NX

A multi-node VPN control panel for modern proxy protocols.

One panel, any number of nodes, 20+ protocols, and subscriptions your clients already understand.

nx-panel.org · Documentation · Install

NX was called Nexora until v0.1.0.

NX is a two-part system for running a fleet of VPN servers from a single place.

Fleet management

• Nodes are stateless. Register one in the Panel, then bring it up with a single command copied from there: it installs the agent, fetches the Panel's client certificate with a one-time install token, generates its own server certificate and comes up under mTLS with trust-on-first-use pinning.
• Global pools of inbounds, outbounds and endpoints, composed into templates (pool items + routing + core settings) that are assigned to nodes.
• Live, incremental updates: adding a user or an inbound reaches running nodes without a restart, and every operation falls back to a full resync if anything goes wrong.
• Heartbeats, per-node traffic accounting, per-node traffic caps (weekly, monthly or yearly) that take a node offline until the next period starts, live log streaming, host metrics and a pinnable tile dashboard.

Users & subscriptions

• Volume quotas, expiry dates, scheduled resets and automatic enforcement.
• One subscription URL per user, rendered on the fly as v2ray share links, Clash / mihomo YAML, sing-box JSON, Xray JSON or plain text. Clash / mihomo and sing-box clients are detected from their User-Agent; everyone else gets the operator-chosen default format unless one is named in the URL, and the Clash, sing-box and Xray base templates are editable.
• Ready-to-import profiles for WireGuard (.conf) and OpenVPN (.ovpn), plus connection details (server URL and credentials) for OpenConnect / AnyConnect clients.

Operations

• Three roles: sudo (owner), admin (operators) and resellers, who see only the users they own and work within their own volume and expiry allowance.
• Bearer API tokens for integrations, signed event deliveries to webhooks and addons, an opt-in audit log of admin changes (who created, updated or deleted what), and an OpenAPI 3 specification served by the Panel itself.
• Certificates: self-signed (generated by the Panel and pinned in subscriptions) or ACME obtained by the node itself (HTTP-01, TLS-ALPN-01, or DNS-01 via Cloudflare, AliDNS or ACME-DNS), both renewed automatically — or bring your own. REALITY and ECH key generation built in.
• Admin UI in English, Persian (RTL), Chinese and Russian, with light, dark and high-contrast themes.

Everything the node engine supports is configurable from the Panel.

Per-user traffic accounting covers every user-carrying inbound and the WireGuard, OpenVPN and OpenConnect server endpoints.

Both install with one command: nx-panel/panel for the panel, and the command the panel shows for each node. Both are single self-contained binaries. The Node's NaïveProxy outbound links Chromium's cronet, which the release builds bundle for amd64, arm64, armv7 and 386. Container images are published with each tagged release.

• NX Panel is proprietary software, licensed per installation. Without a licence it runs on a free tier of 25 users and 1 node with every protocol and feature, so you can evaluate everything before buying. The Node needs no key of its own; the Panel's licence caps how many users it serves and how many nodes it drives.
• A license is a signed token bound to the Panel host's hardware fingerprint (HWID) that raises the per-resource limits. A licence is bought, renewed or moved from the License page in the admin UI (visible to the main admin), and installs itself once the payment is confirmed; a key received by hand is pasted on the same page. Licensed installations verify the key online periodically. See Licence.
• A key that is invalid, expired or issued for another machine is refused at activation with a clear error. If an installed key later expires or the hardware changes, the Panel does not go down — it falls back to the free tier.