Protocols and profiles

A profile is the Xray config handed out to nodes. The panel ships eleven presets: pick one, it is created, then you adjust it to fit.

What works

Verified with live traffic rather than from documentation: each variant was brought up on a server and an external page was fetched through it.

Protocols	VLESS, VMess, Trojan, Shadowsocks 2022, Hysteria2
Transports	TCP (raw), WebSocket, gRPC, XHTTP, HTTPUpgrade, mKCP
Encryption	Reality, TLS, none (behind a reverse proxy)

What the engine cannot do

These are Xray's limits, not the panel's:

h2 and QUIC were removed in Xray 26 — the engine itself suggests XHTTP instead.
mKCP is there, but the header and seed fields were dropped; the old syntax is rejected.
TUIC is absent.
WireGuard is accepted by the engine, but it is not a subscription protocol: it uses a key pair per peer rather than handing configs to clients.

The panel rejects such configs with the engine's own reason, not a generic “error”.

Presets

Preset	When to reach for it
VLESS + Reality (TCP)	The default choice. Needs neither a domain nor a certificate.
VLESS + Reality (gRPC)	Sometimes gets through where plain TCP is throttled.
VLESS + WebSocket	Behind a reverse proxy or a CDN.
VLESS + XHTTP	Survives where WebSockets get cut.
VLESS + HTTPUpgrade	Lighter than WebSocket, passes most proxies.
VLESS + mKCP	Over UDP, holds up better on a poor link.
VMess + WebSocket	When your clients' apps have no VLESS support.
Trojan + TLS	Looks like an ordinary HTTPS site. Needs a domain and a certificate.
Shadowsocks 2022	No TLS at all, a separate key per client.
Hysteria2	Its own congestion control, copes well with packet loss.
Reality + WebSocket	Two entry points in one profile: a primary and a fallback.

Hysteria2: two catches

In Xray the protocol is called hysteria, not hysteria2. With the second spelling the engine answers unknown config id. The version is given separately: "version": 2.

The implementation runs over an ordinary transport, not over QUIC. So Xray-based clients connect to it, while a standalone QUIC hysteria server does not.

A certificate is required — see the node certificate.

Shadowsocks: 2022 only

The classic methods use one password for everybody, so handing different clients different keys is impossible. Only the 2022-* methods will do.

The inbound settings must include password — that is the server key. A client connects with the pair “server key : personal key”, and without the server half the engine answers missing psk. The panel derives the personal key from the client's UUID, so revoking a subscription cuts access here too.

Routing

Blocking and bypassing are done with rules in routing.rules. The editor has ready-made blocks: block torrents and ads, Russian sites direct, sites blocked in Russia through the tunnel, chaining to a second node, your own DNS.

List private networks explicitly rather than using geoip:private: if the file turns out to be missing on the node, a rule referencing it brings the whole config down.

The service inbound

api-in listens on the loopback only and exists for statistics — the agent reads the counters through it. Without it traffic limits do not work. It is not offered in location pickers: there is nothing to connect to.

← Nodes Subscriptions →