pjandro/3x-ui
1
0
Fork 0
mirror of https://github.com/MHSanaei/3x-ui.git synced 2026-07-26 09:52:14 +03:00
Code Issues Packages Projects Releases Wiki Activity

v3

Sanaei
2026-06-03 00:58:33 +02:00
parent fb5eaed98f
commit 93d22f6ecd
1 changed files with 70 additions and 107 deletions
Download Patch File Download Diff File Expand all files Collapse all files

177
Common-questions-and-problems.md

@@ -1,42 +1,26 @@
> [!CAUTION]
> This article was written on June 27, 2024 and much in it may not be relevant
> This FAQ mixes general Linux server administration with panel-specific tips. The panel is now on the v3.x series; commands and panel paths below have been refreshed for it, but external tutorials and IP addresses linked here may age over time.
## 1. Server Update
## 1. Server Update
Usually, the first step on a Linux server is to update and upgrade the server.
One-line server update command:
```sh
```sh
sudo apt-get update && sudo apt-get upgrade -y
sudo apt-get dist-upgrade -y
```
**Fixing Server Update Errors:**
Sometimes you can solve update problems by changing the sources links.
```sh
nano /etc/apt/sources.list
```
Get the appropriate repository from the links below.
[Ubuntu 20.04](https://gist.github.com/ishad0w/788555191c7037e249a439542c53e170) | [Ubuntu 22.04](https://gist.github.com/hakerdefo/9c99e140f543b5089e32176fe8721f5f)
If your connection is interrupted during the update, and you receive an error when updating again, the following commands will solve the problem:
If your connection is interrupted during an update and you then get a lock error, the following commands will fix it:
```sh
sudo rm /var/lib/apt/lists/lock
sudo rm /var/cache/apt/archives/lock
sudo rm /var/lib/dpkg/lock*
dpkg --configure -a
sudo dpkg --configure -a
```
After executing these commands, perform the update and upgrade again.
After running these, perform the update and upgrade again.
## 2. Changing Default SSH Port
@@ -61,7 +45,7 @@ sudo systemctl restart sshd
ssh -p 2222 username@your_server_ip
```
6. If the new port works, update your firewall to allow the new port:
6. If the new port works, update your firewall to allow it:
```sh
sudo ufw allow 2222/tcp
```
@@ -80,9 +64,9 @@ Important notes:
## 3. Root Access to Server
For some servers, login is done with a non-root user.
You can change the user to root with the command `sudo -i` or `sudo su`.
You can switch to root with `sudo -i` or `sudo su`.
You can also allow root user login with the following command and log in directly as root:
You can also allow root login and log in directly as root:
```sh
sudo sed -i 's/#PermitRootLogin prohibit-password/PermitRootLogin yes/' /etc/ssh/sshd_config && sudo systemctl restart ssh && sudo passwd
@@ -91,7 +75,6 @@ sudo sed -i 's/#PermitRootLogin prohibit-password/PermitRootLogin yes/' /etc/ssh
## 4. Changing DNS Server
Changing the DNS server can improve server performance and bypass some restrictions.
[DNS Server Configuration Tutorial](https://github.com/hiddify/hiddify-config/wiki/%D8%A2%D9%85%D9%88%D8%B2%D8%B4-%D8%AA%D9%86%D8%B8%DB%8C%D9%85-DNS-%D8%B3%D8%B1%D9%88%D8%B1#%D8%AA%D9%86%D8%B8%DB%8C%D9%85-dns-%D8%A7%D8%B2-%D8%B7%D8%B1%DB%8C%D9%82-ssh)
a) **Recommended DNS**
@@ -109,51 +92,51 @@ nameserver 185.51.200.2
## 5. Enabling Server Firewall
Enabling the firewall is useful and effective for server security and preventing blocking. Also, in some servers, the firewall is open by default, and you need to enable the ports you need.
Enabling the firewall is useful and effective for server security and preventing blocking. On some servers the firewall is open by default, and you need to enable the ports you need.
First, enable the ports you need in the firewall with the following command. These ports can include SSH port, panel port, config ports, etc.
First, enable the ports you need (SSH port, panel port, config ports, etc.):
```sh
sudo ufw allow <port>/tcp
```
Then turn on the firewall with the following command:
Then turn on the firewall:
```sh
sudo ufw enable
```
Check your firewall status with the command:
Check your firewall status with:
```sh
sudo ufw status`
sudo ufw status
```
You can also easily enable the server firewall using Firewall Management in the x-ui menu.
