{"record":{"id":"89cd748ccf5cbe26","repo":"XTLS/Xray-core","slug":"failed-to-create-request-from-remoteaddr","errorCode":null,"errorMessage":"failed to create request from: ${remoteAddr}","messagePattern":"failed to create request from: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"proxy/trojan/server.go","lineNumber":217,"sourceCode":"\t\t\tshouldFallback = true\n\t\t}\n\t}\n\n\tif isfb && shouldFallback {\n\t\treturn s.fallback(ctx, err, sessionPolicy, conn, iConn, napfb, first, firstLen, bufferedReader)\n\t} else if shouldFallback {\n\t\treturn errors.New(\"invalid protocol or invalid user\")\n\t}\n\n\tclientReader := &ConnReader{Reader: bufferedReader}\n\tif err := clientReader.ParseHeader(); err != nil {\n\t\tlog.Record(&log.AccessMessage{\n\t\t\tFrom:   conn.RemoteAddr(),\n\t\t\tTo:     \"\",\n\t\t\tStatus: log.AccessRejected,\n\t\t\tReason: err,\n\t\t})\n\t\treturn errors.New(\"failed to create request from: \", conn.RemoteAddr()).Base(err)\n\t}\n\n\tdestination := clientReader.Target\n\tif err := conn.SetReadDeadline(time.Time{}); err != nil {\n\t\treturn errors.New(\"unable to set read deadline\").Base(err).AtWarning()\n\t}\n\n\tinbound := session.InboundFromContext(ctx)\n\tinbound.Name = \"trojan\"\n\tinbound.CanSpliceCopy = 3\n\tinbound.User = user\n\tsessionPolicy = s.policyManager.ForLevel(user.Level)\n\n\tif destination.Network == net.Network_UDP { // handle udp request\n\t\treturn s.handleUDPPayload(ctx, sessionPolicy, &PacketReader{Reader: clientReader}, &PacketWriter{Writer: conn}, dispatcher)\n\t}\n\n\tctx = log.ContextWithAccessMessage(ctx, &log.AccessMessage{","sourceCodeStart":199,"sourceCodeEnd":235,"githubUrl":"https://github.com/XTLS/Xray-core/blob/7d214f8b094f75322fa3990f8aadad1c912f24f5/proxy/trojan/server.go#L199-L235","documentation":"Returned by the trojan inbound server when ConnReader.ParseHeader() fails while parsing the first bytes of a decrypted TLS payload. ParseHeader expects the fixed trojan layout: 56-byte hex user hash, CRLF, 1-byte command (TCP/UDP), SOCKS-style address+port, CRLF. Any short read, bad address, or non-trojan byte stream produces this error, which also records an AccessRejected log entry before returning.","triggerScenarios":"A TLS client connects to the trojan port but speaks a different protocol (plain HTTP, another proxy protocol), the client sends fewer than 56 bytes and disconnects, the address parser hits a malformed SOCKS address type, or the client trojan implementation writes an invalid header. Raised in Server.handleConnection after the fallback check decided not to fall back.","commonSituations":"Health probes or scanners hitting the trojan port, a client with a password-hash length mismatch, sharing the port with non-trojan clients without configuring fallbacks, or version drift where the client uses a different trojan header variant.","solutions":["Verify the client is a real trojan client and its password matches a configured user (the 56-byte hex SHA-224 of the password must equal a stored key)","If you must share the port with other protocols, configure fallbacks in the trojan inbound so non-trojan traffic is relayed instead of rejected","Check the access log entry (AccessRejected with the Base cause: 'failed to read user hash' vs 'failed to read address and port') to see which header stage failed","Capture the client hello with tcpdump/tls debugging to confirm what bytes actually arrive after TLS termination"],"exampleFix":"// json config: give non-trojan TLS traffic a fallback\n\"inbounds\": [{\n  \"protocol\": \"trojan\",\n  \"port\": 443,\n  \"settings\": {\n    \"clients\": [{\"password\": \"pw\", \"email\": \"a@b.c\"}],\n    \"fallbacks\": [{\"dest\": 8080}]\n  }\n}]","handlingStrategy":"validation","validationCode":"// Pre-accept check: only route real trojan traffic to this inbound; give\n// everything else a fallback. Config-level prevention:\n//   \"fallbacks\": [{\"dest\": 80}]\n// ensures ParseHeader failures fall back instead of surfacing this error.","typeGuard":null,"tryCatchPattern":"if err := s.processConnection(ctx, conn, dispatcher); err != nil {\n    if strings.Contains(err.Error(), \"failed to create request from\") {\n        // non-trojan or garbage TLS payload: log at debug and close\n        errors.LogDebug(ctx, \"non-trojan client: \", err)\n        return\n    }\n    return err\n}","preventionTips":["Configure at least one default fallback so non-trojan TLS clients never reach the ParseHeader error path","Keep client and server trojan protocol versions aligned","Do not point generic health checks at the trojan port; use a separate monitoring port with fallback"],"tags":["trojan","protocol","inbound","tls"],"backgroundTag":null,"analyzedSha":"7d214f8b094f75322fa3990f8aadad1c912f24f5","analyzedAt":"2026-08-15T14:26:24.325Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}