> ## Documentation Index
> Fetch the complete documentation index at: https://docs.edisglobal.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Install the 3x-ui VLESS proxy panel on Ubuntu 22.04

> Install 3x-ui on Ubuntu 22.04 VPS to run a VLESS proxy panel for privacy, DPI bypass, and access to restricted content with a managed web interface.

## What is VLESS?

VLESS is a modern, lightweight protocol used to create fast, flexible VPN-like connections over the internet. It’s an improved version of VMess with a simpler design and no built-in encryption, because it relies on TLS instead. This makes it efficient, good for use with CDNs, and useful for bypassing censorship or network limits when combined with Xray on a VPS.

## What is 3x-ui?

3x-ui is a web panel (a control dashboard in your browser) for managing Xray-core. It lets you create and manage VLESS VPN accounts without touching complex config files. You can add users, generate VLESS links or QR codes, and see traffic usage in a few clicks. 3x-ui also supports other popular protocols like Trojan, Shadowsocks, and more, so you can choose what works best for your needs. Overall, it turns many “terminal-only” tasks into simple buttons and forms, which is much easier for beginners.

## Choose a VPS for 3x-ui

For this guide, use a **KVM Linux VPS with Ubuntu 22.04**, root access and a public IPv4 address. You will install and manage 3x-ui yourself.

**KVM Starter with 2 GB RAM** is a practical starting point for a small personal setup. For several active users or a commercial service, compare vCPU resources and monthly traffic as well as RAM, then test with your expected workload. There is no fixed number of users or guaranteed throughput associated with a RAM size.

Choose a location close to your users or with a suitable route to their networks. Test the location's Looking Glass before ordering. The plan comparison shows the CPU type, storage, traffic allowance, host uplink and current price for each location. Host uplink speed is not a per-VPS throughput guarantee.

<CardGroup cols={2}>
  <Card title="Compare 2 GB VPS plans" icon="server" href="https://www.edisglobal.com/vps-hosting/2gb-vps?utm_source=edis-docs&utm_medium=referral&utm_campaign=vpn-guides&utm_content=3x-ui-prerequisites">
    Select your location and compare current KVM Starter plans.
  </Card>

  <Card title="Browse all VPS locations" icon="globe" href="https://www.edisglobal.com/vps-hosting?utm_source=edis-docs&utm_medium=referral&utm_campaign=vpn-guides&utm_content=3x-ui-locations">
    Find other locations and larger plans for your deployment.
  </Card>
</CardGroup>

## Install 3x-ui on a VPS

<Steps>
  <Step title="Install Ubuntu 22.04 on your EDIS Global VPS">
    Choose a location and plan above, then select Ubuntu 22.04 as your operating system.
  </Step>

  <Step title="Connect to the VPS using SSH">
    ```bash theme={"system"}
        ssh root@VPS_IP_address
        Enter root password:
    ```
  </Step>

  <Step title="Update and upgrade packages">
    ```bash theme={"system"}
        apt update && apt upgrade -y 
    ```
  </Step>

  <Step title="Install the curl package">
    ```bash theme={"system"}
        apt install curl -y
    ```
  </Step>

  <Step title="Disable IPv6 on Ubuntu 22.04">
    ```bash theme={"system"}
        #Create file 99-disable-ipv6.conf
        sudo nano /etc/sysctl.d/99-disable-ipv6.conf

        #Put this inside the file:
        net.ipv6.conf.all.disable_ipv6 = 1
        net.ipv6.conf.default.disable_ipv6 = 1
        net.ipv6.conf.lo.disable_ipv6 = 1
        #Save file and exit, then apply:

        sudo sysctl --system
        #Check network settings:
        ip a
        ip a | grep inet6
    ```
  </Step>

  <Step title="Install 3x-ui panel">
    ```bash theme={"system"}
        bash <(curl -Ls https://raw.githubusercontent.com/mhsanaei/3x-ui/master/install.sh)
    ```
  </Step>

  <Step title="Set the panel port">
    During the installation, the script asks whether you want to change the port:

    ```bash theme={"system"}
        Would you like to customize the Panel Port settings? (If not, a random port will be applied) [y/n]: 
    ```

    Type **y** to set your own port. The port should be in the 41000-65000 range. For example: 46522

    At the end, you will see something like:

    <Card>
      \###############################################\
      Username: ajYbrazcyO \
      Password: HPty32FVU7 \
      Port: 46522 \
      WebBasePath: ZtvraBUmNK9NQj43ks \
      Access URL: http\://YOUR\_SERVER\_IP:46522/ZtvraBUmNK9NQj43ks ###############################################
    </Card>

