3X-UI, Hiddify, or Marzban in 2026: How to Choose and Set Up a Self-Hosted VPN — Step-by-Step Guide

Introduction

In this practical guide, you’ll choose the right VPN panel for your self-hosted server in 2026, compare 3X-UI, Hiddify, and Marzban, set up a VPS, install the panel, create users, and test connections on your phone and computer. We’ll cover common pitfalls, provide clear instructions without unnecessary jargon, and by the end, you’ll have a fully functioning VPN with a modern setup and an easy-to-manage admin interface.

This guide is designed for beginners but also includes advanced sections: you’ll learn not just how to click buttons, but why certain settings matter and how to avoid issues. If needed, you can scale the solution for your family, a team, or a small business, and optimize your network for streaming, conferences, and gaming.

Helpful to know beforehand: basic Linux terminal commands, how to SSH into a server, and the practical difference between TCP and UDP. But even if you’ve never set up a VPN before — just follow the steps, and you’ll succeed.

Time estimate: 2–4 hours for initial setup, including buying a VPS, installing the panel, creating users, and testing clients. If you’re comfortable with Linux and Docker, it can take as little as 60–90 minutes.

Preliminary Preparation

Before getting started, ensure you have access to a cloud or physical server with a public IPv4 address. For best client compatibility in 2026, use the latest LTS version of Ubuntu Server or Debian. We’ll pick one panel to deploy practically but will show how to set up all three so you can compare.

Required Tools and Access

• Cloud server (VPS) or dedicated server with a public IPv4.
• SSH client on your computer (built into macOS and Linux; on Windows, use built-in or any terminal).
• Basic admin rights on the server (root or user with sudo).
• A domain name is recommended to get a TLS certificate and simplify client connections.

System Requirements

• OS: Ubuntu Server 22.04/24.04 LTS or Debian 12.
• CPU: 1–2 vCPUs enough for family or a small team.
• RAM: 1–2 GB for 3X-UI, 2–4 GB recommended for Hiddify and Marzban including panel, metrics, and buffer.
• Storage: 10–20 GB SSD.
• Network: stable 100 Mbps+ connection, open ports 22/SSH, 80/HTTP, 443/HTTPS, plus UDP ports for WireGuard if you plan to use it.

What to Install

• OS updates and essential utilities (htop, curl, tar, unzip, jq optional).
• Docker and Docker Compose plugin (from OS repositories).
• UFW or another firewall for basic protection.
• Fail2ban to reduce the risk of SSH brute-force attacks.

Backups

If migrating from an existing VPN, export user configs and keys in advance. For new deployments, simply create a local folder on your laptop to store exported files, manually created TLS keys, and docker-compose.yml files.

⚠️ Note: Check your local laws regarding VPN usage. This guide is for educational purposes only. You are responsible for complying with regulations in your country and for how you use your VPN connection.

Basic Concepts

Before choosing a panel, it’s important to understand a few terms in simple language.

• Self-hosted VPN — a VPN running on your own server with full control over logs, updates, and settings.
• Control Panel — a web interface for creating users, issuing configurations, enabling/disabling protocols, setting traffic limits, and more.
• Xray/Reality/Trojan/VMess/VLESS — popular protocols and traffic obfuscation methods to bypass blocks and enhance privacy. In 2026, VLESS-REALITY and Trojan remain solid choices.
• TLS/HTTPS — encrypted traffic with a domain-validated certificate, needed for security and smooth app operation.
• WireGuard — an ultra-light kernel-level VPN protocol offering high speed and stability. It can be a separate module or run alongside panels.
• Docker — containers simplify installation and updates without dependency conflicts.
• UFW/Firewall — basic shield for incoming connections, opening only required ports.

How it works: Clients on phones or PCs connect to your server using specified protocols and route internet traffic through your IP. The panel manages configurations and users, while Xray/WireGuard handle encryption and routing.

Key points: a stable server and regular updates are critical. Monitoring uptime is necessary. A domain with proper TLS reduces connection issues and builds client trust.

Step 1: Choosing a Panel with a Checklist

Goal of this step

You will determine which panel—3X-UI, Hiddify, or Marzban—best meets your needs and finalize your chosen stack on paper.

