skills.rest
pyworkload
pyworkloadCOMMUNITY
Explore all skills by this author →
GitHub

cdn-fallback

Configure 3x-ui inbounds behind a CDN or share port 443 using Xray fallbacks.

5|3|Updated Apr 11, 2026
Search Tags:#cloudflare#cdn#websocket#fallbacks#xray#3x-ui#vless
One-click install
npx skills add https://github.com/pyworkload/3x-ui-mcp --skill cdn-fallback-pyworkload
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: cdn-fallback
Source: https://github.com/pyworkload/3x-ui-mcp/tree/main/skills/cdn-fallback
Command: npx skills add https://github.com/pyworkload/3x-ui-mcp --skill cdn-fallback-pyworkload

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? When REALITY is blocked or the server IP must stay hidden, proxy operators need to front 3x-ui inbounds with a CDN like Cloudflare, or let several protocols share port 443 through Xray fallbacks — both of which involve subtle configuration traps that silently break clients. ## Core Features & Use Cases - CDN fronting: Create WebSocket, gRPC, or xhttp VLESS inbounds on CDN-proxied ports (443, 2053, 2083, 2087, 2096, 8443) and publish correct client links via host groups. - Port sharing with fallbacks: Configure a master TLS inbound on 443 that routes by path or ALPN to child inbounds on localhost, with PROXY protocol (xver: 2) preserving real client IPs. - Trap avoidance: Warns against xtls-rprx-vision flow on non-TCP clients, non-atomic fallback list replacement, Xray restarts dropping connections, and REALITY behind a CDN. - Use Case: Put a VLESS WebSocket inbound behind Cloudflare on port 2053, attach a host group so subscription links point at the CDN hostname, and verify with get_all_inbound_links. ## Quick Start Ask the agent to create a VLESS WebSocket inbound on port 2053 behind Cloudflare and publish it through a host group so client links use the CDN hostname.

Frequently Asked Questions about cdn-fallback

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I put a 3x-ui inbound behind Cloudflare?▼

Create a VLESS inbound with WebSocket, gRPC, or xhttp transport on a Cloudflare-proxied port such as 443, 2053, 2083, 2087, 2096, or 8443. Then attach a host group so generated subscription links advertise the CDN hostname instead of the origin IP.

How do I share port 443 between multiple Xray inbounds?▼

Use set_inbound_fallbacks on a master VLESS or Trojan TLS inbound to route by path or ALPN to child inbounds listening on 127.0.0.1. The call replaces the entire fallback list and restarts Xray, so read the current list first and plan for dropped connections.

Can REALITY be used behind a CDN?▼

No, REALITY cannot be CDN-fronted because it impersonates another site's TLS while the CDN terminates TLS itself. CDN fronting requires a real domain and certificate you control, using WebSocket, gRPC, or xhttp transports.

Why do clients fail to connect with xtls-rprx-vision flow on WebSocket?▼

The xtls-rprx-vision flow is valid only on TCP-based VLESS inbounds. Setting it on a ws, grpc, or xhttp client produces a connection failure that looks like a broken server, so omit the flow field for those transports.

Why do all fallback clients appear as 127.0.0.1?▼

The fallback entry is missing xver: 2, which forwards the real client address over PROXY protocol. Without it, per-client IP limits, fail2ban, and IP logs all see localhost; only values 0, 1, and 2 are accepted.

Related Skills

Explore More Software Engineering Skills→
flavien-iaflavien-ia
34

_dns-ionos-manual

Guide manual nameserver updates for IONOS domains to enable Cloudflare delegation.

Community
Intermediate
prompt-securityprompt-security
1.1k

openclaw-traffic-guardian

Defines an opt-in OpenClaw traffic monitoring baseline for detecting exfiltration, injection, and social-account mutations.

Official
Basic
intrusive-memoryintrusive-memory

Podcast Validation

Validates podcast CDN audio files and website link integrity.

Official
Intermediate
lawnvilawnvi

create-singbox-vpn

Deploy Sing-box VPN nodes with VLESS Reality via Docker Compose on Linux servers.

Community
Advanced