## 6. What settings do you recommend for Reality?
According to [xray developer](https://github.com/XTLS/Xray-core/issues/1769#issuecomment-1464821647) and experts, TCP REALITY VISION combination is the best choice. Of course, you can use GRPC and H2 which have lower ping, but usually TCP has been more successful in speed tests. Additionally, in [this tutorial](https://telegra.ph/RealityTCPHeaderVless-05-29), REALITY with HTTP Camouflage and several SNIs are introduced. It is recommended to use [RealiTLScanner](https://github.com/XTLS/RealiTLScanner) to find SNIs with TLS 1.3 H2 characteristics.
According to the [xray developer](https://github.com/XTLS/Xray-core/issues/1769#issuecomment-1464821647) and experts, the TCP REALITY VISION combination is the best choice. You can also use gRPC and XHTTP, which have lower ping, but TCP has usually been more successful in speed tests. It is recommended to use [RealiTLScanner](https://github.com/XTLS/RealiTLScanner) to find SNIs with TLS 1.3 / H2 characteristics.
It is strongly recommended to put all configs on one inbound or port.
## 7. What should I do if someone wants to log into my panel?
## 7. What should I do if someone is trying to log into my panel?
If you notice through the bot or server logs that your panel is being brute-forced, you have several solutions.
1. Change panel port and path.
2. Block the attacker's IP. If only one IP is trying to access your panel, you can block their IP with the following command if the firewall is active:
1. Change the panel port and path.
2. Block the attacker's IP (if the firewall is active):
```sh
sudo ufw deny from <ip-address> to any
```
3. Limit panel access to your IP. By not leaving the panel port open in the firewall, you can only log in with the config and IP of the same server. Or if you have another IP, you can allow it with the following command if the firewall is active:
3. Limit panel access to your IP. By not leaving the panel port open in the firewall, you can only log in from the same server. Or, if you have another IP, allow it (if the firewall is active):
```sh
sudo ufw allow from <ip-address> to any port <panel-port> proto tcp
```
Enabling HTTPS for the panel is also an [important](https://t.me/projectXtls/165) security point.
Enabling HTTPS for the panel is also an [important](https://t.me/projectXtls/165) security point. You can also enable two-factor authentication in `Panel Settings`.
## 8. How do I disable IP table tunneling?
@@ -161,15 +144,17 @@ Enabling HTTPS for the panel is also an [important](https://t.me/projectXtls/165
sysctl net.ipv4.ip_forward=0
```
First, execute the above command, then replace A- with D- in all commands you used to enable IP table tunneling and execute the commands.
First run the above command, then replace `-A` with `-D` in all the commands you used to enable IP table tunneling and execute them.
## 9. How do I specify that the bot should send backups at a certain time?
## 9. How do I make the bot send backups at a certain time?
It's explained [here](https://github.com/MHSanaei/3x-ui#telegram-bot), and to specify precisely, you can use [this](https://crontab.guru/examples.html) website.
Set the **Notification Time** (cron syntax) in `Panel Settings → Telegram Bot` and enable **Database Backup**. See the [Telegram Bot guide](https://github.com/MHSanaei/3x-ui/wiki) for details, and to build a precise schedule you can use [crontab.guru](https://crontab.guru/examples.html). (The bot also accepts shortcuts like `@daily`, `@weekly`, and `@every 12h`.)
## 10. Does IP limit work? How do I use it in tunneling?
## 10. Does the IP limit work? How do I use it with tunneling?
Yes; from version 1.7.0+, you can use it by installing fail2ban in the x-ui menu and specifying the limit for each client. If a user connects with an unauthorized number of IPs, they will be blocked for the time you specified. From version 1.7.9+, you need to enable access log in xray settings as follows:
Yes. Install fail2ban from the x-ui menu (`IP Limit Management → Install Fail2ban and configure IP Limit`) and set the IP limit for each client. If a user connects with more than the allowed number of IPs, they are blocked for the duration you specified.
You also need to enable the access log. In the panel go to `Xray Configs → Basics → Log → Access Log` and set it to `./access.log`, then save and restart Xray. (If you edit the template directly, the equivalent is:)
```json
"log": {
@@ -180,37 +165,35 @@ Yes; from version 1.7.0+, you can use it by installing fail2ban in the x-ui menu
},
```
Or in version 2.1.3+, set Xray Configs -> Basics -> General -> Access Log to access.log/.