Instructions

1. Define your goal: a personal VPN, one for family, a team up to 20 people, or commercial user access.
2. Note priorities: speed and simplicity, flexible routing and anti-block obfuscation, integrations and billing.
3. Select at least one protocol: VLESS-REALITY for bypassing blocks, Trojan for resilience, plus WireGuard for gaming and high speed.
4. Match the panels: 3X-UI is lightweight and fast, perfect if you want minimal fuss and quick VLESS/Trojan setup. Hiddify is an all-in-one with built-in bypass presets, auto-configuration, great if you don’t want to dive deep into low-level tweaks. Marzban is an advanced panel with flexible user management and integrations, ideal for growth.
5. Make your choice: if you’re a total beginner seeking “minimal clicks”—start with 3X-UI. If you face heavy blocking and need presets—choose Hiddify. Thinking about managing dozens or hundreds of users? Go with Marzban.
6. Write down your plan: “Panel: … Protocols: … Domain: … Ports: … Number of users: …” This gives you a clear roadmap.

Tip: If unsure, start with 3X-UI for quick success in 30–60 minutes, then deploy Hiddify and Marzban on test ports in parallel to compare.

✅ Check: You have a chosen panel and protocol list, and your plan is written and clear.

Possible Problems and Solutions

• Can’t decide on a panel? Solution: start with 3X-UI, then switch if needed.
• Unsure about protocols? Solution: VLESS-REALITY and WireGuard cover most 2026 scenarios.

Step 2: Launching VPS and Preparing Linux

Goal of this step

Set up a server ready for panel installation with a sudo user, updated system, and open required ports.

Instructions

1. Create a VPS in a region close to you or your users. Choose Ubuntu 22.04/24.04 or Debian 12.
2. Save its public IPv4, root login, and password or key.
3. Connect via SSH: on macOS/Linux run ssh root@IP, on Windows use built-in SSH in terminal. Replace IP with your server's address.
4. Create an admin user: adduser vpnadmin. Enter password and details.
5. Grant sudo rights: usermod -aG sudo vpnadmin.
6. Enable automatic time syncing: timedatectl set-ntp true and set your timezone: timedatectl set-timezone Europe/Moscow (or your region).
7. Update system: apt update && apt upgrade -y.
8. Install essential utilities: apt install -y curl htop unzip tar jq.
9. Harden SSH: edit /etc/ssh/sshd_config, change Port to 2222, PasswordAuthentication to no (if using keys), PermitRootLogin to no. Save changes.
10. Configure UFW firewall: apt install -y ufw, then ufw default deny incoming, ufw default allow outgoing, ufw allow 2222/tcp, ufw allow 80/tcp, ufw allow 443/tcp. If using WireGuard, add ufw allow 51820/udp.
11. Enable UFW: ufw enable, confirm with Y. Reconnect via ssh -p 2222 vpnadmin@IP using the new port.
12. Install Fail2ban: apt install -y fail2ban, check service status systemctl status fail2ban.

⚠️ Warning: If you disabled SSH password authentication, make sure your keys work correctly to prevent losing access. Always verify you have an open session with key access before restarting sshd.

Tip: Document the ports you open—this helps when configuring panels and clients and troubleshooting.

✅ Check: You can SSH on port 2222 as vpnadmin, sudo returns root, UFW is enabled with correct ports open, and time/timezone are set correctly.

Possible Problems and Solutions

• Lost access after changing SSH port. Solution: use your VPS provider’s console to revert to port 22 or fix UFW rules.
• UFW blocking web access. Solution: ensure ports 80 and 443 are open and no conflicting deny rules exist.

Step 3: Installing Docker and Basic Security

Goal of this step

Prepare an environment for container-based panel installation, making updates and rollbacks easier.

Instructions

1. Install Docker from repositories: sudo apt install -y docker.io docker-compose-plugin.
2. Add vpnadmin to docker group: sudo usermod -aG docker vpnadmin, then log out and back in to apply group changes.
3. Check versions: docker --version and docker compose version should display without errors.
4. Create working directory: mkdir -p ~/vpn-panels && cd ~/vpn-panels.
5. Create subfolders for each panel: mkdir 3xui hiddify marzban.
6. Prepare directory for TLS and domain: mkdir -p ~/vpn-panels/certs and decide on a domain (e.g., vpn.example.com). Register your domain and set A record to your server IP via your registrar. Domain setup is not covered in this guide.
7. Check that ports 80 and 443 are free: sudo ss -tulpn | grep -E ':80|:443' should show no active services if panels aren’t running yet.

