Advantages of XHTTP

How XHTTP works. The transport imitates the behaviour of an ordinary web browser. Traffic is split into fragments that travel as standard HTTP requests (for example, POST or GET). Both HTTP/1.1 and HTTP/2 are supported.

To the provider it looks as if you are uploading pictures or sending data to a website through an API. Blocking such traffic without “breaking” half of the ordinary internet is very hard.

DANGER

The official sing-box core does not support the XHTTP transport. Use clients built on Xray-core version 1.8.10 or later.

Step 1. Server preparation and system requirements

We recommend using our servers at F3 Cloud – they fully meet the project's system requirements and are compatible with the instructions below.

Parameter	Minimum requirements
vCPU (virtual core)	From 1 core
RAM	From 1 GB
Storage	From 10 GB SSD
Operating system	Ubuntu 24.04 (recommended)

We suggest the DE-RZ9-1 configuration. It runs on an AMD Ryzen 9 5950X processor with a 1 Gbit/s port and fully covers the project's system requirements.

Step 2. Choosing the server configuration

After logging in or registering in the F3 Cloud panel, press Order service to go to the server selection.

The Order service menu shows the main plans first. To see the full list, press View all.

How to choose a server:

• on the DE-RZ9-1 card, press Order;
• in the server configuration, choose the Ubuntu 24.04 operating system;
• press Pay to complete the order.

The screenshot shows the order flow. In your case, choose Ubuntu 24.04 rather than Debian.

Step 3. Server activation

After payment, the order is processed automatically. Server activation usually takes no more than 2 minutes.

The “Processing” status means you need to wait a little.

You can follow the current status in the control panel. As soon as the server is ready, the status changes to Active.

INFO

Activation sometimes takes longer because of high load and an order queue in the chosen location. If the server has not been activated within 10 minutes, write to us in a ticket and we will check the order status promptly.

Step 4. Getting the server details

1. Wait until the server is fully activated.
2. In the client area, tick the checkbox next to the server and press Instruction in the top menu.
3. Copy the connection details from the instruction:
   • Server IP address;
   • Username;
   • Password.

The screenshot below shows where to find this information.

The server details are also sent to your email.

Step 5. Buying and configuring a domain

XHTTP with TLS needs your own domain pointing to the server's IP address. The cheapest domain from any registrar will do, for example reg.ru or Selectel.

TIP

Choose a neutral domain name that looks like an ordinary website, for example shaurma-ashotika.ru. Do not use vpn, proxy, xray, vless, reality or similar words in it. The domain name is sent in plain text (SNI), and such words are easy to match against a list.

The setup is shown using reg.ru as an example.

Enter the domain name and press Подобрать (Find).

The site will redirect you to the payment page, be careful here. Remove the .online domain from the order and keep only the .ru domain.

Then press Перейти в заказ (Go to order).

Do the same here: untick all the green checkmarks and keep only your .ru domain. Press Оплатить (Pay), and the site will take you to the registration page. Follow the registrar's instructions.

After payment you will get access to the registrar's client area and the domain settings. Follow the steps shown in the screenshots.

Press the round icon.

Press the tile with your domain.

Press “Изменить” (Edit).

Press the pencil icon next to the records.

Enter your server's IP address in the IP Address field.

Almost done. Now wait until the domain's new A record points to your VPS.

INFO

The A record tells the whole internet that your domain (for example, myserver.com) is bound to your server's IP address. Changes usually apply within a few hours, in rare cases up to 48 hours.

You can check the A record with dig myserver.com A +short. If the command prints your server's IP address, move on to the next step.

If the domain is served through Cloudflare, turn off proxying for this record (grey cloud instead of orange). Otherwise the connection goes through Cloudflare's servers rather than directly to your VPS.

Step 6. Setting up the server and the panel

Install any SSH client, for example Termius, PuTTY or PowerShell. Connect to the server over SSH (port 22) using the details you received after ordering the server.

1. Once connected, update the system:

apt update && apt upgrade -y
reboot # reboot after the update and connect again

TIP

You can set up the connection with our automatic script: https://github.com/yafoxins/3xui-autoinstall.

2. Connect to the server again and run the 3x-ui installation command:

bash <(curl -Ls https://raw.githubusercontent.com/mhsanaei/3x-ui/master/install.sh) v2.8.10

3. The installer offers to change the 3x-ui panel port:

Would you like to customize the Panel Port settings? (If not, a random port will be applied) [y/n]:
# answer "y" and press Enter
# when asked for the port, answer "8080" and press Enter

4. Install a certificate for the 3x-ui panel.

Choose option 2.

Enter nothing, just press Enter.

The panel login details. Open the address in a browser.

5. Create a connection in the panel.

Open the “Inbounds” section.

Create a connection.

Fill in the fields as in the screenshot, using your own values.

TIP

In the connection's TLS settings, set the uTLS field to the firefox or edge fingerprint instead of the default chrome. The Chrome fingerprint now raises suspicion with provider filters more often than others, because almost every VPN app uses it. The edge limitation described in our Reality articles does not apply to XHTTP with ordinary TLS.

DANGER

After every change to the connection settings, always press Get New ECH Cert. If the connection is unstable, try the stream-up, stream-one and packet-up modes one by one and pick the one that works best on your network.

Fill in the fields as in the screenshot and press Get New ECH Cert.

6. Go back to the terminal and press Ctrl+C. Now issue a certificate for your domain. Enter the commands one by one, using your own values:

curl https://get.acme.sh | sh -s email@example.com
~/.acme.sh/acme.sh --set-default-ca --server letsencrypt
~/.acme.sh/acme.sh --issue -d your-domain.ru --standalone

After the certificate is issued, the files are located here:

Certificate: /root/.acme.sh/your-domain.ru_ecc/fullchain.cer
Key: /root/.acme.sh/your-domain.ru_ecc/your-domain.ru.key

7. Enter these paths in the 3x-ui connection settings in the Public key and Private key fields and save the connection.

8. The connection is ready. Press the QR code and import it into your VPN client.

Step 7. Server security

To set up fail2ban for the 3x-ui panel, do the following:

1. Connect to the server over SSH.
2. Enter sudo x-ui.
3. Open the IP Limit Management section by entering 21.
4. Choose Install Fail2ban and configure IP Limit and confirm with y.

WARNING

Before configuring UFW, move SSH from port 22 to another port using our guide. The new port must be opened with ufw allow YOUR-PORT/tcp, otherwise you will lose access to the server.

Configuring UFW is also required:

• open the connection and panel ports with ufw allow 443/tcp and ufw allow 8080/tcp;
• enable the firewall with ufw enable and confirm with y.

Set up the remaining protection measures without fail using our detailed guide.

Which client to use

Only clients built on Xray-core support XHTTP. We recommend:

• Incy – iPhone, iPad, Mac, Android, Windows, macOS and Linux. Currently available in the Russian App Store;
• Happ – all platforms. Removed from the Russian App Store, so iPhone and Mac need an Apple ID from another country;
• v2rayN – Windows, macOS and Linux, v2rayNG – Android.

Download links are collected in the Marzban article. Clients based on the sing-box core (Hiddify, NekoBox, Throne) do not work with XHTTP.

WARNING

On iPhone, VPN apps run with a strict memory limit. XHTTP can cause short spikes in memory use, so the system force-quits the process and the connection drops. If this happens, try another XHTTP mode or the Shadowrocket client (paid).