VPS und Server · 7 Min.

3x-ui install on a VPS: your own VLESS + Reality VPN

3x-ui is an open-source web panel for Xray: it creates VLESS + Reality connections and hands them to your devices as a link or QR code. Install it on a VPS with one script, put the inbound on port 443, keep the panel itself closed behind the firewall and an SSH tunnel, and connect with v2rayNG, v2rayN, Hiddify or Streisand. For personal use and a few family devices the smallest plan is enough.

What you need

A VPS with Ubuntu 24.04 or Debian 12 and root access over SSH (see Connecting over SSH). Xray is light: Pulse (2 vCPU, 2 GB, $10/month) handles a handful of devices and still has room for a website or a bot on the same server.
Port 443 free. Our images are clean, with no preinstalled panels or web servers, so nothing listens there until you install it.
If privacy is the point, you can also pay in crypto, Monero included.

1. Install 3x-ui

apt update && apt install -y curl
bash <(curl -Ls https://raw.githubusercontent.com/mhsanaei/3x-ui/master/install.sh)

The installer asks whether to set the panel port yourself and generates a random username, password and web base path. Write them down. You can print them again at any time:

x-ui settings

You don't need an SSL certificate for the panel if you only open it through the SSH tunnel in step 2.

2. Secure the panel

Whoever gets into the panel controls your server, and bots scan for 3x-ui on its default port 2053 all day. Four rules:

Non-default port and path. If the installer left the defaults, run x-ui and use the menu to change the port and reset the web base path.
Strong credentials. Set a long random password from the same menu; openssl rand -base64 24 generates one.
Firewall: SSH and 443 only. The panel port stays closed:

apt install -y ufw
ufw allow OpenSSH
ufw allow 443/tcp
ufw enable

Open the panel through an SSH tunnel. On your own computer:

ssh -L 8443:127.0.0.1:PANEL_PORT root@SERVER_IP

Then browse to http://127.0.0.1:8443/WEB_BASE_PATH/. For extra safety, set the panel's listen IP to 127.0.0.1 in Panel Settings so it never answers from outside. Keep it current with x-ui update.

3. Create a VLESS + Reality inbound

Reality borrows the TLS handshake of a real site, the "target". It must support TLS 1.3 and HTTP/2. Check from the server (the answer should be 2):

curl -so /dev/null -w '%{http_version}\n' --tlsv1.3 https://www.microsoft.com

In the panel, go to Inbounds → Add Inbound:

Protocol: vless, port: 443
Transmission: TCP (RAW)
Security: Reality, uTLS: chrome
Target (Dest in older versions): www.microsoft.com:443, SNI: www.microsoft.com
Click Get New Cert to generate the key pair
In the client section, Flow: xtls-rprx-vision

Save. Create one client per device: you can then revoke a lost phone without touching the others. The QR code and the vless:// link are in the inbound's client menu.

4. Client apps

Android: v2rayNG or Hiddify
iPhone and iPad: Streisand or Hiddify
Windows: v2rayN or Hiddify
macOS and Linux: Hiddify

Scan the QR code or import the vless:// link from the clipboard, connect, and check that an IP lookup site shows the server's address.

Common mistakes

The inbound doesn't start: something else holds port 443. ss -tlnp | grep :443 shows what.
Connects but nothing loads: the SNI doesn't match the target, the target lacks TLS 1.3, or the client has a different flow. Compare the client settings with the inbound.
Panel left on 2053 with the default path: sooner or later someone finds it. Close the port in ufw.
Speed drops in the evening: traffic on dedisrv VPS isn't limited, but the server's 1 Gbit/s port shares the host's uplink with its neighbours. When several servers are busy at once, each gets an even share. Browsing, messaging and HD video are fine; a fixed guaranteed rate for many users at once is a job for a dedicated server.
Forgetting the rules: a personal proxy is for your own privacy. Our terms prohibit using servers for unlawful purposes, and that covers the traffic through your tunnel.

Order Pulse