How to Install Xray REALITY on Debian 13 Using 3x-ui
Xray REALITY is an advanced transport protocol designed to obscure proxy traffic by masquerading as standard TLS connections to legitimate third-party domains without requiring your own domain name or certificates. By utilizing existing public TLS certificates from popular websites, REALITY eliminates certificate fingerprinting and domain-registration footprints.
3x-ui is an enhanced, multi-protocol web management panel for Xray-core that simplifies the deployment, configuration, and monitoring of Xray services. It features an intuitive graphical interface for managing inbounds, client credentials, traffic quotas, and advanced cryptographic parameters such as REALITY public/private key pairs and short IDs.
This guide walks you through installing 3x-ui on Debian 13 (Trixie), configuring system security and prerequisites, accessing the management interface, and provisioning an Xray VLESS-REALITY inbound proxy server.
Prerequisites
- A server or virtual machine running Debian 13 (Trixie) with root privileges
- Basic familiarity with Linux terminal commands and networking concepts
- Outbound network connectivity on standard web and TLS ports (80, 443, 2053)
Key concepts
Xray REALITY Protocol
REALITY is an extension of the VLESS protocol that eliminates the need for purchasing a domain or generating Let’s Encrypt certificates. The server proxies the TLS handshake directly from a target camouflage server (such as www.microsoft.com or dl.google.com), authenticating authorized clients via elliptic-curve cryptography (X25519) while presenting valid third-party certificates to external observers.
3x-ui Web Panel
3x-ui is an open-source management interface built on top of Xray-core. It provides an SQLite-backed web panel to generate and rotate client UUIDs, configure protocol routing rules, monitor per-client bandwidth, and manage system firewall ports seamlessly.
1. Update System Packages and Install Dependencies
Before installing 3x-ui, update your Debian package index and install the essential utility packages including curl, tar, openssl, and ca-certificates. These tools are required to retrieve the installation payload, manage archive extraction, and generate cryptographic keys.
apt-get update && apt-get install -y curl tar openssl ca-certificates ufw jq socat
Observed result: Output from the successful recorded run:
Get:1 file:/etc/apt/mirrors/debian.list Mirrorlist [30 B]
Get:2 file:/etc/apt/mirrors/debian-security.list Mirrorlist [39 B]
Get:3 https://deb.debian.org/debian trixie InRelease [140 kB]
Get:4 https://deb.debian.org/debian trixie-updates InRelease [47.3 kB]
Get:5 https://deb.debian.org/debian trixie-backports InRelease [54.0 kB]
Get:6 https://deb.debian.org/debian-security trixie-security InRelease [43.4 kB]
Get:7 https://deb.debian.org/debian trixie/main Sources [10.5 MB]
Get:8 https://deb.debian.org/debian trixie/main amd64 Packages [9678 kB]
Get:9 https://deb.debian.org/debian trixie/main Translation-en [6486 kB]
Get:10 https://deb.debian.org/debian trixie-updates/main Sources [1840 B]
Get:11 https://deb.debian.org/debian trixie-updates/main amd64 Packages [4412 B]
Get:12 https://deb.debian.org/debian trixie-updates/main Translation-en [2496 B]
Get:13 https://deb.debian.org/debian trixie-backports/main Sources [318 kB]
Get:14 https://deb.debian.org/debian trixie-backports/main amd64 Packages [330 kB]
Get:15 https://deb.debian.org/debian trixie-backports/main Translation-en [241 kB]
Get:16 https://deb.debian.org/debian-security trixie-security/main Sources [239 kB]
Get:17 https://deb.debian.org/debian-security trixie-security/main amd64 Packages [264 kB]
Get:18 https://deb.debian.org/debian-security trixie-security/main Translation-en [162 kB]
Fetched 28.6 MB in 30s (943 kB/s)
Step 1 · Update System Packages and Install Dependencies
Expected result: All base dependencies are installed and the Debian package repositories are up to date.
Note: Debian 13 includes modern cryptographic libraries and systemd by default.
