Skip to content
Get started

3x-ui on a VPS: install and VLESS Reality

Xray panel with limits

Install on a VPSGitHub
Category
VPN / Proxy
Hosting
VPN server
Author
MHSanaei
License
GPL-3.0
Version
3.8.5
Updated

The script is free · VPS from $2.79 per month · installs in about 6 minutes

Install over SSH

root@vps:~# bash <(curl -Ls https://raw.githubusercontent.com/mhsanaei/3x-ui/master/install.sh)

  • SystemUbuntu 24.04 · x86_64ok
  • Sourcegithub.com/MHSanaei/3x-uiok
  • Version3.8.5ok
  • Port2053/tcplisten
  • Port443/tcplisten

✓ 3x-ui 3.8.5 installed · about 60 seconds

root@vps:~#

Install command from the library. Output is shortened and may differ on your server.

What it is

  • Xray
  • VLESS
  • REALITY
  • Hysteria2
  • Limits

3x-ui is a web panel for Xray-core, a continuation of the X-UI project. In it you create connections (inbounds) and clients, set a traffic limit, expiry and device count for each, and hand out links, QR codes and subscriptions.

The panel installs with a single script, without Docker, and uses almost no resources, which is why it is a popular choice for one or two servers. Besides VLESS with REALITY, it supports VMess, Trojan, Shadowsocks, WireGuard, AmneziaWG, Hysteria2 and MTProto.

During installation the script generates a random username, password, port and panel path, and the service is managed through the x-ui console menu.

  • VLESS, VMess, Trojan, Shadowsocks, WireGuard, AmneziaWG, Hysteria2, MTProto
  • TCP, WebSocket, gRPC and XHTTP transports with TLS and REALITY
  • Per-client limits on traffic, time, IPs and devices
  • Built-in subscription server: raw, JSON and Clash
  • Telegram bot, REST API and multi-node management
  • SQLite database by default, or PostgreSQL

Who it is for

  • You want your own VPN on VLESS Reality for yourself, family or a small team — with a traffic limit, expiry and device count per client.
  • Plain WireGuard is blocked and you need a WireGuard-like tunnel: AmneziaWG is built into the 3x-ui panel itself.
  • One or two servers without Docker: the panel installs with one script and is managed from the x-ui menu.

Recommended plan

For 3x-ui: at least 1 vCPU, 2 GB RAM and 10 GB NVMe.

Minimum to run
1 vCPU · 1 GB RAM · 10 GB disk
Systems
Ubuntu 22.04 · Ubuntu 24.04 · Debian 11 · Debian 12 · AlmaLinux 9
Virtualization
KVM on every VPS of ours

One-click install via the Telegram bot

Three steps in the bot, no command line. The bot shows progress; installation usually takes about 6 minutes.

  1. 01

    Open the bot with the button

    The install button on this page opens @ExpressHost_bot, and the bot fills in 3x-ui by itself.

  2. 02

    Choose a plan and OS

    The script appears at the “Скрипты” (Scripts) step automatically; then pay for the server.

  3. 03

    Get the login details

    When installation finishes, the bot sends the login details to the chat.

What the bot sets up

  • Installs the latest 3x-ui release from GitHub on Ubuntu 22.04 or 24.04.
  • Generates a random username, password and secret panel path; the panel listens on port 1024.
  • Issues a Let’s Encrypt certificate for the server domain server-name.expresshost.cloud, so the panel opens over HTTPS right away.
  • When installation finishes, the bot sends the panel address (Access URL), username and password; a copy is kept in /root/info.txt.
  • The bot does not create connections (inbounds): add VLESS Reality or AmneziaWG in the panel using the steps below.

Installing 3x-ui by hand

If you already have a server or want your own setup, install the panel with the official script. It runs on Ubuntu, Debian, AlmaLinux and other distributions and must be run as root.

3x-ui ports
PortProtocolPurpose
2053tcpWeb panel (default port; the installer suggests a random one)
443tcpTypically used for VLESS REALITY (configured in the panel)
  1. 01

    Connect to the server

    The bot sends the IP and root password once the server is created.

    Code
    ssh root@SERVER_IP
  2. 02

    Run the installer

    The script installs the service and the x-ui management command and generates a random username, password and panel path. Set the port yourself or keep a random one.

    Code
    bash <(curl -Ls https://raw.githubusercontent.com/mhsanaei/3x-ui/master/install.sh)
  3. 03

    Choose an SSL certificate

    The installer offers Let’s Encrypt for a domain (90 days) or for the IP address (6 days); both renew automatically. Validation needs port 80 open; for a domain, create an A record pointing to the server IP first.

