Inbounds and protocols

Define what users connect to, setting protocol, port, transport and security on the Server Network tab.

Last updated Aug 14, 2026View as Markdown

Overview

An inbound is a listener on the server: a protocol, a port, a transport and a security layer, identified by a tag. It is what a client’s connection actually lands on, and it is what a subscription hands out. Inbounds are not a sidebar page of their own, because they live on the Network tab of the Server screen, alongside outbounds and routing rules, because they are all facets of the same Xray configuration.

Before you start

  • Whatever port you choose must be open on the host firewall and, under Docker, published from the container.
  • Pick the tag deliberately. Routing rules and subscriptions reference inbounds by tag, so renaming one later means touching everything that points at it.
  • REALITY needs no certificate of your own, while plain TLS does. See Certificates.

Steps

  1. Open Server and go to the Network tab.
  2. Under Inbound Connections, choose Add Inbound. If you already have inbounds configured directly in Xray, use Discover to pull them into the panel instead.
  3. Work through the dialog’s tabs from top to bottom. Tabs that do not apply to the protocol you chose are hidden, and a tab with a validation error shows a red dot.
  4. On General, give the inbound a tag (for example vless-tcp-reality), an optional friendly name, a listen address and a port.
  5. On Network, Transport and Security, choose the transport and the security layer. On Protocol, fill in the protocol-specific settings.
  6. Save, then use Sync to push the configuration to the running core.
  7. Grant the inbound to a subscription from the Access section of that subscription’s detail sheet.

Reference

Dialog tab What it holds
General Tag, name, listen address, port, and an optional port range or list.
Network The network the listener uses.
Transport Transport settings for TCP, WebSocket, gRPC, HTTP/2 and the rest.
Security The security layer: TLS, REALITY, or none.
Protocol Settings specific to the chosen protocol.
Advanced Sniffing and other lower-level options.
Field What it does
Tag Unique identifier for this inbound. Referenced by routing rules and subscriptions.
Listen address The address the listener binds to, for example 0.0.0.0.
Port The port clients connect to, and the port used in generated client links.
Port range An optional range or list (1000-2000, or 80,443,8080). The listener binds this range; the Port above is still what client links use.
Protocol Notes
VLESS Recommended; pairs with REALITY and XTLS Vision flow control.
VMess The classic Xray protocol.
Trojan TLS-based.
Shadowsocks AEAD ciphers; the method is chosen on the Protocol tab.
Hysteria2 Carries its own security settings.
WireGuard Managed peers, tied to subscription lifecycle.
SOCKS, Mixed, HTTP, Dokodemo-door Utility inbounds, mostly for local and forwarding use.

Outbounds sit below inbounds on the same tab and define egress, which can be direct (freedom), dropped (blackhole), or forwarded through an upstream proxy, with routing and balancing rules deciding which outbound a connection takes. Each outbound row can be tested from the panel and shows its Test Result.

Troubleshooting

Clients cannot connect to a new inbound. Confirm the configuration reached the core: after saving, Sync pushes it to the running Xray. Then check the port is genuinely reachable from outside, and under Docker it must be in the app service’s published ports, not only open in the firewall.