Tip: If running multiple panels on one server, assign each its own domain and unique panel ports to avoid conflicts on 80/443.

✅ Check: Docker is installed and commands work. Directories for panels and certificates exist. Ports 80/443 are free.

Possible Problems and Solutions

• Docker command not found. Solution: re-login or run newgrp docker. Confirm docker.io is installed.
• Ports 80/443 busy. Solution: stop unnecessary services or configure your reverse proxy to use different ports.

Step 4: Deploying 3X-UI — Quick Start

Goal of this step

Install the lightweight 3X-UI panel, quickly create your first VLESS-REALITY or Trojan config, and confirm connectivity.

Instructions

1. Go to the panel directory: cd ~/vpn-panels/3xui.
2. Create a minimal docker-compose.yml with the 3xui service using the image mhsanaei/3x-ui:latest, expose the admin web port (e.g., 2053), mount volumes for configs and logs, and set restart to always.
3. Create a .env file with variables: XUI_PORT=2053, XUI_USERNAME=admin, XUI_PASSWORD=your_strong_password (choose a 14+ character password).
4. Launch the panel: docker compose up -d. Check that the container status is healthy: docker ps.
5. Open the panel port in UFW: sudo ufw allow 2053/tcp.
6. Access the web interface: open your IP or domain on port 2053 with the protocol the panel specifies. Log in with credentials from .env.
7. Create your first instance: choose VLESS-REALITY or Trojan (stable and well-supported in 2026). Set port 443 for TLS service and your domain pointing to the server. Enable automatic certificate issuance.
8. Save the config and issue the TLS certificate. Wait for “issued” and “successfully bound” status.
9. Create a user: set login, traffic limit (e.g., 200 GB/month), expiration, and assign one or more devices. Save the user.
10. Download or copy the client config link: QR code or URI string.

Tip: Immediately create a second admin with a different password and disable the default built-in login if the panel allows. This improves security.

Expected Result

The panel is accessible on port 2053, the domain certificate is issued, a user with VLESS-REALITY or Trojan config is created, and you’re ready to test on your phone.

✅ Check: Scan the QR code in the client app on your smartphone and connect. Status should show "Connected," and the panel should display an active session.

Possible Problems and Solutions

• Certificate not issued. Cause: domain doesn’t point to your IP or port 80 is closed. Solution: verify your A record and UFW rules for ports 80/443, then retry issuing.
• Panel not opening. Cause: port 2053 not open. Solution: sudo ufw allow 2053/tcp and check docker container logs.
• Client won’t connect. Cause: incorrect port or server time mismatch. Solution: check timedatectl status and port config.

Step 5: Deploying Hiddify — Bypass Presets and Convenience

Goal of this step

Run the Hiddify panel in a container, get ready-made bypass presets, and centrally manage configs for multiple users and devices.

Instructions

1. Navigate to the panel directory: cd ~/vpn-panels/hiddify.
2. Create docker-compose.yml with the panel service using image hiddify/hiddify-manager:latest, expose admin port (e.g., 2087), mount config volumes, and set restart to always.
3. Create a .env file with admin credentials and domain: HIDDIFY_PORT=2087, ADMIN_USERNAME=admin, ADMIN_PASSWORD=strong_password, DOMAIN=vpn.yourdomain.
4. Start the panel: docker compose up -d and wait for container to run: docker ps.
5. Open admin port in UFW: sudo ufw allow 2087/tcp.
6. Log into the web interface and follow the setup wizard. Enable bypass modes: turn on VLESS-REALITY, add Trojan and extra obfuscations if needed. Set your domain and enable certificate issuance.
7. Save settings and wait for all components to show green status in the panel.
8. Create users or groups, assign expiration and limits. Generate configs in preferred formats including QR codes.
9. Optionally enable metrics and uptime monitoring within the panel to track current traffic usage.

Tip: Use different domains or subdomains for different protocols in Hiddify. This adds flexibility and resistance to filtering.

Expected Result

Hiddify runs on port 2087, certificate is issued, bypass presets activated, users created with ready-to-use client configs.

