Security Best Practices

Harden your V2RayTun deployment with these security recommendations.

Secure the Panel Server

Use a Firewall

Only expose the ports you need. A minimal ufw setup:

Bash

ufw default deny incoming
ufw default allow outgoing
ufw allow ssh
ufw allow 80/tcp
ufw allow 443/tcp
ufw allow 62050/tcp
ufw enable

Disable Root SSH

Edit /etc/ssh/sshd_config:

Text

PermitRootLogin no
PasswordAuthentication no

Use SSH key authentication exclusively. Restart sshd after changes.

Keep the OS Updated

Bash

apt update && apt upgrade -y

Enable automatic security updates:

Bash

apt install -y unattended-upgrades
dpkg-reconfigure -plow unattended-upgrades

Panel Security

Register Immediately

The /register endpoint is open until the first admin account is created. Create the admin account immediately after installation to lock registration.

Use Strong Passwords

Choose a strong admin password (16+ characters). If using API tokens, treat them as secrets — never commit them to version control.

Restrict Panel Access

If the panel is only used by administrators, consider restricting access by IP using Caddy:

Text

panel.example.com {
    @blocked not remote_ip 203.0.113.0/24
    respond @blocked 403
    reverse_proxy frontend:3001
}

mTLS Communication

All panel-to-node communication uses mutual TLS by default. V2RayTun generates a private CA and issues certificates for each node.

Certificate Rotation

Regenerate node certificates periodically:

Delete the node in the panel.
Re-create it to generate new certificates.
Re-deploy the node with the new certificate set.

Protect Certificate Files

Ensure certificate files are readable only by root:

Bash

chmod 600 /opt/v2raytun/certs/*
chmod 600 /opt/v2raytun-node/certs/*

Network Security

Use Separate Servers

Run the panel and nodes on separate servers. If a node is compromised, the panel and user database remain protected.

Change Default Ports

Modify default protocol ports to reduce automated scanning:

AmneziaWG: change from 51820 to a random high port.
Hysteria2: change from 8443 to a random high port.

Update the corresponding host configurations in the panel to reflect the new ports.

Monitor Traffic

Use vnstat or similar tools to monitor traffic patterns and detect anomalies:

Bash

apt install -y vnstat
vnstat -l -i eth0

API Security

Use API tokens instead of admin credentials for automation.
Set short expiration times on JWT tokens.
Rotate API tokens regularly.
Never expose the panel API to the public internet without authentication.

Backups

Automate daily backups with v2raytunsetup backup.
Store backup archives off-server (S3, another VPS, or local download).
Encrypt backup files if storing in shared or cloud storage:

Bash

gpg -c /opt/v2raytun/backups/backup-latest.tar.gz

See Backup & Restore for the full backup guide.