    <Callout icon="key" iconType="regular" color="#FFC107">
      Save these credentials to notes.
    </Callout>
  </Step>
</Steps>

## Connect to the 3x-ui panel

Never connect to 3x-ui over plain HTTP. It’s not secure. Always access the panel via HTTPS or through an SSH tunnel. To secure your connection to 3x-ui, make sure at least one of the following is set up:

* Generate and assign a self-signed certificate for the panel
* Use SSH port forwarding (access 3x-ui through an SSH tunnel)
* Use a Let’s Encrypt SSL certificate if you have a registered domain

<Tabs>
  <Tab title="Self-signed cert" icon="expeditedssl">
    A self-signed certificate lets the 3x-ui panel use HTTPS, so all data between your browser and the panel is encrypted instead of sent in plain text. Your browser may show a warning because the certificate isn’t from a public certificate authority (CA), but the connection is still secure. This helps prevent man-in-the-middle (MITM) attacks. It is also much safer than using HTTP, especially when entering your password or changing VPN settings.

    Generate a self-signed certificate and apply it to 3x-ui:

    1. Create a directory for the certificate:

    ```bash theme={"system"}
      # Create cert directory
      sudo mkdir -p /root/cert/
    ```

    2. Generate a self-signed certificate:

    ```bash theme={"system"}
      sudo openssl req -x509 -nodes -newkey rsa:2048 -days 365 \
        -keyout /root/cert/private.key \
        -out /root/cert/cert.crt \
        -subj "/C=EE/ST=Harjumaa/L=Tallinn/O=Org/OU=site/CN=localhost"
    ```

    3. Assign the certificate to the 3x-ui web panel:

    ```bash theme={"system"}
      sudo /usr/local/x-ui/x-ui cert \
        -webCert "/root/cert/cert.crt" \
        -webCertKey "/root/cert/private.key"
    ```

    4. Restart the 3x-ui panel to apply changes:

    ```bash theme={"system"}
    sudo x-ui
    ```

    Select option **13** to restart the panel. After that, 3x-ui serves the web interface over HTTPS using your self-signed certificate.
  </Tab>

  <Tab title="SSH port forwarding" icon="left-right">
    SSH port forwarding (SSH tunneling) lets you securely access a service on your VPS, like the 3x-ui web panel, without opening its port to the public internet. You create an encrypted SSH connection where your PC listens on a local port (for example `2222`). The tunnel forwards all traffic to the 3x-ui port on the server (for example `46522`). When you open `http://127.0.0.1:2222/` in your browser, you’re safely talking to the panel through SSH.

    Set up SSH port forwarding on the VPS:

    ```bash theme={"system"}
       #Execute 3x-ui cli
       x-ui

       #Select an item 22. SSH Port Forwarding Management 
       Please enter your selection [0-25]: 22

       #Choose setting Set listen IP
       Choose an option: 1
       #Use default IP (127.0.0.1)
       Select an option (1 or 2): 1
    ```

    When you select option 1, 3x-ui shows sample commands for creating an SSH tunnel from your local machine.

    <b>Create an SSH tunnel from your PC:</b>

    ```bash theme={"system"}
       SSH Port Forwarding Configuration:
       Standard SSH command:
       ssh -L 2222:127.0.0.1:46522 root@134.255.210.100

       If using SSH key:
       ssh -i <sshkeypath> -L 2222:127.0.0.1:46522 root@YOUR_SERVER_IP

       After connecting, access the panel at:
       http://localhost:2222/ZtvraBUmNK9NQj43ks/
    ```

    You can also use this second example to connect to the server from your local machine, where the 3x-ui port is 46522:

    ```bash theme={"system"}
       ssh -L 127.0.0.1:2222:127.0.0.1:46522 root@YOUR_SERVER_IP
    ```

    Open the URL in the browser on your local PC:

    ```text theme={"system"}
       http://127.0.0.1:2222/ZtvraBUmNK9NQj43ks
    ```
  </Tab>

  <Tab title="Let's Encrypt SSL cert" icon="certificate">
    To get a trusted HTTPS certificate from Let’s Encrypt for the 3x-ui panel, you need:

    * Domain name, e.g. vpn.example.com
    * That domain’s A record pointing to your VPS IP (set in the hosting provider)
    * Port 80 on the VPS open to the internet (for HTTP validation)

    Connect to the server via SSH and run these commands:

    ```bash theme={"system"}
       #Execute 3x-ui cli
       x-ui

       #Select SSL Certificate Management
       Please enter your selection [0-25]: 18

       #Choose “Get SSL”
       Choose an option: 1

       Select Get SSL, then enter:
       Your domain name (e.g. vpn.example.com)
       Your email address (used by Let’s Encrypt)

       #Set the certificate for the 3x-ui panel
       In the same SSL Certificate Management menu, select Set Certificate Paths for the Panel, then select the certificate for your domain so the panel uses it for HTTPS.

