Closed
Description
Describe the bug
Dokodemo Inbound works as a proxy server. it seems that if we provide a sni to the inbound port then the server forwards the connection to the provided sni without any restriction. it looks like a security issue
To Reproduce
Steps to reproduce the behavior:
- First server: Create a dokodemo inbound on port i.e. 443 with whatever target IP you want.(should not be the second server IP)
- Use an existing Vless was tls config. it can be any other protocol with tls security. make sure the config is working fine.
- Change the address in the config to the first server IP address
- make sure the config has a valid sni and host parameter similar to certificates for tls.
- in this case the first server IP address works as clean IP and passes all traffic.
Expected behavior
I expect that Dekodomo only forwards the traffic to the target IP.
it looks like some users scan all Iran VPS providers' IPs, and then use these local IPs as clean IP.
so they can use these IPs and overload the VPS.
we have seen this issue on the latest version of Sanaei but did not check on the Alireza Panel,
the source issue might be from the Xray core.