mirror of
https://github.com/MHSanaei/3x-ui.git
synced 2026-10-23 14:25:01 +03:00
MHSanaei
9b91f0f42e
Fold the standalone 3x-ui-docs project (Next.js 16 + Fumadocs, deployed to docs.sanaei.dev) into docs/ so the panel and its documentation share a single source of truth, the way sing-box keeps its docs in-tree. The old repo becomes redundant and can be retired. - Import the full site under docs/ (app, components, content, lib, public, scripts, config). The self-contained pnpm project sits alongside the existing engineering notes with no filename collisions. - Re-point "Edit on GitHub" links from MHSanaei/3x-ui-docs to this repo's docs/content/docs path (docs/lib/shared.ts, docs/app/.../page.tsx). - Add docs-ci.yml and docs-deploy.yml under .github/workflows/, scoped to docs/** and run with working-directory: docs, since GitHub only runs workflows from the repo-root .github/. deploy-static.yml's GitHub Pages publish (CNAME docs.sanaei.dev) carries over unchanged. Follow-up (outside this commit): attach the docs.sanaei.dev custom domain to this repository's Pages (or set the Vercel project's root directory to docs), confirm the site is live from the monorepo, then delete MHSanaei/3x-ui-docs.
37 lines
1.2 KiB
Plaintext
37 lines
1.2 KiB
Plaintext
---
|
|
title: Ports & Firewall
|
|
description: The ports 3x-ui uses by default and ready-made ufw / nftables rules to open them.
|
|
icon: Network
|
|
---
|
|
|
|
Open only the ports you actually use. Below are the common ones and a generator
|
|
for `ufw` and `nftables` rules.
|
|
|
|
## Common ports
|
|
|
|
| Port (default) | Purpose |
|
|
| -------------- | ----------------------------------------- |
|
|
| `22` | SSH (keep this open!). |
|
|
| `2053` | Panel (configurable). |
|
|
| `2096` | Subscription server (if separate). |
|
|
| `443` | A common inbound port (TLS / REALITY). |
|
|
| `80` / `443` | Reverse proxy (if you run one). |
|
|
|
|
Your actual inbound ports depend on the inbounds you create.
|
|
|
|
## Generate firewall rules
|
|
|
|
<FirewallRulesGenerator />
|
|
|
|
<Callout type="warn">
|
|
Always keep SSH allowed before enabling a default-deny policy, and test from a
|
|
second session so you don't lock yourself out.
|
|
</Callout>
|
|
|
|
## Related
|
|
|
|
<Cards>
|
|
<Card title="Security" href="/docs/operations/security" description="Fail2ban, IP limits, and hardening." />
|
|
<Card title="Environment variables" href="/docs/reference/env-vars" description="XUI_PORT and friends." />
|
|
</Cards>
|