When running shadowsocks-libev with a plugin (e.g., xray-plugin, v2ray-plugin), all authentication failures are logged with 127.0.0.1 as the source IP, with the offending address on a separate line, making it exceptionally difficult to use fail2ban or similar tools for brute force protection:
2025/10/11 04:45:59 from tcp:172.56.170.224:35098 accepted tcp:127.0.0.1:0
2025-10-11 04:45:59 ERROR: failed to handshake with 127.0.0.1: authentication error
The plugin sees real client IPs, but shadowsocks only sees localhost connections forwarded by the plugin.
Please ensure that plugins can properly pass along client IP information for more accurate authentication error logging.
When running shadowsocks-libev with a plugin (e.g., xray-plugin, v2ray-plugin), all authentication failures are logged with 127.0.0.1 as the source IP, with the offending address on a separate line, making it exceptionally difficult to use fail2ban or similar tools for brute force protection:
The plugin sees real client IPs, but shadowsocks only sees localhost connections forwarded by the plugin.
Please ensure that plugins can properly pass along client IP information for more accurate authentication error logging.