Multi-hop vless proxy not working

Operating system

macOS

System version

26.6.2

Installation type

sing-box for macOS Graphical Client

If you are using a graphical client, please provide the version of the client.

Версия 1.14.0 (1)

Version

Description

I try to setup a multi-hop vless, having one VPS as entry in one country, and second VPS - on another as exit.
I setup my client config going for exit outbound server, which has "detour": "to-intermediate".

And i see that my connection to intermediate is working, while connection for exit server is broken, and logs has such message:

15:23:12 ERROR [2397291312 15.2s] inbound/vless[vless-in]: process connection from xxx:37378: TLS handshake: REALITY: processed invalid connection

All sing-box instances at client and VPS are 1.14.0

Reproduction

{
"dns": {
"servers": [
{
"type": "https",
"tag": "dns-doh",
"server": "1.1.1.1",
"path": "/dns-query",
"tls": {
"enabled": true,
"server_name": "one.one.one.one"
}
},
{
"type": "udp",
"tag": "dns-udp",
"server": "1.1.1.1"
}
],
"strategy": "prefer_ipv4",
"final": "dns-doh",
"reverse_mapping": true
},
"inbounds": [
{
"type": "tun",
"tag": "tun-in",
"address": [
"172.19.0.1/30"
],
"auto_route": true,
"strict_route": true,
"stack": "system"
},
{
"type": "mixed",
"tag": "mixed-in",
"listen": "127.0.0.1",
"listen_port": 7890
}
],
"outbounds": [
{
"type": "direct",
"tag": "direct"
},
{
"type": "vless",
"tag": "to-intermediate",
"server": "xxx",
"server_port": 443,
"uuid": "xxx",
"flow": "xtls-rprx-vision",
"tls": {
"enabled": true,
"insecure": false,
"server_name": "vk.com",
"utls": {
"enabled": true,
"fingerprint": "chrome"
},
"reality": {
"enabled": true,
"public_key": "xxx",
"short_id": "xxx"
}
},
"domain_resolver": {
"server": "dns-doh",
"strategy": "prefer_ipv4"
}
},
{
"type": "vless",
"tag": "to-exit",
"server": "xxx",
"server_port": 443,
"uuid": "xxx",
"flow": "xtls-rprx-vision",
"detour": "to-intermediate",
"tls": {
"enabled": true,
"server_name": "www.cloudflare.com",
"utls": {
"enabled": true,
"fingerprint": "chrome"
},
"reality": {
"enabled": true,
"public_key": "xxx",
"short_id": "xxx"
}
}
},
],
"route": {
"auto_detect_interface": true,
"default_domain_resolver": {
"server": "dns-doh",
"strategy": "prefer_ipv4"
},
"rule_set": [
{
"type": "remote",
"tag": "geosite-category-ru",
"format": "binary",
"url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-category-ru.srs",
"download_detour": "direct",
"update_interval": "24h"
},
{
"type": "remote",
"tag": "geoip-ru",
"format": "binary",
"url": "https://raw.githubusercontent.com/SagerNet/sing-geoip/rule-set/geoip-ru.srs",
"download_detour": "direct",
"update_interval": "24h"
}
],
"rules": [
{
"action": "sniff",
"sniffer": [
"tls",
"http",
"quic"
],
"timeout": "1s"
},
{
"action": "resolve",
"strategy": "prefer_ipv4"
},
{
"protocol": "dns",
"action": "hijack-dns"
},
{
"ip_is_private": true,
"action": "route",
"outbound": "direct"
},
{
"rule_set": "geoip-ru",
"action": "route",
"outbound": "direct"
}
],
"final": "to-exit"
}
}

Logs

Supporter

• I am a sponsor

Integrity requirements

• I confirm that I have read the documentation, understand the meaning of all the configuration items I wrote, and did not pile up seemingly useful options or default values.
• I confirm that I have provided the server and client configuration files and process that can be reproduced locally, instead of a complicated client configuration file that has been stripped of sensitive data.
• I confirm that I have provided the simplest configuration that can be used to reproduce the error I reported, instead of depending on remote servers, TUN, graphical interface clients, or other closed-source software.
• I confirm that I have provided the complete configuration files and logs, rather than just providing parts I think are useful out of confidence in my own intelligence.

Start by reproducing the multi-hop configuration using the to-intermediate detour and the VLESS/REALITY settings shown in the issue, then trace the exit connection through the VLESS outbound and the inbound/vless REALITY handshake. Done means the intermediate connection remains usable and the exit server completes its handshake without the reported “processed invalid connection” error.