✅ Check: Connect from your phone and laptop with different protocols (e.g., VLESS-REALITY and Trojan), verify active sessions and growing traffic counters on the panel.

Possible Problems and Solutions

• Some presets fail to start. Cause: port conflicts or hung containers. Solution: check with docker ps, review logs, and change ports if 80/443 are busy.
• Certificates not issued. Cause: domain not resolving to server. Solution: verify DNS records with your registrar.

Step 6: Deploying Marzban — Scale and Control

Goal of this step

Launch Marzban in a container, set up users with varying limits and expiry dates, enable protocols, and ensure the panel suits scaling needs.

Instructions

1. Enter the panel directory: cd ~/vpn-panels/marzban.
2. Create docker-compose.yml with images: main marzban/gozargah:latest (or gozargah/marzban:latest), plus reverse proxy for ports 80/443, and config storage. Forward admin port, e.g., 2096.
3. Create .env with ADMIN_USERNAME, ADMIN_PASSWORD, MARZBAN_PORT=2096, DOMAIN=vpn.yourdomain.
4. Start the panel: docker compose up -d and verify with docker ps.
5. Open admin port in UFW: sudo ufw allow 2096/tcp.
6. Access the web interface, create the first admin user, configure domain, and enable certificate issuance.
7. Add protocols: VLESS-REALITY and Trojan. Specify ports and domain, ensuring no conflicts with other panels on the server.
8. Create plans: e.g., “Standard” — 200 GB, 2 devices, 30 days; “Premium” — 500 GB, 5 devices, 90 days.
9. Create users and assign them plans. Save configs and QR codes for clients.

Tip: Marzban is great for grouping users and integrating with external billing. If launching just for yourself now, plan your tariff structure for future ease.

Expected Result

The panel is available on port 2096, certificate issued, protocols enabled, plans created, and users active.

✅ Check: Connect as a test user. Confirm traffic counts per plan and accurate expiration display.

Possible Problems and Solutions

• Panel doesn’t issue certificate. Cause: domain not linked. Solution: add A record and retry.
• Port conflicts with other panels. Solution: change admin and service ports in docker-compose.yml and update UFW accordingly.

Result Verification

Checklist

• SSH access on a non-standard port works.
• UFW is active, only necessary ports are open.
• At least one panel (or all three on different ports) is accessible from the internet.
• Certificates are issued and valid.
• At least one user is created and loaded on the client side.
• Successful connection from phone and PC confirmed.

How to Test

1. Connect on your smartphone using Wi‑Fi and mobile data—both must work.
2. Test speed on any popular speed-test site—results depend on server plan and location.
3. Open various bandwidth-heavy resources (video, streaming, video calls) to verify stability.
4. Check the panel for growing traffic counters and active sessions.

Success Indicators

• Session setup time under 3 seconds.
• Stable connections held for 30–60 minutes without drops.
• Throughput meets expectations for your region and plan.

Common Errors and Fixes

• Issue: Panel won’t open. Cause: port blocked by UFW. Fix: add ufw allow port/tcp and check docker ps.
• Issue: Certificate not issued. Cause: incorrect DNS record. Fix: verify A record points to server IP and port 80 is open.
• Issue: Client can’t connect. Cause: server clock is off. Fix: enable NTP and set correct timezone.
• Issue: Low speed. Cause: bandwidth bottleneck or overloaded server. Fix: switch server region, upgrade plan, or enable WireGuard for users needing speed.
• Issue: Mobile network connections drop. Cause: aggressive filtering. Fix: use VLESS-REALITY with a well-planned domain, enable extra obfuscations in Hiddify.
• Issue: Port conflicts when running multiple panels. Cause: duplicate 80/443. Fix: use a shared reverse proxy and distinct subdomains or separate service ports.
• Issue: Forgot admin password. Cause: not recorded. Fix: recreate admin account via environment variables and restart the container.

Additional Features

Advanced Settings

• Reverse proxy and unified entry: run a lightweight proxy and assign each panel its own subdomain to avoid exposing admin ports on unusual ports.
• Parallel WireGuard: install wireguard-tools and bring up wg0 interface on port 51820/udp for fast gaming and low latency. Users can choose protocols per task.
• Domain rotation: prepare multiple subdomains in advance and switch them as needed to bypass local blocks.
• Backup: regularly export user configs from panels and save docker-compose.yml and .env files securely.

