Add xray/v2ray-plugin IP forwarding for fail2ban compatibility

Author: ohshitgorillasCreated Oct 10, 2025Updated Jun 17, 2026
Labelsenhancement

When running shadowsocks-libev with a plugin (e.g., xray-plugin, v2ray-plugin), all authentication failures are logged with 127.0.0.1 as the source IP, with the offending address on a separate line, making it exceptionally difficult to use fail2ban or similar tools for brute force protection:

2025/10/11 04:45:59 from tcp:172.56.170.224:35098 accepted tcp:127.0.0.1:0
 2025-10-11 04:45:59 ERROR: failed to handshake with 127.0.0.1: authentication error

The plugin sees real client IPs, but shadowsocks only sees localhost connections forwarded by the plugin.

Please ensure that plugins can properly pass along client IP information for more accurate authentication error logging.

Source: shadowsocks/shadowsocks-libev