2. Run the verified updated command
Run the command shown below, then execute the verification checks for this step.
printf 'y\nadmin\nAdminSecure2025!\n2053\n' | bash <(curl -Ls https://raw.githubusercontent.com/mhsanaei/3x-ui/master/install.sh) /usr/local/x-ui/x-ui setting -username admin -password 'AdminSecure2025!' /usr/local/x-ui/x-ui setting -port 2053 apt-get install -y sqlite3 sqlite3 /etc/x-ui/x-ui.db "UPDATE settings SET value = '' WHERE key = 'webBasePath';" systemctl restart x-ui
Observed result: Output from the successful recorded run:
The OS release is: debian
Arch: amd64
Running…
Get:1 file:/etc/apt/mirrors/debian.list Mirrorlist [30 B]
Get:2 file:/etc/apt/mirrors/debian-security.list Mirrorlist [39 B]
Hit:3 https://deb.debian.org/debian trixie InRelease
Hit:4 https://deb.debian.org/debian trixie-updates InRelease
Hit:5 https://deb.debian.org/debian trixie-backports InRelease
Hit:6 https://deb.debian.org/debian-security trixie-security InRelease
Reading package lists…
Reading package lists…
Building dependency tree…
Reading state information…
curl is already the newest version (8.14.1-2+deb13u5).
tar is already the newest version (1.35+dfsg-3.1).
tzdata is already the newest version (2026c-0+deb13u1).
socat is already the newest version (1.8.0.3-1+deb13u1).
ca-certificates is already the newest version (20250419).
openssl is already the newest version (3.5.7-1~deb13u3).
The following additional packages will be installed:
bsd-mailx cron-daemon-common exim4-base exim4-config exim4-daemon-light
libevent-2.1-7t64 libfile-fcntllock-perl libgdbm-compat4t64
libgnutls-dane0t64 libidn12 liblockfile-bin liblockfile1 libnsl2 libperl5.40
libunbound8 perl perl-modules-5.40
Step 2 · Run the verified updated command
Expected result: Verification succeeds and includes: active; 2053
3. Generate REALITY Keypair and Verify Xray-Core
Verify that Xray-core is functioning correctly and generate an X25519 cryptographic key pair using Xray’s built-in cryptographic tool. These keys form the basis of the REALITY handshake authentication between clients and your server.
/usr/local/x-ui/bin/xray-linux-amd64 x25519
Observed result: Output from the successful recorded run:
PrivateKey: 2PNAD1lxG1GBupuR47FZWtW1F43osWENCFs_048Jrmk
Password (PublicKey): rNLboXB7Ha3PN8oyOey4ZWDP7Qw2ELlI5q44AQGs4ms
Hash32: 0yF15nQmBHGeLFCEZsR467kzOkCfFToDPAuOL3prffw
Step 3 · Generate REALITY Keypair and Verify Xray-Core
Expected result: A valid PrivateKey and matching PublicKey pair are generated by the Xray binary.
Note: The Private Key is stored on the server inside the inbound configuration, while the Public Key is distributed to client configs.
4. Verify the updated browser flow
Open http://debian13.test:2053 and perform the actions shown below.
Open http://debian13.test:2053 in your browser.
- Enter admin in Username.
- Enter the validated disposable credential in Password.
- Click Log in.
Step 4 · Verify the updated browser flow
Expected result: The page displays: Restart
5. Verify the updated browser flow
Open http://debian13.test:2053/panel/inbounds and perform the actions shown below.
Open http://debian13.test:2053/panel/inbounds in your browser.
- Enter reality in Search.
- Click General Actions.
- Click Export All URLs.
Step 5 · Verify the updated browser flow
Expected result: The page displays: Total Inbounds
How the final setup works
The 3x-ui panel runs as a background systemd service listening on port 2053, managing the core Xray service. Inbound proxy traffic connects to Xray via VLESS over TCP/REALITY (port 443), masquerading as outbound TLS traffic to an approved camouflage domain.
Troubleshooting
Unable to access the 3x-ui web dashboard on port 2053
Likely cause: The x-ui systemd daemon is inactive or local firewall rules are blocking incoming TCP traffic on the dashboard port.
Fix: Check service status using ‘systemctl status x-ui’ and ensure port 2053 is open using ‘ufw allow 2053/tcp’ or nftables rules.
REALITY inbound fails to handshake with camouflage server
Likely cause: The configured SNI (Server Name Indication) camouflage domain does not support TLS 1.3 or uses conflicting ALPN negotiations.
Fix: Select a well-known TLS 1.3-compatible destination such as dl.google.com or www.microsoft.com:443 in the REALITY inbound settings.
Useful commands
Check 3x-ui service status
systemctl status x-ui
Restart 3x-ui service
systemctl restart x-ui
View Xray core logs
journalctl -u x-ui -e --no-pager
Access 3x-ui CLI management utility
x-ui
Conclusion
You have successfully installed and configured 3x-ui on Debian 13 (Trixie). The web management panel is active on port 2053, and Xray-core is ready to provision VLESS-REALITY inbounds for censorship-resistant proxying.
- Installed prerequisites and deployed 3x-ui with systemd service supervision
- Verified Xray-core binary functionality and generated X25519 REALITY cryptographic keys
- Authenticated to the web dashboard and navigated inbound proxy and panel configuration interfaces
