Setting up VLESS in Marzban

To log in to the dashboard without using an SSL certificate and domain name, we need to create a tunnel. The tunnel creation command is constructed as follows: ssh -L [local port]:[remote host]:[remote port] [user]@[server address]

In our case, the command looks like this:

ssh -L 8000:localhost:8000 root@server IP

After entering this command, confirm the connection ** by entering "Yes" and then enter the password from the server **. After connecting to the server, access to the panel should appear from your device's browser.

The panel should now be available in the browser via the link: http://127.0.0.1:8000/dashboard /

We will need the Termius - Android https://apps.apple.com/ru/app/termius-terminal-ssh-client/id549039908 - IOS and macOS

After installation, go to it and log in to the server via SSH for the first time, then go to the main menu and select the "Port Forwarding" tab

In the lower corner, click "+", then select Local and click Continue

Select the server from the list, and then specify the following data:

We set a name for this tunnel and click on the "Check mark" to save the settings:

Activating the tunnel by clicking on this rule:

The panel should now be available in the browser via the link: http://127.0.0.1:8000/dashboard /

After logging in, we will see the main panel page

A correctly added A record looks like this: After installing the A record, you must wait for the data to be updated on the global network: This usually happens within 5-15 minutes, but sometimes it takes up to 24 hours to update DNS records.

You can check the update of data on the network in various services, for example: https://dnschecker.org

After the global domain name update, go to the server's SSH console and issue an SSL certificate using the script Acme.sh

Below are the step-by-step commands for obtaining an SSL certificate via Acme.sh :

After executing the commands, you will see a similar message about the successful certificate issue:

After making changes, we save the file using the keyboard shortcut Ctrl + O and pressing Enter and restart the panel with the command:

After restarting, go to the browser via the link https://yourdomain:8000/dashboard and we observe the entrance window to the Marzban panel:

After logging in, we will see the main panel page:

Further changes will be made in the settings, which are located in the upper right corner (settings sign)

Let's start by adding the VLESS TCP Reality protocol Open these settings

We observe that in the "Inbounds" block there are only TCP Shadowsocks, add VLESS TCP Reality to the beginning of the block after the square bracket

    {
      "tag": "VLESS TCP REALITY",
      "listen": "0.0.0.0",
      "port": 443,
      "protocol": "vless",
      "settings": {
        "clients": [],
        "decryption": "none"
      },
      "streamSettings": {
        "network": "tcp",
        "tcpSettings": {},
        "security": "reality",
        "realitySettings": {
          "show": false,
          "dest": "replace:443",
          "xver": 0,
          "serverNames": [
            "replace"
          ],
          "privateKey": "replace",
          "publickKey": "replace",
          "shortIds": [
            "replace"
          ]
        }
      },
      "sniffing": {
        "enabled": true,
        "destOverride": [
          "http",
          "tls",
          "quic"
        ]
      }
    }, 

After adding the protocol, the configuration should look like this

After adding the VLESS TCP Reality protocol, you need to change the values:

1. ServerNames
2. Dest
3. Privatekey
4. shortIds

Let's change Server Name and Dest

Site requirements:

1. TLS 1.3
2. HTTP/2
3. Should not be behind a CDN service

You can check ping with the command:

ping site -c 4

If you haven't found a site suitable for these requirements, you can use the sites listed below:

Better suited for servers in Sweden and Finland:

teamdocs.su

Better suited for servers in Germany:

wikiportal.su

Better suited for servers in Moscow:

docscenter.su

In this case, ping to the teamdocs.su site turned out to be the lowest, we will choose it as Server Name and Dest, specify them in these lines

Let's generate new encryption keys and the shortIds parameter in your server's command line with commands

docker exec marzban_marzban_1 xray x25519

If an error occurred, try another command:

docker exec marzban-marzban-1 xray x25519

shortIds can be generated using the following command:

openssl rand -hex 8

We need to copy the Private key and shortIds parameters and then replace them in the panel

After making changes, you need to save the changes, restart the core and refresh the page in the browser