X-NET v1.4.7

X-NET v1.4.7 — DNS-Based Reverse Proxy

✨ New Features

1. DNS-Based Tunnel Transport

• Added DNS transport mode alongside direct TLS transport.
• Communication between public and private nodes through DNS resolvers.
• TLS 1.3 encryption with Forward Secrecy and dedicated encryption keys for each reverse proxy.
• HMAC packet authentication to prevent forged packets from being accepted.
• Secure authoritative DNS server that never operates as an Open Resolver.
• Support for 8 resolver selection strategies.
• Automatic MTU detection and temporary exclusion of unhealthy resolvers.
• Simultaneous packet transmission through multiple resolvers.
• Traffic pattern obfuscation using randomized packet padding and query timing jitter.
• DNS over TCP support.
• 24 optional advanced settings across 5 configuration groups.
• 6 predefined configuration profiles:
  • Highly Unstable Network
  • Unstable Network
  • Balanced
  • Good Network
  • Stable and Clean Network
  • Hard to Detect
• Resolver health monitoring, including latency, packet size, packet loss, and query statistics.

2. Panel Access Through the Tunnel

• Nodes can access the management panel through the reverse proxy tunnel whenever direct connectivity fails.
• End-to-end TLS encryption and node authentication.
• Supports both connection directions.

3. Agent Offline Configuration Persistence

• Agents automatically save their latest received configuration to disk.
• If an agent restarts while the panel is unreachable, its tunnels can be restored using the previously saved configuration.

4. Connection Limits and Traffic Quotas

• Configurable maximum simultaneous connections per reverse proxy (1–256).
• Automatic service deactivation when the traffic quota is exhausted.
• Hourly backup traffic quota verification.
• Persistent traffic accounting across tunnel disconnections and reconnections.
• Manual traffic counter reset.
• Live connection monitoring, including:
  • Client IP address
  • Connection type
  • Connection duration
  • Upload traffic
  • Download traffic

5. Improved Node Reporting

• Private-node events are now displayed in the panel event history.
• Agents automatically report their supported capabilities to the panel.
• DNS transport can be enabled for nodes behind NAT that cannot be directly reached by the panel.

6. Updated Connection Guide

• Added step-by-step instructions for configuring and verifying DNS transport.
• Added documentation for DNS configuration profiles and how to select them.
• Added connection limit and traffic quota documentation.
• Added instructions for accessing the panel through the tunnel.
• Expanded and improved the troubleshooting section.

Connection Guide: Available in the Reverse Proxy section of the panel.

🐞 Bug Fixes

• Translated 31 previously untranslated strings in the SSH settings and backup recovery sections into English, Russian, and Chinese.

⬆️ Upgrade Instructions

• Update the panel and all agents to version 1.4.7.
• DNS transport, agent-side connection limits, live connection monitoring, and panel access through tunnels require all participating nodes to run the new version.
• DNS transport cannot be enabled for agents running older versions.
• Database changes are additive and applied automatically.
• Existing reverse proxies remain unchanged and continue using direct TLS transport without connection limits or traffic quotas.

⚠️ Important Notes

• The tunnel domain must be resolvable through DNS resolvers accessible from the private node's network.
• UDP port 53 must be available on the public node and allowed through the hosting provider's firewall.
• On Ubuntu, the systemd-resolved service may already be occupying port 53.
• DNS transport is significantly slower than direct TLS and is intended for basic web browsing and messaging, not video streaming.
• Newly installed agents must connect to the panel at least once to receive and save their initial configuration.

Install the latest version:

apt update
bash <(curl -fsSL https://raw.githubusercontent.com/xpanel-cp/x-net/main/install/xnet.sh)

X-NET v1.4.6

🔒 New Feature: Block the Source IP of a Confirmed Account-Sharer

Previously, when the panel detected two devices using the same SSH account at once, it could only kill the extra session — the offending device would simply reconnect a moment later and leak a bit more traffic on every cycle. Now you can stop that at the network level:

• New "Ban confirmed sharer's IP" setting under SSH connection-limit enforcement. When sharing is confirmed (every session involved was carrying real traffic — not an inference about a dead connection), the extra device's source IP is denied at the host firewall, for a configurable duration (10s–24h, default 10 minutes; 0 = disabled).
• New "Blocked IPs" admin section: shows every currently-banned IP, the account it was banned for, the reason, and when the ban expires — with a one-click Unblock button for an IP that was banned by mistake (no need to wait out the timer).
• Bans are stored in the database, so they survive a panel restart, and are lifted automatically once their timer expires.
• This never applies to a "dead reconnect" kill — only to a confirmed-sharing or lock-to-IP-mismatch verdict — so a legitimate user who simply dropped and reconnected from the same address can never be locked out by it.

