diff --git a/common/badtls/badtls.go b/common/badtls/badtls.go
index 32e54a68..3964defa 100644
--- a/common/badtls/badtls.go
+++ b/common/badtls/badtls.go
@@ -202,5 +202,9 @@ func (c *Conn) WriterMTU() int {
 }
 
 func (c *Conn) Upstream() any {
+	return c.Conn
+}
+
+func (c *Conn) UpstreamWriter() any {
 	return c.NetConn()
 }
diff --git a/inbound/trojan.go b/inbound/trojan.go
index e1f47801..026de488 100644
--- a/inbound/trojan.go
+++ b/inbound/trojan.go
@@ -182,7 +182,7 @@ func (h *Trojan) newConnection(ctx context.Context, conn net.Conn, metadata adap
 func (h *Trojan) fallbackConnection(ctx context.Context, conn net.Conn, metadata adapter.InboundContext) error {
 	var fallbackAddr M.Socksaddr
 	if len(h.fallbackAddrTLSNextProto) > 0 {
-		if tlsConn, loaded := common.Cast[*tls.STDConn](conn); loaded {
+		if tlsConn, loaded := common.Cast[tls.Conn](conn); loaded {
 			connectionState := tlsConn.ConnectionState()
 			if connectionState.NegotiatedProtocol != "" {
 				if fallbackAddr, loaded = h.fallbackAddrTLSNextProto[connectionState.NegotiatedProtocol]; !loaded {
@@ -192,6 +192,9 @@ func (h *Trojan) fallbackConnection(ctx context.Context, conn net.Conn, metadata
 		}
 	}
 	if !fallbackAddr.IsValid() {
+		if !h.fallbackAddr.IsValid() {
+			return E.New("fallback disabled by default")
+		}
 		fallbackAddr = h.fallbackAddr
 	}
 	h.logger.InfoContext(ctx, "fallback connection to ", fallbackAddr)