       #Restart the 3x-ui panel to apply changes:
       sudo x-ui
       Select option **13** to restart the panel.
       #After that, you can use URLs with valid Let’s Encrypt certificate:
       https://vpn.example.com:PORT/ 
    ```
  </Tab>
</Tabs>

<Check>
  Great, you’re now securely connected and logged in to the 3x-ui panel. Next, you’ll create a new inbound and connect to your server from your client apps.
</Check>

## Create an inbound in the 3x-ui panel

Log in to the panel:

<img src="https://mintcdn.com/edisglobal-b1e34a56/_dVr7N6xG681-x4I/assets/3x-ui-login.png?fit=max&auto=format&n=_dVr7N6xG681-x4I&q=85&s=7663d3b2720704f79bc7805a1c50344a" alt="3x-ui login" width="846" height="734" data-path="assets/3x-ui-login.png" />

After logging in to the 3x-ui panel, go to the **Inbounds** tab and click **Add Inbound**:

<img src="https://mintcdn.com/edisglobal-b1e34a56/_dVr7N6xG681-x4I/assets/3x-ui-inbounds.png?fit=max&auto=format&n=_dVr7N6xG681-x4I&q=85&s=0fcd8539eb5d370d7901cb6b5d7b13e7" alt="inbounds" width="1805" height="745" data-path="assets/3x-ui-inbounds.png" />

Fill in the following fields in the menu that opens:

* Remark - name the connection
* Protocol - select <b>vless</b>
* Listen IP - leave the field blank
* Port - specify port <b>443</b>
* Click the **Client** drop-down list, then click **Email**, **ID** and **Subscription** one by one to update them.
* For **Flow**, select <b>xtls-rprx-vision</b>. The **Flow** field appears after you set **Security** to **Reality**.

<img src="https://mintcdn.com/edisglobal-b1e34a56/cXMik4TCfKv7Ec7z/assets/3x-ui-addinbound.png?fit=max&auto=format&n=cXMik4TCfKv7Ec7z&q=85&s=1adb4f8047a13cd8785803a35b0699d9" alt="addinbound" width="717" height="1178" data-path="assets/3x-ui-addinbound.png" />

* Transmission - TCP(RAW)
* Security - Reality
* uTLS - chrome or firefox
* Target - google.com:443
* SNI - google.com,[www.google.com](http://www.google.com)
* Short IDs - click to update
* Click **Generate New Cert**

<img src="https://mintcdn.com/edisglobal-b1e34a56/cXMik4TCfKv7Ec7z/assets/3x-ui-addinbound2.png?fit=max&auto=format&n=cXMik4TCfKv7Ec7z&q=85&s=8d3c84ddba9ae8be7071badfc7a85e17" alt="addinbound2" width="719" height="1192" data-path="assets/3x-ui-addinbound2.png" />

Enable **Sniffing** by turning on the switch:

<img src="https://mintcdn.com/edisglobal-b1e34a56/_dVr7N6xG681-x4I/assets/3x-ui-addinbound3snifingenable.png?fit=max&auto=format&n=_dVr7N6xG681-x4I&q=85&s=7909e9e00b7a2f941924103e7d7aba02" alt="addinbound3snifingenable" width="710" height="451" data-path="assets/3x-ui-addinbound3snifingenable.png" />

After entering the data, click **Create**.

If you configured the inbound correctly, it appears in the list. Click the <b>+</b> icon to show client settings for export:

<img src="https://mintcdn.com/edisglobal-b1e34a56/_dVr7N6xG681-x4I/assets/3x-ui-inboundcreated.png?fit=max&auto=format&n=_dVr7N6xG681-x4I&q=85&s=759ba82c4ed019088ad66a22648275e7" alt="inboundcreated" width="1480" height="401" data-path="assets/3x-ui-inboundcreated.png" />

In the drop-down menu, click the QR code image:

<img src="https://mintcdn.com/edisglobal-b1e34a56/_dVr7N6xG681-x4I/assets/3x-ui-qrcodeclick1.png?fit=max&auto=format&n=_dVr7N6xG681-x4I&q=85&s=bc79e996dcbb8c3ae6c4f638bfa9b095" alt="qrcodeclick1" width="1483" height="540" data-path="assets/3x-ui-qrcodeclick1.png" />

In the pop-up window you’ll see two QR codes. Click the QR code on the right (the VLESS one) and the panel copies its client configuration to your clipboard. Then paste this config into your VPN client on your PC or mobile device.

