, 3 network unreachable, 4 host unreachable, 5 connection refused, 6 TTL expired, 7 command not supported, 8 address type not supported.","triggerScenarios":"Server successfully completed negotiation but refused the request itself: target port blocked by server rules (code 2), target down (code 5), server cannot route IPv6 (code 8), or UDP ASSOCIATE unsupported (code 7).","commonSituations":"Server-side routing rules blocking the destination; destination service actually down; requesting IPv6 targets through an IPv4-only server; trying UDP through a TCP-only SOCKS5 server; server out of file descriptors presenting as code 1.","solutions":["Map the numeric code to the RFC 1928 table to identify the refusal reason first.","Code 2: adjust server routing/firewall rules to permit the destination.","Code 5/3/4: verify the target is reachable from the server itself (curl/nc from the server host).","Code 7: use a SOCKS5 server that supports UDP ASSOCIATE, or switch to a UDP-capable outbound.","Code 8: force IPv4 domain strategy in the outbound settings (domainStrategy: UseIPv4)."],"exampleFix":"// code 8 workaround: force IPv4 resolution on the socks outbound\n// before\n\"streamSettings\": {}, \"settings\": { \"servers\": [ { \"address\": \"s\", \"port\": 1080 } ] }\n\n// after\n\"settings\": { \"servers\": [ { \"address\": \"s\", \"port\": 1080 } ] },\n\"sendThrough\": \"0.0.0.0\",\n// plus routing/outbound domainStrategy set to UseIPv4 so only IPv4 ATYP is sent","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := client.Process(ctx, link, dialer); err != nil {\n\tif msg := err.Error(); strings.Contains(msg, \"server rejects request\") {\n\t\t// parse trailing reply code (1..8) and branch: rule block vs unreachable vs no-UDP\n\t}\n}","preventionTips":["Map RFC 1928 reply codes to runbooks for your ops team.","Maintain a fallback outbound for codes 3/4/5 destinations.","Force an IPv4 domain strategy when the server lacks IPv6 (avoids code 8)."],"tags":["socks","socks5","client","reply-code","connection-refused"],"backgroundTag":null,"analyzedSha":"7d214f8b094f75322fa3990f8aadad1c912f24f5","analyzedAt":"2026-08-15T14:26:24.325Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}