You cannot use the IP limit for direct tunneling, because only your domestic server's IP reaches the foreign server. A simple solution is [panel-to-panel](https://github.com/rahgozar94725/freedom/blob/main/domestic-server/p-to-p.md) [outbound](https://t.me/panel3xui/65) tunneling and using the IP limit on the domestic server.
You cannot use IP limit for direct tunneling because only your Iranian server's IP reaches the foreign server. A simple solution is [panel-to-panel](https://github.com/rahgozar94725/freedom/blob/main/domestic-server/p-to-p.md) [outbound](https://t.me/panel3xui/65) tunneling and using IP limit on the Iranian server.
The IP limit doesn't work by default for CDN configs because the IPs of CDN edge servers reach our server. To send the user's real IP to Xray, create a reverse proxy with nginx by setting the `X-Forwarded-For` header for WS and `X-Real-IP` for gRPC, and enable `acceptProxyProtocol` in your inbound settings.
IP limit doesn't work by default for CDN configs because the IPs of CDN edge servers reach our server. To send the user's IP to xray, you can create a reverse proxy using nginx by setting the X-Forwarded-For header for WS and X-Real-IP for GRPC, and enable acceptProxyProtocol in your inbound settings.
## 11. Some sites don't open for me. What is WARP and how do I use it?
## 11. Some sites don't open for me. What is WARP? How do I enable it? How do I route all traffic through WARP?
WARP routes your server's traffic through Cloudflare's network using WireGuard, changing your server's IP to a Cloudflare IP. Since WARP IPs are whitelisted by most services, you can access sites that return Forbidden or 403 errors. However, your server's IP may not be fixed.
WARP routes your server's traffic through Cloudflare's network using WireGuard, changing your server's IP to a Cloudflare IP. Since WARP IPs are whitelisted in most services, you can access sites that give forbidden or 403 errors. However, your server's IP may not be fixed.
You can enable WARP this way:
Enable WARP this way:
```
Xray Configs -> Outbounds -> Create -> Add Outbound
Xray Configs → Outbounds → WARP → Create → Add Outbound
```
In the Basics column, check platforms like Google and Spotify
In the **WARP Routing** section, you can toggle preset categories (e.g. Google, Spotify).
Or add your desired site this way:
Or add your desired sites this way:
```
Xray Configs -> Routing Rules -> Add Rule
Xray Configs → Routing Rules → Add Rule
```
Select warp as Outbound Tag and add your domains to Domain as follows:
Select `warp` as the Outbound Tag and add your domains to the Domain field, for example:
```
bing.com,yahoo.com,geosite:instagram,geosite:meta
```
You can view existing geosites from [this link](https://github.com/v2fly/domain-list-community/tree/master/data).
You can view existing geosites at [this link](https://github.com/v2fly/domain-list-community/tree/master/data).
**To route all traffic through WARP**, you can modify the WARP route code in the Advanced column as follows:
**To route all traffic through WARP**, modify the WARP route in the Advanced template as follows:
```json
{
@@ -220,35 +203,27 @@ You can view existing geosites from [this link](https://github.com/v2fly/domain-
},
```
Additionally, if you encounter a 403 error in Google, installing WARP is not mandatory, and you can solve the problem by enabling the Use IPv4 for Google option in xray panel settings.
For Spotify, sometimes besides WARP, you also need to enable Fake DNS on the client side.
If you encounter a 403 error on Google, WARP isn't mandatory — you can often solve it by enabling the **Use IPv4 for host** option in the Xray settings. For Spotify, sometimes besides WARP you also need to enable Fake DNS on the client side.
## 12. What should I do with Hetzner abuse?
Receiving abuse from datacenters is not related to the panel.
Receiving abuse reports from datacenters is not related to the panel.
Routing all traffic through [WARP](https://github.com/MHSanaei/3x-ui/wiki/Common-questions-and-problems#11---%D8%A8%D8%B9%D8%B6%DB%8C-%D8%B3%D8%A7%DB%8C%D8%AA%D8%A7-%D8%A8%D8%B1%D8%A7%D9%85-%D8%A8%D8%A7%D8%B2-%D9%86%D9%85%DB%8C%D8%B4%D9%87-%D9%88%D8%A7%D8%B1%D9%BE-%DA%86%DB%8C%D9%87-%DA%86%D8%AC%D9%88%D8%B1%DB%8C-%D9%81%D8%B9%D8%A7%D9%84%D8%B4-%DA%A9%D9%86%D9%85-%DA%86%D8%AC%D9%88%D8%B1%DB%8C-%DA%A9%D9%84-%D8%AA%D8%B1%D8%A7%D9%81%DB%8C%DA%A9-%D8%B1%D9%88-%D8%A7%D8%B2-%D9%88%D8%A7%D8%B1%D9%BE-%D8%B1%D8%AF-%DA%A9%D9%86%D9%85) can prevent some abuses. Not running and installing unknown scripts is also an effective security measure. Also, make sure BitTorrent and Private IPs are blocked in Xray settings.
