3AX-UI is a fork of 3x-ui with built-in support for the AmneziaWG protocol.
The A in the name stands for Amnezia — the protocol that is the key difference between this panel and the original.
Important
This project is intended for personal use only. Please do not use it for illegal purposes.
bash <(curl -Ls https://raw.githubusercontent.com/coinman-dev/3ax-ui/main/install.sh)To install the latest pre-release version:
bash <(curl -Ls https://raw.githubusercontent.com/coinman-dev/3ax-ui/main/install.sh) --betaThe original 3x-ui is built around the Xray core and supports VLESS, VMess, Trojan, Shadowsocks, and WireGuard. However, AmneziaWG — a modified WireGuard with traffic obfuscation — is not supported in the original.
3AX-UI solves this: AmneziaWG is integrated directly into the panel and managed exactly like any other protocol through the familiar inbounds interface.
AmneziaWG is WireGuard with added packet obfuscation. Standard WireGuard is easily detected and blocked by DPI systems (Russia, Iran, China). AmneziaWG makes traffic indistinguishable from random noise.
What's added:
- Dedicated AWG server settings page (network parameters, IPv4/IPv6 address pool, obfuscation parameters)
- AWG client management directly from the Inbounds page — just like VLESS or Trojan
- Per-client: automatic key generation (private, public, preshared), IP allocation from pool, QR code,
.conffile download - Traffic statistics collected every 10 seconds (upload/download per client)
- Traffic limits and expiry dates — same as all other protocols
The AWG settings page lets you configure packet obfuscation parameters:
| Parameter | Description |
|---|---|
Jc |
Number of junk packets before handshake |
Jmin / Jmax |
Minimum and maximum size of junk packets |
S1 / S2 |
Size of init/response headers |
H1 – H4 |
Magic headers for different packet types |
These parameters are automatically written into each client's config — no manual configuration needed.
AWG clients can be assigned a native public IPv6 address from the server — without NAT66. This works via NDP proxy (ndppd or a built-in fallback using ip -6 neigh add proxy). Clients receive a real IPv6 address, which matters for services that require it.
NDP proxy may not work on a VPS for reasons outside your server's control:
1. Hypervisor blocks NDP packets (MAC filtering)
Many providers allow a VPS to send packets only from its own network interface MAC address. When ndppd forwards a Neighbor Advertisement on behalf of a client, the hypervisor treats this as IP spoofing and drops the packet. Everything looks correct inside the VPS, but client IPv6 traffic never reaches the internet.
2. Provider assigns a "link prefix" instead of a "routed prefix"
NDP proxy only works when the IPv6 block is routed directly to your VPS. Many providers connect multiple VPSes to a shared virtual network and assign addresses from a common pool — in this case, NDP proxy at the VPS level won't help.
Contact your provider's support. You need to find out:
- IPv6 allocation type: is it a fully routed /64 prefix (routed to your VM) or an address from a shared pool (link prefix)? Only a routed prefix allows NDP proxy to work.
- Hypervisor-level NDP proxy: does the control panel have an option to enable NDP proxy / Neighbor Discovery at the host level?
- IP spoofing allowance: ask them to allow NDP packet forwarding from your VPS (disable MAC filtering for your interface at the hypervisor level).
Message template for provider support: "I'm running a server with multiple virtual network interfaces and need to assign individual public IPv6 addresses from my /64 block to each of them using NDP proxy. Could you please confirm whether my IPv6 allocation is a fully routed /64 prefix routed to my VM directly, and whether NDP Neighbor Advertisement packets originated from my VM are allowed through the hypervisor — or if they are dropped by MAC/ARP filtering on the host node?"
The install script (install.sh) automatically:
- Installs the AmneziaWG kernel module via PPA
ppa:amnezia/ppa - Installs
awg-toolsandndppd - Detects the server's external interface and configures PostUp/PostDown rules
- Sets up AWG autostart after server reboot
- Detects Secure Boot and warns about potential DKMS module issues
The panel settings include a QR Code Size option:
- 300×300 px — compact
- 450×450 px — standard (default)
- 600×600 px — large
On installation, the subscription URL path is automatically generated with a random 12-character suffix (e.g. /sub-Xk92mPqLvzRt/) instead of the default /sub/. This reduces the risk of accidental discovery.
- OS: Ubuntu 22.04+ / Debian 11+
- Linux kernel: 5.6+ (for built-in WireGuard), or an installed AmneziaWG DKMS module
- RAM: 1024 MB or more
- Architecture: amd64 / arm64
Secure Boot: If Secure Boot is enabled on the server, the AmneziaWG DKMS module may fail to load. The install script will warn you automatically.
# Stable release
bash <(curl -Ls https://raw.githubusercontent.com/coinman-dev/3ax-ui/main/install.sh)
# Latest pre-release
bash <(curl -Ls https://raw.githubusercontent.com/coinman-dev/3ax-ui/main/install.sh) --beta
bash <(curl -Ls https://raw.githubusercontent.com/coinman-dev/3ax-ui/main/update.sh)
bash <(curl -Ls https://raw.githubusercontent.com/coinman-dev/3ax-ui/main/update.sh) --beta
=======
# Specific version
bash <(curl -Ls https://raw.githubusercontent.com/coinman-dev/3ax-ui/main/install.sh) v1.0.0
>>>>>>> a89962fb (Use main branch in install commands)- Log into the panel → AWG Settings
- Configure network parameters and obfuscation settings
- Go to Inbounds → Add Inbound
- Select the amneziawg protocol, enter a client email, and click Create
- In the client table, click the QR code icon and scan it in the AmneziaVPN app
| Client | Platform | Link |
|---|---|---|
| AmneziaVPN | Android, iOS, Windows, macOS, Linux | amnezia.org |
Standard WireGuard clients are not compatible with AmneziaWG — they do not support obfuscation parameters.
3AX-UI is based on 3x-ui by MHSanaei. All original features (VLESS, VMess, Trojan, Shadowsocks, WireGuard, Xray, subscriptions, Telegram bot, etc.) are fully preserved.
- MHSanaei — author of the original 3x-ui
- alireza0 — author of the original x-ui
- Iran v2ray rules (GPL-3.0)
- Russia v2ray rules (GPL-3.0)
This project is distributed under the same license as the original 3x-ui — GNU GPL v3.