Xray panel supporting multi-protocol multi-user expire day & traffic & ip limit (Vmess & Vless & Trojan & ShadowSocks & Wireguard)
Find a file
pwnnex eef2d311f4 Fix IP Limit continuous ban loop from stale DB entries (#4077)
After 60abeaa flipped the excess-IP selector to "oldest wins,
newest loses" (to protect the original/current connections), the
per-client IP table in `inbound_client_ips.ips` never evicted IPs
that stopped connecting. Their stored timestamp stayed ancient, so
on every subsequent run they counted as the "oldest protected"
slot(s) and whichever IP was actually using the config now was
classified as "new excess" and re-banned via fail2ban.

This is exactly the #4077 scenario: two IPs connect once and get
recorded, the ban lifts after the configured duration, the lone
legitimate IP that reconnects gets banned again, and again, and
again — a permanent 3xipl.log loop with no real abuser anywhere.

Fix: when merging the persisted `old` list with the freshly
observed `new` log lines, drop entries whose last-seen timestamp
is older than `ipStaleAfterSeconds` (30 minutes). A client that's
actually still active refreshes its timestamp any time xray emits
a new `accepted` line for a fresh TCP, so the cutoff is far above
even idle streaming sessions; a client that's genuinely gone falls
out of the table in bounded time and frees its slot.

Extracted the merge into `mergeClientIps` so it can be exercised
by unit tests without spinning up the full DB-backed job.

Tests cover:
- stale old entry is dropped (the #4077 regression)
- fresh old entries are still carried forward (access-log rotation
  is still backed by the persisted table)
- newer timestamp wins when the same IP appears in both lists
- a clock-skewed old `new` entry can't resurrect a stale IP
- a zero cutoff never over-evicts

Closes #4077
2026-04-22 16:53:32 +03:00
.github CodeQL: ignore v* tag pushes 2026-04-21 15:17:59 +02:00
.vscode DevTools 2025-10-02 01:47:12 +02:00
config v2.9.1 2026-04-21 15:02:06 +02:00
database add hysteria inbound 2026-04-20 16:05:27 +02:00
logger feat: add file logger support (#3575) 2025-10-09 17:39:29 +02:00
media donate: nowpayments 2025-09-18 20:14:10 +02:00
sub add hysteria inbound 2026-04-20 16:05:27 +02:00
util fix windows build 2026-02-20 02:07:46 +01:00
web Fix IP Limit continuous ban loop from stale DB entries (#4077) 2026-04-22 16:53:32 +03:00
windows_files Update OpenSSL installer to version 3.6.0 2026-01-05 18:49:30 +01:00
xray fix: prevent AddUser panic on nil flow for VLESS XHTTP clients 2026-04-21 13:04:39 +02:00
.env.example fix: display of outbound traffic (#3604) 2025-12-23 15:43:25 +01:00
.gitignore Moved DB to same app folder on Windows (#3340) 2025-08-13 23:19:59 +02:00
CONTRIBUTING.md fix: display of outbound traffic (#3604) 2025-12-23 15:43:25 +01:00
docker-compose.yml fix: enhance WebSocket stability, resolve XHTTP configurations and fix UI loading shifts (#3997) 2026-04-19 21:01:00 +02:00
DockerEntrypoint.sh chore: X_UI_ENABLE_FAIL2BAN -> XUI_ENABLE_FAIL2BAN (#3030) 2025-05-22 08:21:23 +02:00
Dockerfile Bump Go to 1.26 2026-02-16 01:10:43 +01:00
DockerInit.sh Update Xray-core to v26.4.17 2026-04-20 20:02:43 +02:00
go.mod revert Fix geosite:ru rule (ram leak) 2026-04-21 12:55:16 +02:00
go.sum revert Fix geosite:ru rule (ram leak) 2026-04-21 12:55:16 +02:00
install.sh fix: enhance WebSocket stability, resolve XHTTP configurations and fix UI loading shifts (#3997) 2026-04-19 21:01:00 +02:00
LICENSE 3x-ui 2023-02-09 22:48:06 +03:30
main.go fix windows build 2026-02-20 02:07:46 +01:00
README.ar_EG.md Add custom geosite/geoip URL sources (#3980) 2026-04-19 21:24:24 +02:00
README.es_ES.md Add custom geosite/geoip URL sources (#3980) 2026-04-19 21:24:24 +02:00
README.fa_IR.md Add custom geosite/geoip URL sources (#3980) 2026-04-19 21:24:24 +02:00
README.md Add custom geosite/geoip URL sources (#3980) 2026-04-19 21:24:24 +02:00
README.ru_RU.md Add custom geosite/geoip URL sources (#3980) 2026-04-19 21:24:24 +02:00
README.zh_CN.md Add custom geosite/geoip URL sources (#3980) 2026-04-19 21:24:24 +02:00
update.sh fix: enhance WebSocket stability, resolve XHTTP configurations and fix UI loading shifts (#3997) 2026-04-19 21:01:00 +02:00
x-ui.rc [feat] restart xray-core from cli #3825 2026-02-20 00:03:16 +01:00
x-ui.service.arch [feat] restart xray-core from cli #3825 2026-02-20 00:03:16 +01:00
x-ui.service.debian [feat] restart xray-core from cli #3825 2026-02-20 00:03:16 +01:00
x-ui.service.rhel [feat] restart xray-core from cli #3825 2026-02-20 00:03:16 +01:00
x-ui.sh Fix SSL domain setup on reinstall: reuse existing certs and avoid false success/failure logs (#4004) 2026-04-17 12:19:45 +02:00

English | فارسی | العربية | 中文 | Español | Русский

3x-ui

Release Build GO Version Downloads License Go Reference Go Report Card

3X-UI — advanced, open-source web-based control panel designed for managing Xray-core server. It offers a user-friendly interface for configuring and monitoring various VPN and proxy protocols.

Important

This project is only for personal usage, please do not use it for illegal purposes, and please do not use it in a production environment.

As an enhanced fork of the original X-UI project, 3X-UI provides improved stability, broader protocol support, and additional features.

Custom GeoSite / GeoIP DAT sources

Administrators can add custom GeoSite and GeoIP .dat files from URLs in the panel (same workflow as updating built-in geofiles). Files are stored under the same directory as the Xray binary (XUI_BIN_FOLDER, default bin/) with deterministic names: geosite_<alias>.dat and geoip_<alias>.dat.

Routing: Xray resolves extra lists using the ext: form, for example ext:geosite_myalias.dat:tag or ext:geoip_myalias.dat:tag, where tag is a list name inside that DAT file (same pattern as built-in regional files such as ext:geoip_IR.dat:ir).

Reserved aliases: Only for deciding whether a name is reserved, the panel compares a normalized form of the alias (strings.ToLower, -_). User-entered aliases and generated file names are not rewritten in the database; they must still match ^[a-z0-9_-]+$. For example, geoip-ir and geoip_ir collide with the same reserved entry.

Quick Start

bash <(curl -Ls https://raw.githubusercontent.com/mhsanaei/3x-ui/master/install.sh)

For full documentation, please visit the project Wiki.

A Special Thanks to

Acknowledgment

  • Iran v2ray rules (License: GPL-3.0): Enhanced v2ray/xray and v2ray/xray-clients routing rules with built-in Iranian domains and a focus on security and adblocking.
  • Russia v2ray rules (License: GPL-3.0): This repository contains automatically updated V2Ray routing rules based on data on blocked domains and addresses in Russia.

Support project

If this project is helpful to you, you may wish to give it a🌟

Buy Me A Coffee
Crypto donation button by NOWPayments

Stargazers over Time

Stargazers over time