Routing all traffic through WARP (see question 11) can prevent some abuse reports. Not running or installing unknown scripts is also an effective security measure. Make sure **Block BitTorrent Protocol** is enabled and private IPs are blocked in the Xray settings, and use the **Block IPs / Block Domains** lists to block known-malicious destinations.
Some warnings don't cause your account to be blocked and are just security warnings and recommendations from BSI. To prevent these warnings, enable the Security Shield option in Xray settings. This setting prevents users from accessing malware links.
Finally, if this problem persists, monitor your users.
If the problem persists, monitor your users.
## 13. How does the panel subscription link work?
The advantage of the subscription link is that if there are changes in inbound settings, you don't need to send a new link to the user, and the user receives the new config by updating from the client side.
The advantage of the subscription link is that if there are changes to the inbound settings, you don't need to send a new link to the user — they receive the new config by updating from the client side.
To use this section, first enable the Enable Subscription Service option in Subscription settings.
Then you can specify a link for each client.
You can select one link for multiple clients.
To use this feature, enable the **Subscription Service** toggle under `Panel Settings → Subscription`. Then you can assign a subscription link to each client; the same link can be shared by multiple clients.
In version 1.7.1+, traffic amount and remaining time are added to the config name.
The remaining traffic and time are added to the config name. It's also recommended to enable HTTPS by selecting your domain's certificate files.
Also, it's recommended to enable HTTPS by selecting your domain's certificate files.
## 14. My server's disk is filling up. How do I stop logs from being saved?
## 14. My server's hard drive is filling up. How do I prevent panel logs from being saved?
If you're not using IPlimit, you can disable access log by modifying the log section in Xray config's Advanced part as follows:
If you're not using the IP limit, disable the access log: go to `Xray Configs → Basics → Log → Access Log` and set it to `none` (or, if editing the template directly, remove the `access` line):
```json
"log": {
@@ -257,58 +232,56 @@ If you're not using IPlimit, you can disable access log by modifying the log sec
},
```
Or in version 2.1.3+, set Xray Configs -> Basics -> General -> Access Log to none.
To clear this log file, use the following command:
To clear an existing access-log file:
```sh
echo "" > /usr/local/x-ui/access.log
```
## 15. What should I do to prevent continuous high CPU usage?
## 15. How do I prevent continuous high CPU usage?
First, check which process is causing the CPU increase with the `top` and `htop` commands.
First, check which process is causing the spike with `top` and `htop`.
If this problem is from the panel or xray, perform these actions:
If it's from the panel or Xray:
- Update the panel.
- Install fail2ban from the x-ui menu.
- Get server resources appropriate for your bandwidth consumption.
## 16. Why is all users' consumption zero and the panel not calculating traffic usage?
## 16. Why is all users' consumption zero and the panel not calculating traffic?
This problem usually has three main reasons:
This usually has these main causes:
- Error in xray config where you should press the Reset to Default Configuration button in the panel once and save.
- You or the bot you're using may not have entered complete user information like email.
- If you've moved the database and have this problem, update the panel once.
- The api rule must be the first rule in the Routing Rules section.
- An error in the Xray config — press the **Reset to Default** button in the panel once and save.
- You (or the bot you're using) may not have entered complete user information such as the email.
- If you moved the database and then hit this problem, update the panel once.
- The `api` rule must be the first rule in the Routing Rules section.
## 17. How do I solve the "database is locked" error?
Usually, this error is due to your server's weak hard drive. To solve it, [disable access log](https://github.com/MHSanaei/3x-ui/wiki/Common-questions-and-problems#14---%D9%87%D8%A7%D8%B1%D8%AF-%D8%B3%D8%B1%D9%88%D8%B1%D9%85-%D9%BE%D8%B1-%D9%85%DB%8C%D8%B4%D9%87-%DA%86%D8%AC%D9%88%D8%B1%DB%8C-%D8%AC%D9%84%D9%88%DB%8C-%D8%B0%D8%AE%DB%8C%D8%B1%D9%87-%D8%B4%D8%AF%D9%86-%D9%84%D8%A7%DA%AF-%D9%BE%D9%86%D9%84-%D8%B1%D9%88-%D8%A8%DA%AF%DB%8C%D8%B1%D9%85).
