Docker & 3x-UI Setup
Installing 3x-UI (VLESS Reality) in Docker with Google BBR and Fail2ban
Complete guide to deploying a functional Xray control panel (3x-ui), optimizing network performance using Google BBR, and protecting it with Fail2ban.
Table of Contents
Google BBR
Increases TCP connection speeds and reduces latency under comparable packet loss conditions.
Fail2ban
Automatically blocks IP addresses of brute-forcers and scanners upon login attempts.
VLESS-Reality
A modern protocol for cloaking traffic to look like legitimate websites (Google, Apple, etc.).
Deployment Guide
Enables the Google BBR network traffic optimization algorithm at the host Linux kernel level.
bash
# Check the current algorithm sysctl net.ipv4.tcp_congestion_control # Enable BBR and FQ queuing in sysctl cat <<EOF | sudo tee -a /etc/sysctl.d/99-bbr.conf net.core.default_qdisc=fq net.ipv4.tcp_congestion_control=bbr EOF # Apply settings without a reboot sudo sysctl --system # Verify activation sysctl net.ipv4.tcp_congestion_control
Note: Google BBR reduces latency (RTT) and significantly increases data transfer speeds under high packet loss conditions. Since the container uses network_mode: host, these kernel settings apply to all 3x-ui connections.
Docker Compose configuration mapping the working SQLite database, certificates, and Fail2ban.
yaml
services:
3xui:
image: ghcr.io/mhsanaei/3x-ui:latest
container_name: 3xui_app
hostname: xxx.t1ltxz.ninja
volumes:
- $PWD/db/:/etc/x-ui/
- $PWD/cert/:/root/cert/
environment:
XRAY_VMESS_AEAD_FORCED: "false"
XUI_ENABLE_FAIL2BAN: "true"
tty: true
network_mode: host
restart: unless-stoppedNote: Note the XUI_ENABLE_FAIL2BAN: "true" setting. This is 3x-ui's built-in mechanism to automatically block IP addresses after failed attempts to brute-force web panel credentials or access secret routes.
Obtaining a domain certificate to secure the web management panel.
bash
# Install certbot sudo apt update && sudo apt install certbot -y # Issue certificate using Standalone mode (port 80 must be free) sudo certbot certonly --standalone -d your-domain.com # Copy certificates to the directory mounted in Docker mkdir -p ./cert sudo cp /etc/letsencrypt/live/your-domain.com/fullchain.pem ./cert/fullchain.pem sudo cp /etc/letsencrypt/live/your-domain.com/privkey.pem ./cert/privkey.pem sudo chown -R $USER:$USER ./cert/
Note: The ./cert/ path is mounted directly into the container at /root/cert/. Later, these paths are specified in the panel settings to enable HTTPS for the panel interface.
Launching the Docker container in background mode.
bash
docker compose up -d
Note: Upon the first run, 3x-UI initializes the built-in SQLite database at ./db/x-ui.db and applies the Fail2ban environment variable.
Changing default login credentials and setting up the HTTPS port.
text
1. Open your browser and go to: http://YOUR_SERVER_IP:2053 2. Default login credentials: - Login: admin - Password: admin 3. Go directly to Panel Settings: - Change Username & Password (REQUIRED!) - Panel Port: Set your custom port (e.g., 2096 or 8443) - Public Key File Path: /root/cert/fullchain.pem - Public Key Certificate Path: /root/cert/privkey.pem - Panel URL Path: Set a secret URL suffix (e.g., /my-secret-panel/) 4. Click "Save" and "Restart Panel".
Note: Configuring a secret URL path and changing default credentials protects the panel from automated public bot scans.
Step-by-step guide to creating the most censorship-resistant VLESS connection.
text
1. Go to "Inbounds" tab -> "Add Inbound". 2. Set basic parameters: - Remark: My-VLESS-Reality - Protocol: vless - Listening Port: 443 (or 8443) 3. In the Transport / Reality section: - Security: reality - Target / Dest: dl.google.com:443 (or www.apple.com:443 / icloud.com:443) - Server Names (SNI): dl.google.com - Short IDs: Generate using the "Get New" button - Key Pair: Click "Get New Key" to generate Private/Public keys 4. Add a Client: - Add Email/Username. - Flow: xtls-rprx-vision (for TCP optimization). 5. Save and click the QR code icon / link to import into clients (v2rayN, Happ, Streisand, Nekobox, Shadowrocket).
Note: VLESS-Reality disguises traffic as communication with trusted servers (Google, Apple, Microsoft) without requiring you to buy your own SSL certificate for VPN traffic (it uses the certificate of the specified cloak SNI).