🐛 Bug Fixes: the ban wasn't actually blocking anything

Two real bugs in the host-firewall layer meant a "banned" IP could still get through:

• ufw: the deny rule was appended to the end of the rule list. Since the panel's own "open this port" rule has no source restriction and is always inserted first, that rule matched before the ban ever got a chance to. The deny rule is now inserted at position 1.
• firewalld: the rich-rule ban was added without --permanent, so the very next --reload discarded it before it ever blocked a packet.
• New: nftables fallback. A host that runs neither ufw nor firewalld (a deliberate choice on some servers, since both would also gate the panel's own ports) now gets IP banning anyway — through a dedicated nftables chain, hooked ahead of any existing rule, that blocks the IP on every port and protocol without touching the host's existing firewall configuration at all.

---

Install the latest version:

apt update
bash <(curl -fsSL https://raw.githubusercontent.com/xpanel-cp/x-net/main/install/xnet.sh)

X-NET v1.4.5

✨ New Feature: Automatic IP Rotation (Cloudflare DNS Rotation)

A brand-new IP Rotation module has been added to the panel, exclusively for Super Admins.

• Secure Cloudflare integration using an AES-256-GCM encrypted API token. The token is never displayed again after being saved.
• Select the desired domain and A record directly from Cloudflare.
• Unlimited IP pool with individual IP entry, bulk import, and drag-and-drop reordering.
• Deterministic and reliable FIFO rotation across IPs, automatically returning to the beginning of the list. The rotation order is preserved even after panel restarts.
• Three scheduling modes: Manual, Interval-based (every 1/3/6/12/24 hours), or Daily at a specific time with a configurable time zone.
• TCP-based IP health checks before each rotation (explicitly not ping/ICMP), with a configurable failure threshold for automatically excluding unreachable IPs and restoring them when they become reachable again.
• Comprehensive statistics dashboard, execution history, and a built-in guide on how to obtain a Cloudflare API token.
• Full translations in all four panel languages: Persian, English, Russian, and Chinese.

🐛 Bug Fixes: Reseller Quotas

• Account renewals can no longer bypass reseller quotas. Previously, renewing SSH or VPN accounts did not affect the reseller's account-count or allocated traffic limits, allowing unlimited renewals. Now, every renewal deducts from both the reseller's account-count quota and traffic quota, just like creating a new account.
• Renewal duration for SSH/VPN accounts in the reseller panel is now fixed at exactly 30 days — no more, no less. This is enforced for both account creation and editing and cannot be bypassed through frontend manipulation.
• Deleting an account only frees up its account-count quota. Used traffic, including traffic consumed through renewals, remains permanently charged against the reseller's quota unless manually reset by a Super Admin.
• These changes are protected by transactional locking to prevent concurrent requests from exceeding quota limits.
• These changes apply exclusively to the Reseller role. Super Admin and Operator functionality remains unchanged.

---

Install the latest version:

apt update
bash <(curl -fsSL https://raw.githubusercontent.com/xpanel-cp/x-net/main/install/xnet.sh)

X-NET v1.4.4

Reseller Quotas, Permissions & Usage Management

• Fixed a quota-bypass gap on renewal: a reseller already over their account/traffic limit (e.g. after an admin lowered it) could previously keep renewing or re-activating existing accounts indefinitely. Renew and Activate now re-check the quota.
• Deleting an account no longer frees up quota. Traffic already consumed by a deleted SSH/VPN account now stays counted against the reseller permanently, via a new persistent ledger — closing a loophole where repeated create/delete cycles let a reseller exceed their real allocation.
• New per-reseller permission controls, independently configurable without granting full inbound/node management access:
  • Allow/deny deleting their own accounts (defaults to the existing behavior for current resellers).
  • Restrict which VPN inbounds a reseller may use.
  • Restrict which SSH protocols a reseller may offer.
• VPN client deletion is now available to Resellers for their own accounts (previously Super Admin only), gated by the new delete permission.
• System Administrators tab: new Allocated / Consumed / Remaining traffic columns per reseller, and a Super-Admin-only Reset usage action to clear a reseller's deleted-account traffic credit (never touches live accounts or history).
• Full Persian / English / Russian / Chinese translations for all new UI text.
• API Documentation Improvements

Security hardening

• Fixed a fail-open bug where unreadable or malformed permission data (e.g. a stale session for a deleted admin) could grant unrestricted access instead of being denied.
• Fixed a race condition that could double-count a deleted account's traffic credit under concurrent duplicate delete requests.
• Closed a gap where re-activating a suspended account could bypass the over-quota check that renewal already enforced.

