Run a V2Ray (Xray) server with the 3x-ui panel

3x-ui is a web panel for an Xray (V2Ray) proxy server. You add the protocols you want (VLESS, VMess, Trojan, Shadowsocks), create an account for each user, and give each user a link or QR code. The App Market installs it onto one of your virtual machines (VMs).

Before you start

• A Doprax account with credit.
• A running VM with at least 512 MB of memory and 5 GB of disk. See Create your first virtual machine.
• Prefer a ProVM or OVH VM, where all ports are open. For a Hetzner VM, read On a Hetzner VM first.

Install the panel

1. In the dashboard, open App Market.
2. Search for 3x-ui and select View details on 3x-ui — Xray VPN Panel, published by doprax.
3. In the bar at the bottom of the page, choose the VM and select Install.
4. A window shows the steps and the log of the installation as it runs. Wait for the status Success.

Choose the right app

The App Market has other apps with similar names, such as 3X-UI panel, Xui panel and X-UI-PRO. They come from other publishers and are set up differently. This page describes only 3x-ui — Xray VPN Panel by doprax.

The general procedure, for any app, is on Explore apps in the App Market.

Sign in

After a successful install, the window shows Access & setup with these details:

Label	Value
Panel	http://YOUR_VM_IP:2053
Default login	admin / admin
Recommended protocol	A VLESS + REALITY inbound, which needs no domain

To see them again later, open the app’s page in the App Market. Under Your installations, select Access & setup next to the VM.

1. Open the Panel address in your browser.
2. Sign in with the username admin and the password admin.
3. Change the username, the password and the panel port at once, in the panel’s settings.

Danger

Until you change them, anyone who finds the panel’s address can sign in with admin / admin and control your server. Do step 3 before anything else.

Add a protocol and users

In 3x-ui, a protocol that listens on a port is called an inbound, and each user is a client of an inbound.

1. In the panel, add an inbound. Choose its protocol and its port. VLESS with REALITY is the strongest default and needs no domain name. VMess, Trojan and Shadowsocks are also available.
2. Add one client to the inbound for each person. You can give a client a traffic limit and an expiry date.
3. Give each person their client’s link or QR code. They open it in an app that supports the protocol, for example v2rayNG, Nekoray, Hiddify or Streisand.

The panel uses the VM’s network directly, so an inbound can listen on any TCP or UDP port of the VM.

On a Hetzner VM

On a Hetzner VM only TCP ports 80, 443 and 19000 to 19100 can be reached from the internet. This changes three things:

• The panel’s first address does not open, because port 2053 is outside the range. Reach it through SSH the first time. Run this on your own computer and leave it running:

  ssh -L 2053:localhost:2053 root@YOUR_VM_IP

  Then open http://localhost:2053 in your browser.

• Set the panel port to a port between 19000 and 19100. After that the panel opens at http://YOUR_VM_IP:THAT_PORT without SSH.

• Give every inbound port 443 or a port between 19000 and 19100, and choose a protocol that works over TCP. UDP does not reach a Hetzner VM.

Good to know

• No host can promise that an address stays reachable from every network. If your users can no longer reach the VM’s IP address, you can change the IP address. The links you handed out contain the old address and must be given out again.
• The panel runs in a Docker container named 3x-ui. Over SSH, docker ps shows whether it is running, and docker logs 3x-ui shows its log.
• Keep one account per person, so that you can remove one person without affecting the others.