3x-ui panel: installation, fine-tuning Reality, and multi-user setup

For a quick 3x-ui installation on a server running Ubuntu 22.04 or Debian 12, simply execute the command bash <(curl -Ls https://raw.githubusercontent.com/MHSanaei/3x-ui/master/install.sh), which will deploy the Xray control panel with support for VLESS Reality, Shadowsocks, and Trojan protocols in 2-3 minutes. This panel is the most up-to-date fork of the original x-ui project, offering extended support for multi-user environments, detailed traffic statistics, and advanced security settings.

3x-ui installation: system requirements and VPS preparation

Before starting the process known as 3x-ui installation, you must ensure that your virtual private server (VPS) meets the minimum technical specifications. Although Xray-core is extremely resource-efficient, the operation of the web interface and the SQLite database requires a certain power margin.

Choosing a server configuration

For stable panel operation with 10-50 active users, it is recommended to use a server with the following characteristics:

• CPU: 1 core (1 GHz+) — Xray parallelizes load excellently, but core frequency is important for Reality encryption.
• RAM: 1 GB RAM — this is sufficient for the Ubuntu OS and the 3x-ui panel itself.
• Disk: 10 GB SSD/NVMe — the main space is occupied by logs and the user database.
• Operating System: Clean 3x-ui ubuntu 20.04/22.04 or Debian 11/12.

When choosing a server location, consider latency (ping). If your audience is in Europe, it's better to choose data centers in the Netherlands or Germany. If you are looking for budget options with high performance, check out DigitalOcean alternatives, where you can get similar power for a lower cost.

Preparing the operating system

Before installation, update the packages and install the necessary dependencies (curl and socat for working with SSL certificates):

apt update && apt upgrade -y
apt install curl socat -y

Ensure that the firewall (ufw) is either disabled or configured to allow traffic through the ports you plan to use for the panel (default is 2053) and for VPN connections.

Step-by-step 3x-ui panel installation with a single command

Using an automated installation script is the most reliable way to deploy the 3x-ui panel. The script will automatically detect the processor architecture (x86_64 or ARM), download the latest version of Xray-core, and configure system services for auto-start.

Running the installation script

Execute the following command in your server's terminal:

bash <(curl -Ls https://raw.githubusercontent.com/MHSanaei/3x-ui/master/install.sh)

During the installation process, the script will ask several questions:

1. Confirmation of installation (press y).
2. Choosing a port for the web interface (it is recommended to change the standard 2053 to any random port in the 10000-60000 range to protect against scanners).
3. Setting the administrator login and password. Do not use standard admin/admin combinations.

Managing the service via terminal

After the installation is complete, management commands will be available via the x-ui utility. Simply type x-ui in the console to bring up the management menu, where you can reset the password, change the port, or restart the service. This is critical if you lose access to the web interface.

Comparing the convenience of administration, many users choose this tool instead of manually editing JSON configs. In the context of choosing between local and international hosting, installing such a panel on a Western VPS provides more freedom, as mentioned in our article Reg.ru / Beget vs Western VPS.

Configuring 3x-ui reality with cloudflare.com masking

The 3x-ui reality technology is currently the most advanced way to bypass blocks. It eliminates the use of self-signed SSL certificates, instead "borrowing" a certificate from a real popular website (e.g., cloudflare.com or microsoft.com). To a censor, your traffic looks like a normal visit to a legitimate resource.

Creating an Inbound connection

In the web interface, go to the "Inbounds" section and click "Add Inbound". Select the following parameters:

• Protocol: vless
• Port: 443 (using port 443 is mandatory to simulate HTTPS)
• Transmission: TCP
• Security: REALITY

Fine-tuning Reality parameters

In the Reality settings block, fill in the fields:

Important: in the Flow field, select xtls-rprx-vision. This activates additional mechanisms to counter active probing by Deep Packet Inspection (DPI) systems. Read more about how this combination works in the article Your own VPN on VPS: VLESS Reality + Xray-core in 10 minutes.

x-ui multi-user management and traffic limits

The x-ui multi user functionality allows you to create separate accounts for different people or devices within a single port (Inbound). This eliminates the need to open hundreds of ports in the firewall and simplifies administration.