<img src="https://mintcdn.com/edisglobal-b1e34a56/cXMik4TCfKv7Ec7z/assets/3x-ui-QRcode2.png?fit=max&auto=format&n=cXMik4TCfKv7Ec7z&q=85&s=fb0e803116d5f13cd3b6f45830c049f1" alt="QRcode2" width="708" height="507" data-path="assets/3x-ui-QRcode2.png" />

## How to connect to 3x-ui (PC, Android, iOS)

Compatible 3x-ui clients include **Hiddify**, **v2rayN**, **v2RayTun**, **v2RayNG**, **Nekoray** and others.

| Client | Mobile (Android / iOS) | PC (Windows / Linux / macOS) | Notes |
| - | - | - | - |
| **v2rayNG** | <Icon icon="android" iconType="solid" /> Android | – | Popular Android V2Ray/Xray client; supports import via link/QR. |
| **v2RayTun** | <Icon icon="android" iconType="solid" /> Android, <Icon icon="apple" iconType="solid" /> iOS | <Icon icon="windows" iconType="solid" /> Windows | Xray-based client that works well with VLESS/Trojan configs. |
| **Streisand** | <Icon icon="android" iconType="solid" /> Android, <Icon icon="apple" iconType="solid" /> iOS | <Icon icon="windows" iconType="solid" /> Windows <br /> <Icon icon="apple" iconType="solid" /> macOS | Multi-protocol client supporting VLESS, VMess, Trojan, Shadowsocks. |
| **Hiddify** | <Icon icon="android" iconType="solid" /> Android, <Icon icon="apple" iconType="solid" /> iOS | <Icon icon="windows" iconType="solid" /> Windows <br /> <Icon icon="apple" iconType="solid" /> macOS <br /> <Icon icon="linux" iconType="solid" /> Linux | Multi-platform client; easy to use with 3x-ui links and subscriptions. |
| **v2rayN** | – | <Icon icon="windows" iconType="solid" /> Windows <br /> <Icon icon="linux" iconType="solid" /> Linux <br /> <Icon icon="apple" iconType="solid" /> macOS | Classic GUI client for VLESS/VMess/Trojan/Xray. |
| **Nekoray** | – | <Icon icon="windows" iconType="solid" /> Windows <br /> <Icon icon="linux" iconType="solid" /> Linux | Cross-platform GUI proxy client for desktops and laptops. |

Links:

* [https://github.com/MHSanaei/3x-ui](https://github.com/MHSanaei/3x-ui)
* [https://github.com/MHSanaei/3x-ui/wiki](https://github.com/MHSanaei/3x-ui/wiki)
* [https://github.com/MHSanaei/3x-ui/wiki/Installation#docker-recommended](https://github.com/MHSanaei/3x-ui/wiki/Installation#docker-recommended)
* [https://github.com/XTLS/Xray-core](https://github.com/XTLS/Xray-core)
* [https://xtls.github.io/en/config/inbounds/vless.html](https://xtls.github.io/en/config/inbounds/vless.html)

## Plan your next deployment

[Choose a VPS location and plan for 3x-ui](https://www.edisglobal.com/vps-hosting/2gb-vps?utm_source=edis-docs\&utm_medium=referral\&utm_campaign=vpn-guides\&utm_content=3x-ui-next-steps). If you sell access to paying subscribers, read our [commercial VPN hosting guide](/commercial-vpn-hosting) for deployment, traffic planning and abuse-handling responsibilities.


## Related topics

- [v2RayTun VPN client on iOS](/advanced-setup-guides/install-3x-ui-on-vps/v2raytun-vpn-client-on-ios.md)
- [Hosting a commercial VPN service](/commercial-vpn-hosting.md)
- [Hiddify client for Windows](/advanced-setup-guides/install-3x-ui-on-vps/hiddify-client-for-windows.md)
- [v2rayNG VPN client on Android](/advanced-setup-guides/install-3x-ui-on-vps/v2rayng-vpn-client-on-android.md)
- [Install AmneziaWG on Ubuntu 22.04](/advanced-setup-guides/install-amneziawg-on-ubuntu-22_04/install-amneziawg-on-ubuntu-2204.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.