# Inbounds and protocols

> Define what users connect to, setting protocol, port, transport and security on the Server Network tab.

Source: https://joinnasnet.com/en/guides/nasnet-linux/server/inbounds/
Last updated: 2026-08-14

---

## Overview

An **inbound** is a listener on the server: a protocol, a port, a transport and
a security layer, identified by a **tag**. It is what a client's connection
actually lands on, and it is what a subscription hands out. Inbounds are not a
sidebar page of their own, because they live on the **Network** tab of the
[Server](/en/guides/nasnet-linux/server/) screen, alongside outbounds and
routing rules, because they are all facets of the same Xray configuration.

## Before you start

- Whatever port you choose must be open on the host firewall and, under Docker,
  published from the container.
- Pick the tag deliberately. Routing rules and subscriptions reference inbounds
  by tag, so renaming one later means touching everything that points at it.
- REALITY needs no certificate of your own, while plain TLS does. See
  [Certificates](/en/guides/nasnet-linux/certificates/).

## Steps

1. Open **Server** and go to the **Network** tab.
2. Under **Inbound Connections**, choose **Add Inbound**. If you already have
   inbounds configured directly in Xray, use **Discover** to pull them into the
   panel instead.
3. Work through the dialog's tabs from top to bottom. Tabs that do not apply to
   the protocol you chose are hidden, and a tab with a validation error shows a
   red dot.
4. On **General**, give the inbound a tag (for example `vless-tcp-reality`), an
   optional friendly name, a listen address and a port.
5. On **Network**, **Transport** and **Security**, choose the transport and the
   security layer. On **Protocol**, fill in the protocol-specific settings.
6. Save, then use **Sync** to push the configuration to the running core.
7. Grant the inbound to a subscription from the **Access** section of that
   subscription's detail sheet.

## Reference

| Dialog tab | What it holds |
| ---------- | ------------- |
| General | Tag, name, listen address, port, and an optional port range or list. |
| Network | The network the listener uses. |
| Transport | Transport settings for TCP, WebSocket, gRPC, HTTP/2 and the rest. |
| Security | The security layer: TLS, REALITY, or none. |
| Protocol | Settings specific to the chosen protocol. |
| Advanced | Sniffing and other lower-level options. |

| Field | What it does |
| ----- | ------------ |
| Tag | Unique identifier for this inbound. Referenced by routing rules and subscriptions. |
| Listen address | The address the listener binds to, for example `0.0.0.0`. |
| Port | The port clients connect to, and the port used in generated client links. |
| Port range | An optional range or list (`1000-2000`, or `80,443,8080`). The listener binds this range; the **Port** above is still what client links use. |

| Protocol | Notes |
| -------- | ----- |
| VLESS | Recommended; pairs with REALITY and XTLS Vision flow control. |
| VMess | The classic Xray protocol. |
| Trojan | TLS-based. |
| Shadowsocks | AEAD ciphers; the method is chosen on the Protocol tab. |
| Hysteria2 | Carries its own security settings. |
| WireGuard | Managed peers, tied to subscription lifecycle. |
| SOCKS, Mixed, HTTP, Dokodemo-door | Utility inbounds, mostly for local and forwarding use. |

Outbounds sit below inbounds on the same tab and define egress, which can be
direct (freedom), dropped (blackhole), or forwarded through an upstream proxy, with
routing and balancing rules deciding which outbound a connection takes. Each
outbound row can be tested from the panel and shows its **Test Result**.

## Troubleshooting

**Clients cannot connect to a new inbound.** Confirm the configuration reached
the core: after saving, **Sync** pushes it to the running Xray. Then check the
port is genuinely reachable from outside, and under Docker it must be in the
`app` service's published `ports`, not only open in the firewall.

## Related

- [Server](/en/guides/nasnet-linux/server/)
- [Hosts](/en/guides/nasnet-linux/server/hosts/)
- [Subscriptions](/en/guides/nasnet-linux/subscriptions/)
- [Certificates](/en/guides/nasnet-linux/certificates/)