Adding new clients

In the settings of the created Inbound, you will find the "Clients" section. Click "Add Client" to generate a new UUID. Each user can be assigned a unique Email (label) for tracking statistics.

Setting restrictions and quotas

The 3x-ui panel provides flexible control tools:

1. Total GB: Traffic limit (e.g., 100 GB). Once exhausted, the client's access is automatically blocked.
2. Expiry Time: Account expiration date. Useful for creating temporary access.
3. IP Limit: Restriction on the number of simultaneous connections from different IP addresses. Setting it to 2-3 is optimal to prevent resale of your access.

Statistics for each user are displayed in real-time. You can see the volume of uploaded and downloaded data, as well as the date of the last connection. If you plan to use this functionality for commercial purposes, you might be interested in the guide on how to start a proxy service.

Comparing 3x-ui with alternative VPN solutions

Choosing 3x-ui is justified when a high degree of anonymity and a convenient GUI are required. However, other protocols exist that may be more effective in specific conditions.

If your task is simply to hide your IP for streaming, setting up WireGuard on a VPS in 5 minutes will be enough. But for bypassing serious state filters, Reality combined with 3x-ui remains the priority choice.

Network stack optimization and performance

To ensure that your 3x-ui installation provides maximum speed (up to 1-10 Gbps), it is necessary to optimize the Linux kernel's handling of network queues. By default, the TCP stack in Ubuntu is configured for general tasks, not for high-load proxy traffic.

Enabling the BBR algorithm

Google BBR (Bottleneck Bandwidth and RTT) significantly increases throughput on unstable channels with packet loss. You can enable it with a couple of commands:

echo "net.core.default_qdisc=fq" >> /etc/sysctl.conf
echo "net.ipv4.tcp_congestion_control=bbr" >> /etc/sysctl.conf
sysctl -p

Increasing open file limits

Every user connection in Xray is an open file (socket). With a large number of x-ui multi users, the standard limit of 1024 files may be exhausted. Edit /etc/security/limits.conf, adding:

* soft nofile 65535
* hard nofile 65535

These changes will allow your server to withstand thousands of simultaneous sessions without performance drops. This is especially relevant for automation tasks, for example, when a Sneaker bot on VPS is running, requiring many proxy connections.

3x-ui backups and data migration

The entire panel configuration, including user data and statistics, is stored in a single SQLite database file. This makes the backup process as simple as possible.

Where is the data located?

The main database file is located at: /etc/x-ui/x-ui.db. SSL certificates may also be in this directory if you configured them through the panel.

Automating backups

To create a daily backup, you can use a simple cron script:

#!/bin/bash
BACKUP_DIR="/root/backups"
mkdir -p $BACKUP_DIR
cp /etc/x-ui/x-ui.db $BACKUP_DIR/x-ui_$(date +%F).db
find $BACKUP_DIR -type f -mtime +7 -delete

If you decide to change providers or scale up, simply install 3x-ui on the new server and replace the x-ui.db file with your backup, then restart the panel with the x-ui restart command. All users and Reality settings will be imported automatically.

Security and control panel protection

Since the control panel has access to critical server settings, its protection is priority number one. Leaving the default settings puts you at risk of brute-force attacks.

Security recommendations

• Change the default path: In the panel settings, change the "Panel URL Root". For example, instead of accessing via http://ip:port/, use http://ip:port/my-secret-path/. This hides the login form from automated scanners.
• Use HTTPS for the panel: Point a domain to your server and issue an SSL certificate (e.g., via Let's Encrypt). In the 3x-ui settings, specify the paths to fullchain.pem and privkey.pem.
• 2FA Authentication: 3x-ui supports two-factor authentication via Google Authenticator. This is a mandatory measure for administrator accounts.
• Restrict access by IP: If you have a static IP, configure iptables or ufw so that the panel port is accessible only from your address.

For those managing complex infrastructure, such as setting up a CI/CD server, external interface security is a basic operational standard.

Conclusions

Using 3x-ui is the most effective and modern way to deploy a personal VPN with Reality protocol support on Ubuntu servers. To ensure maximum stability and speed, we recommend choosing a VPS with KVM virtualization and activating the TCP BBR optimization algorithm immediately after installation.