Account

Payment method

Where it sits in the app's list. Lower comes first.
Credentials
Where the gateway sends the customer back. It must point at this panel’s /pay/return and be registered against the merchant.
Description

Add to the blacklist

nothing yet

Ticket

New ticket

Terms and conditions

One point per line. A button marks the line the cursor is on; an unmarked line is plain text.
In the app

    New product

    Name
    Look
    Plans
    Price

    Edit account

    What they sign in with in the app. Cannot be changed afterwards.
    At least 8 characters. Leave blank when editing to keep the current one.
    Account
    Subscriptions

    Order

    New order

    Product
    An order made or corrected here is recorded as paid manually.

    Charge wallet

    تومان

    Account

    New admin

    At least 8 characters. Blank keeps the current one.
    Expired is not here because it is not stored: it is derived from the time limit below, so setting one is what makes an operator expire. Suspended still signs in and keeps their users; they just cannot create more.
    Limits
    GB Across every user of theirs. 0 is unlimited.
    How many accounts they may create.
    Days The longest one of their users may run.
    Ceiling per user, not a total.
    Plans
    Only dynamic plans can be sold by an operator.
    Account
    Monthly and hourly are a flat rate per interval. Dynamic charges what their users actually consumed. The figures come from Prices.
    % Taken off every price this admin is charged, whichever method they are on. 0 is list price.
    Blank is no time limit.

    Admin

    Prices

    Charge this admin

    New subscription

    Up to 500, created in one go. Everything below — plan, limits, duration — applies to all of them.
    Variables: {n} the counter, {rand} random letters, {date} today. Anything else is kept as written.
    Width the counter is padded to, so 7 becomes 007. 0 leaves it alone.
    How long the random part is. Applies to {rand}, and to {n} when random names are on.
    Limits
    days hours mins
    Counted from when you save. All zero is unlimited.
    0 is unlimited.
    GB 0 is unlimited.
    Zeroes the counter, keeps the history.
    Billing
    —
    Assignment

    Speed policies

    Policies

    Per-inbound limits

    New rule

    Users given this profile are subject to the rule.
    Trigger
    0 triggers from the first byte.
    0 counts everything still sampled.
    When it fires
    0 holds it until you lift it.

    Click the code to copy this config

    Subscription

    Click the code to copy the subscription link
    Configs in this subscription

    User

    Devices

    Addresses

    Notification

    New notification

    Edit charge

    Capture a profile

    A profile starts as a copy of a node that already works. Leave this and edit it afterwards to build one by hand.

    Apply profile

    New plan

    T
    Terms
    GB 0 grants unlimited.
    days Counted from the day the user is created.
    0 grants unlimited.
    Unit prices
    T
    T Charged pro rata, so 45 days costs one and a half.
    T
    T Added once, whatever they pick.
    Bounds
    Data GB GB
    Duration days days
    Devices
    When a user's usage goes back to zero.
    What happens if a user on this plan goes too far. Chosen once here rather than on every account.
    Assignment

    New node

    Agent
    Printed by install-node.sh. One agent serves both engines on this machine, so the key, host and port are shared.
    Only how the panel reaches the node. Use 172.17.0.1 if it runs on this server.
    Engines
    Where the collector reads traffic counters.
    Peers are numbered out of this. The first address is the interface, so a /24 holds 253 users.
    What clients dial. Blank uses the node's own address.
    The tunnel device WireGuard creates — wg0, wg1. Not the machine's network card.
    1420 fits a 1500 path: 20 IP, 8 UDP, 32 WireGuard.
    Holds a NAT mapping open. 0 disables it.
    Tunnel
    Collection
    Multiplies what this node’s traffic costs a user. 1 counts every byte once; 2 charges two for every one.
    GB GB of the machine’s own flow in total — every byte its interface moves, not what its users are billed for. Reaching it switches the node off and drains its clients. Raise it to bring the node back. 0 is unlimited.
    sec Seconds between collections from this node. 0 uses the collector’s own interval.
    sec Seconds to wait on this node’s agent before giving up.
    Reach this node through a proxy, for a machine the panel cannot dial directly. http://, https:// or socks5://, with optional user:pass. Blank connects straight to it.
    Panel forwarding
    What customers fetch their subscription through.
    The whole panel, sign-in included. There is rarely a reason to put this on a public port.
    host:port the node dials. Blank uses the host from the subscription base URL on 443.
    Cost
    T What the server itself costs per period.
    T Charged on user traffic.
    T

    Scan REALITY target

    A decoy has to speak TLS 1.3 and advertise HTTP/2, and the names on its certificate are the SNIs a client may present.

    New inbound

    General
    Plans are matched on the tag, so every node carrying this tag serves the same plan.
    Blank listens on every address. 127.0.0.1 or an @name makes this inbound reachable only as a fallback target.
    Transport
    Security
    The SNIs a client may present. Add an empty one to accept connections with none.
    Hex, even length, up to 16.
    For the subscription link; xray derives its own from the private key.
    0 disables the clock-skew check.
    Post-quantum signature over the temporary certificate. Optional.
    Comma separated. Only these sources are believed when they claim a client address.
    Which protocols the destination is read out of, so routing rules can match on domain.
    Plans

    New host

    Host route
    A host rewrites what a client dials for this inbound, wherever that inbound is served.
    The hostname or IP the client connects to. Blank uses each node’s own address.
    Blank uses the inbound’s own port.
    Host name
    Written out per user. Click a variable below to insert it at the cursor.
    Shown to
    Stream settings
    Overrides the inbound’s server name for this host.
    Sent as the HTTP Host header on ws, httpupgrade and xhttp.
    Request path for the transports that use one.
    Protocols offered during the TLS handshake.
    The TLS client this host imitates.
    Sent by the transports that carry headers. The Host header has its own field above.
    IKEv2
    The name on the certificate. Only needed when the address is an IP and the certificate is for a hostname.
    Overrides the inbound. Blank uses the inbound’s setting, which defaults to 1.1.1.1, 1.0.0.1.

    Add outbound

    Paste any config link and the form fills itself. The icon imports what is in the field, or the clipboard when it is empty.
    Remote server
    Vision flows need stream security tls or reality, not none.
    Stream & security tcp · none
    Mux and dialer

    Add host

    Plain text matches the whole name. Prefix with domain: for a suffix, keyword: for a substring, regexp: for a pattern, or geosite: for a list.
    An address pins the name. A single domain aliases it to that name instead.

    Add DNS server

    Skip this server during DNS fallback queries.

    Add balancer

    Add rule

    Routing action
    Match conditions
    Every condition you fill must match for the rule to apply. Leave a field empty to ignore it.
    Advanced
    A json object matched against request attributes.

    New rule

    Every node, unless one is named here.
    Allow returns early and nothing below it is consulted for that address.
    One address as /32, a range as CIDR. IPv4 only: v6 needs ip6tables and is not written.
    Per source address. 0 leaves the rate alone.
    How many may arrive at once before the average applies.
    Open at the same time from one address. 0 is unlimited.

    Passphrase

    Are you sure?