Usually this is due to a slow/weak server disk. To solve it, disable the access log (see question 14).
## 18. How do Direct Country Configs settings work?
This setting is only suitable for panel-to-panel outbound tunneling, and by enabling it on your Iranian server, you can open internal sites with your Iranian server's IP.
This setting is only suitable for panel-to-panel outbound tunneling. By enabling it on your domestic server, you can open internal sites with the domestic server's IP.
## 19. How do I solve the problem of not downloading from GitHub when installing or updating the panel?
## 19. GitHub won't download when installing or updating the panel
If it stops at `Resolving raw.githubusercontent.com` during GitHub download or you receive the `Connection timed out` error, and this problem only exists for GitHub, it can be solved in two ways.
If it stops at `Resolving raw.githubusercontent.com` or you get a `Connection timed out` error, and the problem only affects GitHub, there are two fixes.
**First method**: Download the script with IPv4:
**First method** — download over IPv4:
```sh
bash <(curl -Ls https://raw.githubusercontent.com/mhsanaei/3x-ui/master/install.sh --ipv4)
```
**Second method**: You can change GitHub's domain IP as follows:
**Second method** — override GitHub's domain IP:
```sh
sudo nano /etc/hosts
```
Add this line to the end of the file and save:
Add this line to the end of the file and save (note: GitHub's IPs can change over time):
```
185.199.110.133 raw.githubusercontent.com
@@ -318,26 +291,16 @@ Add this line to the end of the file and save:
Search works fine in the latest updates, but note that no client's email should contain spaces.
## 21. What kind of panel did you make! It keeps giving 400 errors!
## 21. Why does a user stay online and over-consume even after their traffic is used up?
If you encounter the `Error: Request failed with status code 400` error, enable SSL for your panel.
Traffic is checked every 10 seconds, and if the quota is used up the panel tells Xray to disconnect the client. If the user is still shown as online, it may be due to the server's disk and changes being saved late. More importantly, if Xray doesn't disconnect the user, it's not an x-ui bug: according to [community evaluations](https://github.com/alireza0/x-ui/issues/771#issuecomment-1861822323), when a user is downloading at high bandwidth it can take roughly two minutes for all of that user's Xray sessions to end, and consumption keeps being recorded during that window.
If SSL is enabled, perform the actions in [this link](https://www.hostinger.com/tutorials/how-to-fix-400-bad-request-error).
## 22. Why doesn't my panel open after updating or transferring?
## 22. Why does a user remain online and consume more than specified even after their traffic is used up?
This might be due to an error in Xray or a panel SSL issue. It's usually solved by **Reset Settings** in the x-ui menu.
In this panel, traffic is checked every 10 seconds, and if the volume is used up, it gives xray the command to disconnect. If the user is still shown as online, it might be due to the server's hard drive and changes not being saved or being saved late. More importantly, if xray doesn't disconnect the user, it's not an x-ui panel bug because according to [our evaluations](https://github.com/alireza0/x-ui/issues/771#issuecomment-1861822323), when a user is downloading with high bandwidth, it takes about two minutes (this time is not exact) for all user sessions in xray to end. During this time, user consumption is recorded in the panel.
## 23. Why doesn't my panel open after updating or transferring?
This problem might be due to an error in xray or panel SSL issue.
It's usually solved by Reset Settings in the x-ui menu.
## 24. How do I use fragment for my config?
## 23. How do I use a fragment for my config?
Fragment is easily configurable in the Freedom column of Outbounds for panel-to-panel tunneling.
But for direct config, fragment [cannot be received as a link](https://github.com/XTLS/Xray-core/discussions/716#discussioncomment-6273317); and must be used as json.
You can use [this tool](https://ircfspace.github.io/fragment/) to easily create fragment json.
For a direct config, a fragment [cannot be delivered as a link](https://github.com/XTLS/Xray-core/discussions/716#discussioncomment-6273317) and must be used as JSON. You can use [this tool](https://ircfspace.github.io/fragment/) to easily create the fragment JSON.