Trojan monitoring

TunnelHQ checks Trojan and Trojan-Go servers. It auto-detects trojan:// links, performs actual TLS handshakes with password verification, and supports WebSocket, gRPC and raw TCP transports.

Why Trojan needs specialized monitoring

Trojan's entire design goal is to look exactly like normal HTTPS traffic. This is excellent for users but terrible for generic uptime monitors.

The whole protocol works by:

• Client opens a standard TLS connection to the server on port 443
• After the TLS handshake completes, client sends a password hash as the first bytes
• If the password matches, the server treats the connection as a SOCKS5-like tunnel
• If the password is wrong or missing, the server transparently proxies the traffic to a fallback web server. So to the outside world it looks identical to any HTTPS site

This means any TLS probe succeeds. You always get a valid handshake. Generic uptime monitors will report "up" whether the Trojan process is actually running or not. If Trojan has crashed but nginx is still serving the fallback website on 443, a port monitor says "up"; your Trojan users see failed connections.

TunnelHQ performs the actual Trojan password authentication handshake and verifies that you're connecting to a real Trojan server, not just a fallback website.

URI auto-detection

Paste any standard Trojan URI and TunnelHQ parses the config automatically:

trojan://[email protected]:443?
  security=tls&
  sni=vpn.yourdomain.com&
  type=ws&
  path=/tunnel&
  host=vpn.yourdomain.com#Production-Trojan

From this, TunnelHQ extracts:

• Password (URL-decoded)
• Endpoint (vpn.yourdomain.com:443)
• SNI and ALPN values
• Transport (tcp, ws, grpc)
• WebSocket path and Host header (if transport is ws)
• gRPC service name (if transport is grpc)

Trojan vs Trojan-Go

Trojan-Go is a Go implementation with additional features (multiplexing via Mux, Shadowsocks-style AEAD fallback, WebSocket/gRPC transports). TunnelHQ handles both:

• Classic Trojan (C++ original): Raw TLS + password auth
• Trojan-Go: Classic Trojan plus WebSocket transport with path routing, gRPC transport, Mux multiplexing

Common Trojan failure modes TunnelHQ catches

• Password rotation without client update
• TLS certificate expiry on the server
• SNI mismatch after domain rename
• Trojan-Go process crashed but fallback web server still running on 443
• WebSocket path renamed on server, old path now hits fallback
• gRPC service name rotated
• Certificate chain rebuilt without intermediate cert

What a failed check tells you

A failed check comes with a message that says where to look. For Trojan, as for the other V2Ray and Xray share-link protocols, there are two to know.

• Tunnel established - Internet is stuck. The proxy connection worked, but traffic through it didn't reach the internet. Check the server's routing and NAT, its DNS, and whether its outbound traffic is blocked.
• Tunnel unreachable. The connection didn't come up. Check that the server is running, that the host and port in the link are reachable, and that the link's credentials and transport settings (such as security, sni, and type) match the server's.

Pricing for Trojan monitoring

All plans include Trojan monitoring.

See the full plan comparison

Read more

• Trojan in the docs
• Monitoring V2Ray subscription URLs in production
• VLESS monitoring