mirror of
https://github.com/MHSanaei/3x-ui.git
synced 2026-11-15 17:45:03 +03:00
MHSanaei
9b91f0f42e
Fold the standalone 3x-ui-docs project (Next.js 16 + Fumadocs, deployed to docs.sanaei.dev) into docs/ so the panel and its documentation share a single source of truth, the way sing-box keeps its docs in-tree. The old repo becomes redundant and can be retired. - Import the full site under docs/ (app, components, content, lib, public, scripts, config). The self-contained pnpm project sits alongside the existing engineering notes with no filename collisions. - Re-point "Edit on GitHub" links from MHSanaei/3x-ui-docs to this repo's docs/content/docs path (docs/lib/shared.ts, docs/app/.../page.tsx). - Add docs-ci.yml and docs-deploy.yml under .github/workflows/, scoped to docs/** and run with working-directory: docs, since GitHub only runs workflows from the repo-root .github/. deploy-static.yml's GitHub Pages publish (CNAME docs.sanaei.dev) carries over unchanged. Follow-up (outside this commit): attach the docs.sanaei.dev custom domain to this repository's Pages (or set the Vercel project's root directory to docs), confirm the site is live from the monorepo, then delete MHSanaei/3x-ui-docs.
98 lines
3.7 KiB
Plaintext
98 lines
3.7 KiB
Plaintext
---
|
|
title: Inbounds & Protocols
|
|
description: Create inbounds in 3x-ui — protocols, transports, traffic reset and expiry, and fallbacks that serve multiple protocols on one port.
|
|
icon: ArrowDownToLine
|
|
---
|
|
|
|
An **inbound** is a listener that accepts client connections on a port using a
|
|
particular protocol and transport. Most of your day-to-day work is creating and
|
|
managing inbounds and the clients inside them.
|
|
|
|
## Create an inbound
|
|
|
|
<Steps>
|
|
|
|
<Step>
|
|
### Add an inbound
|
|
|
|
Open **Inbounds → Add**, give it a remark, pick a **protocol**, and choose a
|
|
**port** and listen address.
|
|
</Step>
|
|
|
|
<Step>
|
|
### Choose a transport and security
|
|
|
|
Pick the transport (TCP, WebSocket, gRPC, HTTPUpgrade, XHTTP, …) and the security
|
|
layer (none, TLS, or REALITY). See [Transports](/docs/config/transports) and
|
|
[REALITY](/docs/config/reality).
|
|
</Step>
|
|
|
|
<Step>
|
|
### Add clients
|
|
|
|
Add one or more clients, each with its own credential, limits, and share link.
|
|
See [Clients](/docs/config/clients).
|
|
</Step>
|
|
|
|
<Step>
|
|
### Set traffic limit, expiry, and reset
|
|
|
|
Optionally cap total traffic and set an expiry date for the inbound, and choose a
|
|
periodic **traffic reset** schedule: `never` (default), `hourly`, `daily`,
|
|
`weekly`, or `monthly`.
|
|
</Step>
|
|
|
|
</Steps>
|
|
|
|
## Supported protocols
|
|
|
|
The inbound editor accepts these protocols:
|
|
|
|
| Protocol | Notes |
|
|
| ---------------------- | ------------------------------------------------------------------------ |
|
|
| **VLESS** | Lightweight; the basis for REALITY + XTLS-Vision. Recommended. |
|
|
| **VMess** | Older but very widely supported by clients. |
|
|
| **Trojan** | TLS-based; supports XTLS and fallbacks. |
|
|
| **Shadowsocks** | Includes Shadowsocks-2022 (`2022-blake3-*`) ciphers. |
|
|
| **WireGuard** | Modern tunnel. |
|
|
| **Hysteria2** | Selected as `hysteria`; the panel emits `hysteria2://` links. |
|
|
| **HTTP** | HTTP proxy. |
|
|
| **Mixed (SOCKS/HTTP)** | A combined SOCKS + HTTP listener. |
|
|
| **Dokodemo-door / Tunnel** | Port forwarding / traffic redirect. |
|
|
| **MTProto** | Telegram MTProto proxy, served by a bundled `mtg` process (not Xray). |
|
|
|
|
<Callout type="info">
|
|
Hysteria2 isn't a separate protocol internally — it's the `hysteria` protocol
|
|
with the transport version set to 2, and the panel generates `hysteria2://`
|
|
share links for it.
|
|
</Callout>
|
|
|
|
## Fallbacks — multiple protocols on one port
|
|
|
|
Fallbacks let a single TLS port (e.g. `443`) serve more than one protocol — for
|
|
example VLESS **and** Trojan — by routing unmatched handshakes to a child
|
|
inbound. In 3x-ui, fallbacks are managed in the panel (a master inbound's
|
|
**Fallbacks** list) rather than hand-written into JSON.
|
|
|
|
Fallbacks are available only when the master inbound is:
|
|
|
|
- **VLESS** or **Trojan**,
|
|
- on the raw **TCP** transport,
|
|
- with **TLS** or **REALITY** security.
|
|
|
|
Each fallback rule targets a child inbound and can match on `path`, `alpn`, and
|
|
`dest`. Client share links for a fallback child are automatically rewritten to
|
|
advertise the master's address, port, and TLS.
|
|
|
|
## Not sure which to pick?
|
|
|
|
Use the wizard to get a recommendation based on your goals and clients:
|
|
|
|
<ProtocolWizard />
|
|
|
|
<Callout type="info">
|
|
For censorship resistance with modern clients, **VLESS + REALITY +
|
|
XTLS-Vision** is the usual best choice — continue to
|
|
[REALITY](/docs/config/reality).
|
|
</Callout>
|