UI fixes

• Fixed unreadable/invisible button and status-pill colors in dark mode across the System Administrators table and several action buttons (caused by invalid color codes that silently failed to render).
• Fixed table column headers breaking mid-word across several pages.
• Fixed a corrupted Persian translation for "Unlimited".
• Fixed black/near-black card borders incorrectly appearing in light mode.
• Fixed unreadable hover-state text on several buttons in dark mode.
• Terminal/log/code preview panels (system logs, SSH config preview, API sandbox, import & bulk-create logs, certificate console) now properly follow light/dark theme instead of always rendering dark.

Upgrade notes

apt update
bash <(curl -fsSL https://raw.githubusercontent.com/xpanel-cp/x-net/main/install/xnet.sh)

X-NET v1.4.3

✨ New Features

• Port Forwarding: Added support for forwarding any port to a local service on the same server. For example, an SSH service running on port 22 can also be accessed through port 9000. Manage forwarding rules from the new Port Forwarding tab in Global Settings.
• Bulk Account Transfer: You can now select multiple accounts in SSH Account Management and Subscription Management and transfer them to another reseller or the Super Admin in a single operation.
• Automated Telegram Backups: Automated panel backups through the Telegram bot have been re-enabled, providing a backup storage option independent of the main server.

🐛 Important Bug Fixes

• Fixed a Critical Node Editing Bug: Editing a node, such as changing its IP address after moving it to a new server, could unintentionally overwrite its secure connection key and leave the node permanently offline. This issue is now fixed. The node's connection key is preserved when editing its settings unless you explicitly change it.
• Fixed the Node Retry Button: The Retry button now works as expected for nodes that are stuck or unresponsive.
• Fixed SSH Port Display: The SSH account creation form now displays the actual configured port for resellers and operators instead of incorrectly defaulting to port 22.
• Fixed SSH Settings Reset: SSH settings are now preserved after the core service restarts instead of reverting to their default values.

⬆️ Upgrade to v1.4.3

Upgrade to X-NET v1.4.3 to get the latest features, fixes, and improvements.

apt update
bash <(curl -fsSL https://raw.githubusercontent.com/xpanel-cp/x-net/main/install/xnet.sh)

Thank you for supporting the X-NET project! ❤️

X-NET v1.4.2

✨ New Features

• Dedicated Reseller Dashboard

  • User statistics, active/online users, traffic usage, and charts are now displayed only for accounts and subscriptions created by the respective reseller.
  • This scoping applies to both the regular dashboard and the live dashboard (WebSocket).

• Shared Reseller Traffic Quota

  • Administrators can set a traffic limit (maxTrafficLimitBytes) for each reseller.
  • This quota is shared across the reseller's SSH and VPN accounts.
  • When an account is created or renewed, the actual traffic quota usage is checked and deducted from the shared pool.
  • The reseller dashboard displays used traffic, the total limit, and the remaining quota in real time.

• SSH Account Deletion by Resellers

  • Resellers can delete SSH accounts they created themselves.
  • They cannot delete accounts created by other resellers.

• Advanced SSH Account Search

  • SSH account search now supports mobile phone numbers in addition to usernames and remarks.

• Redesigned SSH Welcome Banner

  • Introduced a new Banner system with a simple enable/disable toggle.

  • Ready-to-use and fully editable templates are provided for four languages:

    • 🇬🇧 English
    • 🇮🇷 Persian
    • 🇷🇺 Russian
    • 🇨🇳 Chinese

  • Each account can have its own Banner language.

  • A global default language is used when no language is specified for an account.

• New Banner Variables

  • {trafficPercent} — traffic usage percentage
  • {trafficBar} — text-based traffic progress bar

• Full xnet-ssh-info Localization

  • SSH connection information now supports all four languages.

---

🔄 Changes & Improvements

• Reseller account-count and traffic quotas are now actually enforced on the Backend using atomic operations.
• SSH and VPN account creation and renewal now consume traffic from the reseller's shared traffic pool.
• The default concurrent connection limit for new SSH accounts has been changed from 2 to 1.
• Frontend role detection has been centralized, so different pages now use a single source of truth for determining the current administrator's role.
• Inbound Management access has been removed from the Reseller role.
• Resellers can still select an Inbound when creating a Subscription; the related issue has been fixed.
• The Panel Version change card has been removed from the reseller dashboard. This feature is now available only to Super Admins.
• The SSH Global Settings layout has been redesigned, removing unnecessary empty space between cards.
• Fixed the brief appearance of unauthorized Sidebar items during a hard page refresh for resellers.
• Removed the misleading Telegram Backup toggle from the UI. Telegram backup delivery had already been disabled in the Backend.
• Several UI strings that were always displayed in English regardless of the selected language have been corrected and fully localized across all four supported languages.

