invalid request version

[AmoAlireza]

this is normal? it's like someone trying to connect and bypass the request version!
if anybody know something about it tell me how to fix it 🤍

all these IPs reported as abuse btw.

2024/06/24 10:32:45 167.94.145.109:54028 rejected proxy/vless/encoding: invalid request version
2024/06/24 10:32:48 167.94.145.109:54032 rejected proxy/vless/encoding: invalid request version
2024/06/24 12:06:11 206.168.34.63:48140 rejected proxy/vless/encoding: invalid request version
2024/06/24 12:06:14 206.168.34.63:48146 rejected proxy/vless/encoding: invalid request version
2024/06/24 12:45:14 165.227.172.206:60984 rejected proxy/vless/encoding: invalid request version
2024/06/24 12:53:51 157.245.222.108:33196 rejected proxy/vless/encoding: invalid request version
2024/06/24 16:38:00 199.45.154.158:46230 rejected proxy/vless/encoding: invalid request version
2024/06/24 16:38:04 199.45.154.158:46232 rejected proxy/vless/encoding: invalid request version
2024/06/24 19:55:44 104.37.174.65:55560 rejected proxy/vless/encoding: invalid request version
2024/06/24 22:12:16 157.245.222.108:42930 rejected proxy/vless/encoding: invalid request version
2024/06/24 22:37:51 147.182.241.81:47392 rejected proxy/vless/encoding: invalid request version
2024/06/25 01:11:12 162.142.125.32:52044 rejected proxy/vless/encoding: invalid request version
2024/06/25 01:11:16 162.142.125.32:45570 rejected proxy/vless/encoding: invalid request version
2024/06/25 02:33:45 64.225.74.178:36884 rejected proxy/vless/encoding: invalid request version
2024/06/25 02:55:56 134.209.95.237:54572 rejected proxy/vless/encoding: invalid request version
2024/06/25 03:49:15 198.235.24.90:61918 rejected proxy/vless/encoding: invalid request version
2024/06/25 03:49:16 198.235.24.90:61930 rejected proxy/vless/encoding: invalid request version
2024/06/25 04:53:11 71.6.146.186:46148 rejected proxy/vless/encoding: invalid request version
2024/06/25 06:35:03 45.156.128.106:34854 rejected proxy/vless/encoding: invalid request version
2024/06/25 06:35:10 45.156.128.106:40362 rejected proxy/vless/encoding: invalid request version
2024/06/25 06:35:10 45.156.128.106:40402 rejected proxy/vless/encoding: invalid request version
2024/06/25 06:56:54 205.210.31.234:58694 rejected proxy/vless/encoding: invalid request version
2024/06/25 06:56:55 205.210.31.234:58696 rejected proxy/vless/encoding: invalid request version
2024/06/25 07:05:37 212.70.149.146:64537 rejected proxy/vless/encoding: invalid request version
2024/06/25 07:16:59 212.70.149.146:65058 rejected proxy/vless/encoding: invalid request version
2024/06/25 07:27:40 212.70.149.146:63628 rejected proxy/vless/encoding: invalid request version

[mmmray]

can you say what kind of config you are running? vless+?

if it is simple vless+tls, this kind of error can be triggered by attempting to talk any other protocol (like http) to the server, and if this is true, it is just a random scanner.

I think this is very likely because of the entry in abuse DB. Things like active probing typically don't show up in Abuse DB.

If you want to investigate further, tcpdump can be your friend, but you have to somehow run it without TLS.

[AmoAlireza]

hi @mmmray
i using marzban and i have 2 kind vless config, 1-simple vless+tcp 2-CDN vless+ws+tls.

if it's random scanner and not make any problem so that's fine.

{
      "tag": "TUNNEL",
      "listen": "0.0.0.0",
      "port": 1000,
      "protocol": "vless",
      "settings": {
        "clients": [],
        "decryption": "none"
      },
      "streamSettings": {
        "network": "tcp",
        "security": "none",
        "tcpSettings": {
          "acceptProxyProtocol": false,
          "header": {
            "type": "none"
          }
        }
      },
      "sniffing": {
        "enabled": true,
        "destOverride": [
          "http",
          "tls",
          "fakedns",
          "quic"
        ]
      }
    },

{
      "tag": "CDN",
      "listen": "0.0.0.0",
      "port": 2096,
      "protocol": "vless",
      "settings": {
        "clients": [],
        "decryption": "none"
      },
      "sniffing": {
        "destOverride": [
          "http",
          "tls",
          "quic",
          "fakedns"
        ],
        "enabled": true,
        "metadataOnly": false,
        "routeOnly": false
      },
      "streamSettings": {
        "network": "ws",
        "security": "tls",
        "tlsSettings": {
          "certificates": [
            {
              "certificateFile": "/var/lib/marzban/certs/public.pem",
              "keyFile": "/var/lib/marzban/certs/private.pem",
              "ocspStapling": 3600,
              "oneTimeLoading": false,
              "usage": "encipherment"
            }
          ],
          "cipherSuites": "",
          "disableSystemRoot": false,
          "enableSessionResumption": false,
          "maxVersion": "1.3",
          "minVersion": "1.2",
          "rejectUnknownSni": true,
          "serverName": ""
        },
        "wsSettings": {
          "acceptProxyProtocol": false,
          "headers": {
            "host": ""
          },
          "host": "",
          "path": "/cfconn"
        }
      }
    },

[mmmray]

I think it can be triggered on vless+tcp if you attempt to curl this port, like curl http://MYIP:1000

in any case it's probably not worth worrying about.

[PalmTamino]

hi @mmmray i using marzban and i have 2 kind vless config, 1-simple vless+tcp 2-CDN vless+ws+tls.

if it's random scanner and not make any problem so that's fine.

{
      "tag": "TUNNEL",
      "listen": "0.0.0.0",
      "port": 1000,
      "protocol": "vless",
      "settings": {
        "clients": [],
        "decryption": "none"
      },
      "streamSettings": {
        "network": "tcp",
        "security": "none",
        "tcpSettings": {
          "acceptProxyProtocol": false,
          "header": {
            "type": "none"
          }
        }
      },
      "sniffing": {
        "enabled": true,
        "destOverride": [
          "http",
          "tls",
          "fakedns",
          "quic"
        ]
      }
    },

{
      "tag": "CDN",
      "listen": "0.0.0.0",
      "port": 2096,
      "protocol": "vless",
      "settings": {
        "clients": [],
        "decryption": "none"
      },
      "sniffing": {
        "destOverride": [
          "http",
          "tls",
          "quic",
          "fakedns"
        ],
        "enabled": true,
        "metadataOnly": false,
        "routeOnly": false
      },
      "streamSettings": {
        "network": "ws",
        "security": "tls",
        "tlsSettings": {
          "certificates": [
            {
              "certificateFile": "/var/lib/marzban/certs/public.pem",
              "keyFile": "/var/lib/marzban/certs/private.pem",
              "ocspStapling": 3600,
              "oneTimeLoading": false,
              "usage": "encipherment"
            }
          ],
          "cipherSuites": "",
          "disableSystemRoot": false,
          "enableSessionResumption": false,
          "maxVersion": "1.3",
          "minVersion": "1.2",
          "rejectUnknownSni": true,
          "serverName": ""
        },
        "wsSettings": {
          "acceptProxyProtocol": false,
          "headers": {
            "host": ""
          },
          "host": "",
          "path": "/cfconn"
        }
      }
    },

Hey, I also have the issue:
2025/01/10 18:27:04 from 162.158.155.14:61090 rejected proxy/vless/encoding: invalid request version

did you find any solution to this problem?