# Trojan monitoring

To monitor a Trojan server, complete a real Trojan handshake: a TLS connection, then the password that only a Trojan server accepts. TunnelHQ does that from outside every 1 to 5 minutes by plan, and alerts you in 20 channels when it fails.

[Start Free Trial](https://app.tunnelhq.com/register) [View the API docs](https://docs.tunnelhq.com/api/)

TunnelHQ checks Trojan and Trojan-Go servers. It auto-detects `trojan://` links, performs actual TLS handshakes with password verification, and supports WebSocket, gRPC and raw TCP transports.

## Why Trojan needs specialized monitoring

Trojan's entire design goal is to look exactly like normal HTTPS traffic. This is excellent for users but terrible for generic uptime monitors.

The whole protocol works by:

-   Client opens a standard TLS connection to the server on port 443
-   After the TLS handshake completes, client sends a password hash as the first bytes
-   If the password matches, the server treats the connection as a SOCKS5-like tunnel
-   If the password is wrong or missing, the server transparently proxies the traffic to a fallback web server. So to the outside world it looks identical to any HTTPS site

This means any TLS probe succeeds. You always get a valid handshake. Generic uptime monitors will report "up" whether the Trojan process is actually running or not. If Trojan has crashed but nginx is still serving the fallback website on 443, a port monitor says "up"; your Trojan users see failed connections.

TunnelHQ performs the actual Trojan password authentication handshake and verifies that you're connecting to a real Trojan server, not just a fallback website.

## URI auto-detection

Paste any standard Trojan URI and TunnelHQ parses the config automatically:

```
trojan://password@vpn.yourdomain.com:443?
  security=tls&
  sni=vpn.yourdomain.com&
  type=ws&
  path=/tunnel&
  host=vpn.yourdomain.com#Production-Trojan
```

From this, TunnelHQ extracts:

-   Password (URL-decoded)
-   Endpoint (`vpn.yourdomain.com:443`)
-   SNI and ALPN values
-   Transport (`tcp`, `ws`, `grpc`)
-   WebSocket path and Host header (if transport is ws)
-   gRPC service name (if transport is grpc)

## Trojan vs Trojan-Go

Trojan-Go is a Go implementation with additional features (multiplexing via Mux, Shadowsocks-style AEAD fallback, WebSocket/gRPC transports). TunnelHQ handles both:

-   **Classic Trojan** (C++ original): Raw TLS + password auth
-   **Trojan-Go**: Classic Trojan plus WebSocket transport with path routing, gRPC transport, Mux multiplexing

## Common Trojan failure modes TunnelHQ catches

-   Password rotation without client update
-   TLS certificate expiry on the server
-   SNI mismatch after domain rename
-   Trojan-Go process crashed but fallback web server still running on 443
-   WebSocket path renamed on server, old path now hits fallback
-   gRPC service name rotated
-   Certificate chain rebuilt without intermediate cert

## What a failed check tells you

A failed check comes with a message that says where to look. For Trojan, as for the other V2Ray and Xray share-link protocols, there are two to know.

-   **Tunnel established - Internet is stuck.** The proxy connection worked, but traffic through it didn't reach the internet. Check the server's routing and NAT, its DNS, and whether its outbound traffic is blocked.
-   **Tunnel unreachable.** The connection didn't come up. Check that the server is running, that the host and port in the link are reachable, and that the link's credentials and transport settings (such as `security`, `sni`, and `type`) match the server's.

## Pricing for Trojan monitoring

All plans include Trojan monitoring.

| Plan | Tunnels | Check interval | Price |
| --- | --- | --- | --- |
| Free trial | 14 days free on every plan. Your card is charged on day 15, and you can cancel any time before. |
| Starter | 20 | 5 min | $12/mo or $84/yr |
| Pro | 100 | 2 min | $39/mo or $276/yr |
| Business | 500 | 1 min | $99/mo or $756/yr |

[See the full plan comparison](https://tunnelhq.com/pricing/)

[Start Free Trial](https://app.tunnelhq.com/register) [Test a config free](https://tunnelhq.com/test/)

## Read more

-   [Trojan in the docs](https://docs.tunnelhq.com/protocols/v2ray-xray/)
-   [Monitoring V2Ray subscription URLs in production](https://tunnelhq.com/blog/monitoring-v2ray-subscription-urls/)
-   [VLESS monitoring](https://tunnelhq.com/vless-monitoring/)

## Trojan monitoring questions

### Can I monitor a Trojan server behind Cloudflare?

Yes for WebSocket-over-TLS Trojan. Cloudflare proxies WS fine. For raw TLS Trojan, Cloudflare terminates TLS at the edge, so the Trojan handshake can't pass through. Deploy WS transport if you want Cloudflare in front.

### Does TunnelHQ work with the Trojan-Go Mux multiplexer?

Yes. The Mux layer is transparent to monitoring. TunnelHQ performs the Trojan auth handshake and then closes the connection; Mux logic happens post-auth.

### Does subscription URL monitoring detect new Trojan configs?

Yes. Point TunnelHQ at your V2Ray/Clash subscription URL. It polls the URL, parses any Trojan (and VLESS, VMess, SS) configs inside, and auto-creates a tunnel for each new one.

Source: https://tunnelhq.com/trojan-monitoring/