3X-UI
Description
3X-UI provides a simple web interface for configuring and managing the V2ray (xray) proxy server. It supports various protocols, including VLESS, VMess, Shadowsocks, Socks, HTTP/HTTPS, QUIC, and more.
Getting started
3X-UI is installed with the image and is automatically enabled when the server boots.
After the image is installed, the 3X-UI web interface will be available at https://example.com:8080, where example.com is the hostname of your server.
To enter the web-interface use admin login and password, which you can find in a file on the server:
/root/.app_password
To access this file, you will need to log in to the server via SSH. You can connect to the server via SSH:
- With an SSH key, if this option is enabled before a server is created
- With the
rootuser password sent by mail when server is activated
Changing domain
If you wish to use your own domain or subdomain to access the 3X-UI web interface, you will need to log on to the server via SSH under the root user and run the command:
add_domain
You will be prompted to enter a domain or subdomain in the format subdomain.example.com.
Make sure your domain exists and is pointed to the IPv4 address of your server!
When the script finishes, a Let's Ecnrypt certificate will be issued for the specified domain or subdomain and the web-interface will be available at https://example.com:8080/, where example.com is the previously specified domain (subdomain).
Profile creation
To create profiles for connecting to the proxy, navigate to the Inbounds menu and click Add Inbound.
A menu will appear asking you to specify profile (proxy server) settings. Most settings can be left at their default values. Simply click Create to finalize the profile.
To view the list of user profiles, click the + button to the left of the profile.
The UUID column in the user list shows the unique identifier needed for manually configuring a connection.
To add a new user, click Menu → Add Client.
Choose a protocol and configure it
3X-UI is primarily used to conceal the usage of a proxy server or VPN. The more effectively the protocol disguises traffic, the less likely it is for your ISP to detect and block it.
Based on resistance to blocking, protocols can be ranked as follows: Shadowsocks and VLESS + Reality offer the best resistance. For simple, but less resistant options, Shadowsocks is recommended. For greater resilience, opt for more complex protocols.
Below are detailed instructions for configuring your connection:
Shadowsocks
The simplest option. Click Add Inbound in the Inbounds menu (refer to the Profile creation section for more details). Then follow the settings shown in the screenshot below, leaving all other options as defaults.
If your ISP detects the standard encryption mode BLAKE3_AES_256_GCM, try switching to another available option. If detection persists, consider using one of the more block-resistant protocols.
VLESS + Reality
This option provides the best balance between setup complexity and detection resistance. If you're unsure which protocol to use, this is likely the best choice.
Click on Add Inbound in the Inbounds menu (see Profile creation section for more details) and then follow these steps:
- Select VLESS as the protocol.
- Set the port to 443.
- In the security section, choose Reality.
- Under uTLS, select Chrome or leave it at the default.
- Click the green Get new cert button, ensuring that the Private key and Public key fields are populated.
- Leave other options as defaults and click Create.
Connecting to proxy
| Windows/Linux | macOS | Android | iOS |
|---|---|---|---|
 | |  |  |
For quick configuration, you can generate a QR code or export the inbound's URL:
Simply copy the URL from the pop-up window to your clipboard. On most clients, you can add a connection by selecting Add profile from clipboard or Import profile from clipboard.
When manually configuring, you will need to specify a random profile name (remark), server IP address, port, client ID (UUID).
Since there are many variations of clients for different operating systems, below we will give an example of setting up a client for Windows, as the most common OS. However, for other OS, including mobile ones, the algorithm will be similar.
- Export your inboubnd URL and copy to the clipboard as described above in this section of article.
- Run Nekobox client as Administrator and enable Tun Mode.
- Press Enter on your keyboard to paste your URL from clipboard and your connection wil be added automatically. Alternatively you may click on Program button and then click on line Add profile from clipboard or Scan QR-code.
- Highlight the added connection line with your mouse and press Enter again to establish connection. Or click on it with right mouse button and then click on Start entry.
- To disconnect from the server, please similarly right-click on the connection line and then click Stop.
Software installed
| Name | License |
|---|---|
| 3X-UI | GNU GPLv3 |
| Caddy | Apache License 2.0 |
Useful links
For more information about the installed packages, please refer to their official documentation: