mirror of
https://github.com/MHSanaei/3x-ui.git
synced 2026-10-23 06:15:01 +03:00
MHSanaei
9b91f0f42e
Fold the standalone 3x-ui-docs project (Next.js 16 + Fumadocs, deployed to docs.sanaei.dev) into docs/ so the panel and its documentation share a single source of truth, the way sing-box keeps its docs in-tree. The old repo becomes redundant and can be retired. - Import the full site under docs/ (app, components, content, lib, public, scripts, config). The self-contained pnpm project sits alongside the existing engineering notes with no filename collisions. - Re-point "Edit on GitHub" links from MHSanaei/3x-ui-docs to this repo's docs/content/docs path (docs/lib/shared.ts, docs/app/.../page.tsx). - Add docs-ci.yml and docs-deploy.yml under .github/workflows/, scoped to docs/** and run with working-directory: docs, since GitHub only runs workflows from the repo-root .github/. deploy-static.yml's GitHub Pages publish (CNAME docs.sanaei.dev) carries over unchanged. Follow-up (outside this commit): attach the docs.sanaei.dev custom domain to this repository's Pages (or set the Vercel project's root directory to docs), confirm the site is live from the monorepo, then delete MHSanaei/3x-ui-docs.
67 lines
2.6 KiB
Plaintext
67 lines
2.6 KiB
Plaintext
---
|
|
title: Security
|
|
description: Harden 3x-ui — panel auth and 2FA, Fail2ban IP limits, firewall rules, BBR, and staying current.
|
|
icon: ShieldCheck
|
|
---
|
|
|
|
A proxy panel is a high-value target. A few layers of hardening go a long way.
|
|
|
|
## Panel hardening
|
|
|
|
- Strong, unique credentials and **two-factor auth** (TOTP).
|
|
- A non-default panel port and a long, random web base path.
|
|
- TLS on the panel (directly or via a [reverse proxy](/docs/operations/reverse-proxy)).
|
|
- The built-in **login limiter** blocks an IP/username after 5 failed attempts
|
|
in 5 minutes (for 15 minutes), and the panel can route its own egress through
|
|
an outbound.
|
|
|
|
See [First login](/docs/guide/first-login) for the full checklist.
|
|
|
|
## Fail2ban & IP limits
|
|
|
|
Set an **IP limit** per client (see [Clients](/docs/config/clients)) to cap the
|
|
number of simultaneous source IPs. Enforcement is handled by **Fail2ban**, which
|
|
3x-ui installs and configures for you (enabled by default on script installs, and
|
|
on Docker via `XUI_ENABLE_FAIL2BAN=true`).
|
|
|
|
Manage it from the `x-ui` menu (**22 — IP Limit Management**): install/configure,
|
|
change the ban duration (default **30 minutes**), ban/unban an IP, view ban logs,
|
|
and check status. Under the hood:
|
|
|
|
- The jail is named **`3x-ipl`**; ban logs live at `/var/log/x-ui/3xipl.log` and
|
|
`/var/log/x-ui/3xipl-banned.log` (also via `x-ui banlog`).
|
|
- Bans cover all TCP/UDP **except** your SSH and panel ports, so a ban can't lock
|
|
you out of the server or panel.
|
|
|
|
<Callout type="warn">
|
|
On Docker, Fail2ban bans with `iptables`, which needs the `NET_ADMIN` (and
|
|
`NET_RAW`) capability — `docker-compose.yml` grants them. With a bare
|
|
`docker run`, add `--cap-add=NET_ADMIN --cap-add=NET_RAW` or bans are logged
|
|
but never applied.
|
|
</Callout>
|
|
|
|
## Firewall
|
|
|
|
Open only the ports you actually use: SSH, the panel port, the subscription
|
|
port, and your inbound ports. The `x-ui` menu (**23 — Firewall Management**) wraps
|
|
`ufw`, or generate rules here:
|
|
|
|
<FirewallRulesGenerator />
|
|
|
|
<Callout type="warn">
|
|
Make sure SSH stays allowed before enabling a default-deny firewall, or you can
|
|
lock yourself out. Test with a second session open.
|
|
</Callout>
|
|
|
|
## Network tuning (BBR)
|
|
|
|
The `x-ui` menu (**26 — Enable BBR**) toggles Google's BBR congestion control
|
|
(`net.ipv4.tcp_congestion_control = bbr`, `net.core.default_qdisc = fq`), which
|
|
often improves throughput on congested links.
|
|
|
|
## Keep current
|
|
|
|
Update 3x-ui and Xray-core regularly — security fixes land in new releases. Watch
|
|
the [releases page](https://github.com/MHSanaei/3x-ui/releases) and see
|
|
[Update & uninstall](/docs/guide/update-uninstall).
|