  4. 04

    Save the login details

    At the end the script prints Username, Password, Port, WebBasePath and Access URL — the full panel address. It also writes them to /etc/x-ui/install-result.env. The command below shows the current settings.

    Code
    x-ui settings
  5. 05

    Secure the panel

    Turn on two-factor authentication in Panel Settings and open only the ports you need in the firewall. Username, password, path and port can be changed from the x-ui menu.

How to set up VLESS Reality in 3x-ui

REALITY disguises the connection as the TLS handshake of a real, popular website, so it needs no domain or certificate of your own. It works with VLESS; the recommended flow is xtls-rprx-vision.

  1. 01

    Create a VLESS inbound

    In Inbounds add a connection: protocol VLESS, Security set to reality. Pick a free port, for example 443.

  2. 02

    Choose the target (dest) and SNI

    Use someone else’s busy website with TLS 1.3 and HTTP/2 that both the server and the clients can reach — the documentation’s example is www.microsoft.com:443. The domain must not be a redirect. In SNI / Server Names enter a name from that site’s certificate.

  3. 03

    Generate the keys and Short ID

    The panel creates the x25519 key pair and the Short ID for you. The private key stays on the server; clients only get the public one.

  4. 04

    Set the flow and fingerprint

    Flow is xtls-rprx-vision, both in the client entry and in the link. Use a common uTLS fingerprint such as chrome.

  5. 05

    Add a client and share the link

    Create a client, set a traffic limit and expiry, and send the vless:// link or QR code. v2rayNG, Hiddify, Mihomo and other clients work.

AmneziaWG in 3x-ui

AmneziaWG is a WireGuard fork with obfuscation, so DPI does not recognise WireGuard. In 3x-ui it runs inside the panel (amneziawg-go in user space), without a kernel module or DKMS. The bot has no separate AmneziaWG script — install 3x-ui and add an inbound. Other methods, requirements and clients are in a separate guide.

AmneziaWG server on a VPS: every method
  1. 01

    Add an AmneziaWG inbound

    Choose the AmneziaWG protocol and set the port and tunnel subnet, for example 10.8.1.0/24.

  2. 02

    Keep the default obfuscation

    The panel generates a random Jc, Jmin/Jmax, S1–S4, H1–H4 set and can regenerate it. The values must match on the server and the clients — client configs inherit them automatically.

  3. 03

    Add a client

    Each client gets its own keys and address. Download the .conf or copy the vpn:// link — the official AmneziaWG and AmneziaVPN apps import it. Version 3.1 parameters need an Amnezia app that supports 3.1.

Updating and backing up 3x-ui

Updating keeps the database and settings. Take a backup before a major-version jump.

  1. 01

    Copy the database

    All connections, clients and settings live in /etc/x-ui/x-ui.db, certificates in /root/cert/. Keep the copy off the server.

    Code
    cp /etc/x-ui/x-ui.db /root/x-ui-backup-$(date +%F).db
  2. 02

    Update to the latest stable release

    The Update item of the x-ui menu does the same.

    Code
    x-ui update

Common 3x-ui errors

  • The panel does not open

    Open the whole Access URL — with the port and the secret path. Check the service with x-ui status and the logs in the x-ui menu (Logs Management); the panel port must not be taken by another service.

  • The certificate is not issued

    The domain’s A record must point to the server before issuing, and port 80 must be reachable from the internet for HTTP validation. REALITY needs no certificate.

  • A Reality client cannot connect

    Most often the target and SNI are to blame: the site must support TLS 1.3 and HTTP/2, and the SNI must match its certificate. Check the xtls-rprx-vision flow in the client and the link, and that the inbound port is open.

  • A client stopped connecting

    Check whether the client has used up its traffic, expiry or IP limit.

  • Forgot the username or password

    Run x-ui and choose Reset Username & Password. x-ui settings shows the panel port and path.

Sources

Commands and steps were checked against the official documentation on October 25, 2026. What the bot install does comes from its install script.

3x-ui FAQ

Didn’t find an answer? Message @ExpressHost_SupportBot.

How many users can the plan handle?

The panel barely loads the server; resources go to Xray. 1 vCPU and 2 GB RAM is enough for dozens of active clients; as you grow, keep an eye on CPU load and bandwidth.

How do I update 3x-ui?

Run x-ui update or use the x-ui menu. The installer verifies the archive checksum; settings and clients are preserved.

Where is the data stored?

The panel database is /etc/x-ui/x-ui.db, program files are in /usr/local/x-ui. To back up, just copy x-ui.db.

How is 3x-ui different from Marzban?

3x-ui installs without Docker and suits one or two servers. Marzban and Remnawave are stronger at multi-server setups and subscriptions for selling access.

3x-ui installs at checkout — in the bot.

Install 3x-uiBuy in Telegram