---

🐛 Bug Fixes

• Fixed reseller access to dashboard data belonging to other users.
• Fixed the display of Clients belonging to other administrators/resellers in shared Inbound client lists.
• Fixed reseller traffic quotas not being actually enforced during account creation or renewal.
• Fixed the issue preventing resellers from selecting an Inbound when creating a Subscription.
• Fixed the temporary display of unauthorized Sidebar items during page reloads.
• Fixed the Panel Version change card being displayed to unauthorized users.
• Fixed the old static SSH Welcome Banner text being displayed alongside the new custom Banner.
• Fixed multiple untranslated UI strings throughout the panel.

---

🔐 Security

WebSocket Data Leakage Prevention

Previously, the Realtime Dashboard channel could send global panel statistics to connected users without properly enforcing their role or data ownership.

In v1.4.2, the WebSocket feed is now fully scoped by Role and Ownership, just like the regular API endpoints. Resellers can only receive realtime information belonging to their own resources.

Inbound Client Data Leakage Prevention

Inbound Client lists are now filtered according to ownership. Resellers can no longer view Clients belonging to other administrators or resellers.

Atomic Quota Enforcement

Account-count and traffic quotas are now enforced using locked, atomic transactions. This prevents concurrent requests from allowing a reseller to exceed their assigned limits.

Prevention of Unauthorized Quota Escalation

Administrative management endpoints are restricted to Super Admins. Security regression tests confirm that Resellers/Agents cannot increase or modify their own quota or the quota of another reseller.

SSH Account Ownership Enforcement

Resellers can only delete SSH accounts that they created themselves. They cannot delete accounts belonging to other resellers.

---

🧪 Testing & Validation

• Added and executed regression tests for reseller quota restrictions.
• Verified atomic enforcement of both Account Quota and Traffic Quota.
• Tested unauthorized reseller quota escalation paths.
• Verified WebSocket Dashboard and Inbound Client list scoping.
• Verified SSH account deletion permissions based on ownership.
• Verified Banner and xnet-ssh-info localization.
• Verified Frontend and Backend changes for Role/Permission consistency and regression issues.

---

📌 Release Summary

X-NET v1.4.2 focuses heavily on Reseller Management, real quota enforcement, data isolation, and security.

Resellers can now:

• View only their own data.
• Manage only their own resources.
• Operate under real account and traffic quotas.
• No longer exceed their assigned limits, even through concurrent requests.
• Receive no data belonging to other resellers through the Dashboard, WebSocket, or Inbound Client lists.

The SSH Welcome Banner system has also been completely redesigned and localized in four languages, while a range of UI, localization, permission, and UX issues have been resolved in this release.

apt update
bash <(curl -fsSL https://raw.githubusercontent.com/xpanel-cp/x-net/main/install/xnet.sh)

X-NET v1.4.1

✨ New Features

SSH User Contact Information

• Added two independent contact fields for each SSH account: Mobile Number and Telegram ID, separate from the username and notes.

• Smart validation:

  • Mobile numbers accept digits only. Persian/Arabic numerals are automatically converted to English digits.
  • Telegram IDs accept English letters, numbers, and _.
  • The @ prefix can be entered but is automatically removed when saved.

Redesigned SSH User Create/Edit Form

• The previous single long-form interface has been divided into four dedicated tabs:

  • Basic
  • Subscription
  • Contact Information
  • Advanced

• When creating a new user, the form now uses a step-by-step Wizard flow.

• The final Confirm & Deploy button is shown only on the last step.

• When editing an existing user, all tabs remain freely accessible.

Start Subscription on First Connection — Now Available During Editing

• The Start validity on first connection option, previously available only when creating an account, can now also be configured while editing accounts that have not yet been activated.
• For accounts whose subscription has already started, the option is displayed as read-only to prevent data inconsistencies.

Automatic Post-Expiration Actions

Each SSH account can now have a specific action configured after its subscription expires:

• No action
• Notify administrator
• Automatically disable
• Notify + automatically disable

Additional options include a configurable delay after expiration:

• Immediately
• 1 day
• 2 days
• 3 days
• 7 days
• Custom delay

Notifications use the existing Telegram bot and the panel's existing system log.

Important: Automatically disabling expired accounts remains the panel's default behavior and does not depend on this setting. This feature adds an additional notification/action layer and does not replace the existing expiration enforcement.