Optimization

• MTU and MSS: reduce MTU on tunnels or enable MSS clamping for mobile networks to avoid fragmentation.
• QoS: if the server is on your infrastructure, prioritize video call traffic.
• Staged updates: update Xray and panels during off-hours after snapshotting disks or backing up configs.

Tip: Keep a changelog file to track port, domain, and parameter changes. This speeds rollbacks.

Tip: For sensitive use, run a dedicated WireGuard-only server with limited users to simplify performance control.

Tip: Plan tariff structures early in Marzban to avoid manual user migrations later.

Tip: In 3X-UI, test encryption and obfuscation combos on a few users before broad deployment.

Tip: In Hiddify, start with one or two presets instead of enabling all at once to simplify troubleshooting if something breaks.

FAQ

Q: How quickly can I deploy a VPN if I have only one hour?
A: Pick 3X-UI with one domain, VLESS-REALITY on 443, create one user, and test connection. This minimal setup takes about 45–60 minutes with VPS and domain ready.

Q: What’s the best protocol in 2026?
A: For filtering resistance—VLESS-REALITY, for speed and gaming—WireGuard, for compatibility—Trojan. Use combinations depending on your needs.

Q: Is a domain necessary?
A: Recommended. It simplifies TLS issuance and often improves connection success in complex networks. Possible without, but more issues likely.

Q: Can I run multiple panels on one server?
A: Yes, segregate admin ports and configure 80/443 with reverse proxy and subdomains carefully to avoid conflicts.

Q: How do I know if my server can handle the load?
A: Monitor CPU and RAM with htop, check latency and speed during peak hours, watch logs for disconnects. Scale vertically or horizontally if limits are hit.

Q: What to pick for a family of 5–7?
A: 3X-UI or Hiddify with VLESS-REALITY plus a separate WireGuard profile for gaming covers 99% cases.

Q: What about 50+ users?
A: Marzban is ideal for flexible management, plans, traffic accounting, and integration readiness.

Q: What to do during mass blocking?
A: Prepare backup domains, enable extra obfuscations in Hiddify, keep a WireGuard profile as plan B, and consider servers in different regions.

Q: Can I avoid using Docker?
A: You can, but Docker simplifies updates and rollbacks. Without it, dependency conflicts are more likely.

Q: Where to store backups?
A: On encrypted local drives and protected cloud storage without public access. Test restorations regularly.

Conclusion

You’ve completed the full cycle: chosen a panel with a clear checklist, prepared your server, installed Docker, deployed 3X-UI, Hiddify, or Marzban, issued certificates, created users, and tested connections on phone and PC. Now you have a working self-hosted VPN with up-to-date protocols and settings for 2026.

Next, you can dive deeper into automation, add monitoring, plan backup schemes and scaling. If you need ready-made profiles for various regions or separate user groups, expand your panel collection or use the best-fit panel across multiple servers.

Tip: Evaluate total cost of ownership realistically: self-maintenance means time spent updating, monitoring, incident handling, and managing domains and addresses. If you need a quick setup without CLI hassle, check out vpn.how—a personal, not shared VPN server with dedicated IP per client, supporting WireGuard, OpenVPN, IKEv2, L2TP, SSTP; regions include Moscow, Saint Petersburg, Amsterdam, Frankfurt, London, New York, San Jose, Chicago, Singapore, Sydney, Madrid, Helsinki, Stockholm, Warsaw, Copenhagen, Stavanger; payments accepted via major Russian cards (including Tinkoff, Ozon), SBP, and crypto; plans start at ₽490/day or ₽2490/month with discounts for longer terms; auto-starts in 5 minutes after payment. No logs kept. This option makes sense when fast launch and minimal operational hassle are priorities.

Summary comparison:

• 3X-UI — minimal complexity and fast start. Perfect for personal or small groups.
• Hiddify — ready-made bypass presets and built-in logic for complex environments. Great for beginners needing an out-of-the-box all-in-one.
• Marzban — powerful choice for scaling, flexible plans, and managing large user groups.

Pick the path that best fits your goals and grow your infrastructure gradually. With this guide, you have the confidence and foundation to succeed and maintain your VPN long-term.