SSH Lock to IP — New Feature

• SSH accounts can now be locked to a specific IP address.

• Connections from any other IP are detected at the server level and automatically terminated.

• Supported protocols:

  • SSH TCP
  • Dropbear
  • WS
  • WS-TLS

• A smart grace period and cooldown mechanism prevents a temporary reconnect from terminating a valid session or causing repeated disconnect/reconnect loops.

• Known limitation: Due to the current architecture, which relies on external stunnel/dnstt components for SSH TLS and SlowDNS, this feature is currently unavailable for those two protocols because the panel does not have access to the client's real IP address on those paths.

• This feature directly addresses user reports regarding the limitations of the previous IP Limit functionality.

---

🐛 Bug Fixes

Critical Panel Stability Fix

A critical stability issue has been completely fixed.

If the panel's Telegram bot was not configured or became unavailable, the panel could stop responding after a certain number of login/API requests (approximately 100 requests). This affected the entire panel, not just Telegram — including login and API requests — until the service was restarted.

This issue has been fully resolved.

Telegram availability or downtime can no longer block the panel's core functionality.

Fixed Subscription Renewal for Accounts Pending First Connection

Renewing an account that had not yet connected (the Pending state) could incorrectly start its subscription immediately.

This caused the reported issue where an account could effectively lose several days of its validity after being renewed.

The behavior is now corrected:

• Renewal of a pending account only extends its pending period.
• The subscription does not start prematurely.
• Validity begins according to the account's configured first-connection behavior.

Fixed Expiration-State Inconsistency

In certain edge cases, an unrelated account edit — such as changing a note — could incorrectly reset the internal post-expiration action state.

This has been fixed and covered by automated tests to prevent regression.

Fully Fixed Allow Insecure Handling

Previously, the Allow Insecure option (skip SSL certificate verification) was applied only to share links.

It had no effect on:

• sing-box JSON
• Clash

As a result, there was no reliable way to disable certificate verification for those output formats.

This has now been fully corrected.

The behavior is consistent across all three output formats:

• Share Links
• sing-box JSON
• Clash

The Allow Insecure setting can now be properly enabled or disabled across all supported outputs.

apt update
bash <(curl -fsSL https://raw.githubusercontent.com/xpanel-cp/x-net/main/install/xnet.sh)

X-NET v1.4.0

With the release of version 1.4.0, new features and important improvements have been added to enhance connection stability and user management. 🔥

✨ Version 1.4.0 Changelog

🔹 Reverse Proxy Added
Support for Reverse Proxy, along with a complete documentation guide available in the same section of the panel.

🔹 Fixed Frequent SSH Disconnections
Improved SSH connection stability and resolved issues causing frequent disconnections.

🔹 Fixed User Expiration Bug After Traffic Limit Is Reached
Resolved an issue where users were not properly expired after reaching their traffic limit.

🔹 Concurrent SSH Connection Limits
Added precise configuration options for detecting and enforcing concurrent SSH connection limits:

⏱ Detection Delay (Seconds)

The amount of time required to detect concurrent connections.

🔄 Repeat Interval (Seconds)

Defines the interval between repeated checks and enforcement of connection limits.

These settings allow you to manage how concurrent SSH connections are detected and restricted according to your requirements.

apt update
bash <(curl -fsSL https://raw.githubusercontent.com/xpanel-cp/x-net/main/install/xnet.sh)

X-NET v1.3.0

✨ sing-box 1.14.0 Compatibility

• 🔄 Updated DNS configuration for sing-box 1.14
• 🔧 Added full WireGuard / WARP support with the new endpoints structure
• 🛠️ Updated Hysteria v1 configuration fields
• 🧩 Improved rule_set handling and core stability
• 🌐 Fixed DNS settings and added a real DNS Inspector
• 🧭 Fixed Routing rules and multi-value domain / ip / geosite / geoip handling
• 🔍 Added a server-side Routing decision simulator
• 🔗 Unified Domain selection for Subscriptions, Configs, and QR Codes

📦 Core

sing-box 1.14.0

apt update
bash <(curl -fsSL https://raw.githubusercontent.com/xpanel-cp/x-net/main/install/xnet.sh)

X-NET v1.2.9

What's New

• Optimized the core panel engine for better performance and stability
• Added built-in panel update functionality directly from the dashboard
• Improved node management and node operation performance
• Enhanced backup and restore system reliability
• Improved bot module code structure and performance
• Fixed SSH account connection/disconnection issues

Improvements

• Overall system stability improvements
• Code optimization across multiple panel components
• Better reliability during panel operations and maintenance