Article 40: Multi-User and Multi-Protocol Deployments: Centralizing Access

Introduction: The Centralized Proxy Hub

A high-quality V2Ray deployment is rarely limited to a single user or a single protocol. For personal use, an administrator may require separate access methods for a laptop (using stealthy VLESS over wSS/TLS) and a mobile phone (using fast, loss-resilient TUIC). For commercial or group use, the server must efficiently handle dozens of individual users, each requiring unique authentication and policy enforcement.

Multi-User and Multi-Protocol Deployment is the practice of configuring a single V2Ray core instance to act as a centralized hub, hosting multiple Inbounds, protocols, and user IDs simultaneously. This centralized approach offers crucial benefits: simplified maintenance, unified traffic routing, and consolidated user management. This article details the methodology for successfully integrating different protocols and numerous users into one resilient server.

Section 1: The Multi-User Foundation: Client Tagging

The foundation of multi-user management in V2Ray is the ability to assign a unique identifier to each user and map that ID to a specific policy (Article 6 and 39).

1. Unique Authentication (UUIDs and Passwords)

For high-security protocols like VLESS and VMess, each user must be assigned a unique UUID (Universally Unique Identifier).

• VLESS/VMess: Each user gets their own UUID entry in the Inbound’s clients array.
• Trojan/Shadowsocks/Hysteria: These protocols often rely on a shared password or token. In these cases, separate user access is managed either by assigning different tokens for different policy levels, or by relying on V2Ray’s ability to map traffic based on the source IP (which is less reliable).

2. Policy Mapping (level)

Each unique user identifier (UUID) must be assigned a numerical level in the configuration. This level is the direct link to the Traffic Shaping and Quality of Service (QoS) policies defined in the policy object.

• Example: A standard user is assigned level: 0 (with bandwidth limits), while a premium user is assigned level: 1 (with high priority and unlimited bandwidth). V2Ray instantly applies the policy associated with the level upon successful connection.

This separation ensures that one user’s bandwidth abuse or security failure does not affect the service quality or security of others.

Section 2: Multi-Protocol Centralization (The Inbound Array)

V2Ray is designed to listen for multiple protocols simultaneously on different ports, or even on the same port via the Reverse Proxy Fallback mechanism. This flexibility allows the administrator to offer several access options from a single server IP address.

1. Hosting Multiple Ports

The most straightforward method is hosting different protocols on dedicated ports:

Protocol	Port	Primary Purpose
VLESS over wSS/TLS	443/TCP	Maximum Stealth and CDN Compatibility
TUIC	443/UDP	Low Latency and Stability on Lossy Links
Shadowsocks	20000/TCP	Compatibility for legacy clients or fast internal relays

By having distinct Inbounds in the inbounds array, V2Ray monitors all these ports and protocols simultaneously.

2. The Port 443 Multi-Protocol Hub

Advanced deployments often consolidate all traffic onto the highly trusted Port 443 (TCP/UDP) to maximize camouflage.

• TCP 443: Used for VLESS over wSS/TLS and Trojan. V2Ray uses the initial handshake data (TLS SNI or Trojan password) to distinguish between the two and route the connection to the correct internal processor.
• UDP 443: Used simultaneously for QUIC-based transports (TUIC, Hysteria), as UDP port conflicts are less common than TCP conflicts.

This concentration provides maximum stealth by ensuring all external traffic appears to be standard HTTPS communication.

Section 3: Unified Management and Automation (The API)

Managing dozens of UUIDs and checking individual traffic usage manually is impossible. Multi-user deployment relies entirely on the V2Ray API (Article 38) for automation.

1. Real-Time User Provisioning

Instead of editing the static config.json, the administrator uses an external management panel (like a web interface) that communicates with the V2Ray API’s HandlerService.

• API Action: When a new user subscribes, the panel sends a command to the API to instantly inject a new UUID into the VLESS Inbound.
• Immediate Effect: The user receives their UUID and can connect immediately, without the V2Ray service ever needing to restart.

2. Automated Usage Tracking and Suspension

The V2Ray API’s StatsService provides the foundation for managing user consumption.

• Data Collection: An external script periodically queries the API for the uplink and downlink usage for every UUID.
• Enforcement: When a user’s total consumed data (e.g., 500 GB) hits the policy limit, the external script uses the API to instantly remove that user’s UUID from the V2Ray configuration, effectively suspending their access until the next billing cycle.

This automated cycle is mandatory for running a stable, fair, and profitable multi-user service.

Section 4: Routing and Traffic Isolation

In a multi-protocol setup, the Routing object (Article 19) becomes highly critical for ensuring traffic isolation and efficiency.

1. Inbound-Specific Routing

Each Inbound must have a unique tag (e.g., vless-wS-in, tuic-in). Routing rules can then be created to ensure that traffic arriving via one protocol is treated differently than another.

• Example: Traffic arriving via the tuic-in (UDP) Inbound is inherently less stealthy than wSS. Therefore, a routing rule could be created to block geosite:category-malware only for traffic arriving via the UDP Inbound, adding an extra layer of caution to the less-camouflaged traffic.

2. Protocol-Specific Outbounds

Multi-protocol deployment often requires creating dedicated Outbounds to manage traffic flow efficiently.

• High-Speed Relay Outbound: All traffic arriving from the standard stealth Inbound (wSS/TLS) is routed to a high-speed relay Outbound using a faster, lower-overhead protocol (like raw VMess/TCP) to reach the final internet destination.
• Primary Direct Outbound: The system’s main Freedom Outbound, used for local routing, is still the final step for traffic that must bypass the tunnel.

Section 5: Best Practices for High-Resilience Multi-User Deployments

1. Hardware Capacity

Multi-protocol deployment increases CPU load due to the diverse cryptographic requirements (VLESS is light, but TLS handshake processing is heavy). Administrators must choose a VPS with at least two dedicated CPU cores and adequate RAM (4GB+) to handle dozens of concurrent connections and the multiple protocol stacks running simultaneously.

2. Strict Security Boundary

The V2Ray core should be the only application listening on the public-facing ports (443/TCP, 443/UDP). All management access (API, Nginx, etc.) must be strictly confined to the private 127.0.0.1 address space.

3. Subscription Management (Client-Side)

For the client, managing multiple protocols is simplified through a single subscription link (Article 20). The management panel provides one link that contains multiple configurations (VLESS, TUIC, Shadowsocks), allowing the user to switch seamlessly between protocols based on their current network condition (e.g., switch to TUIC when on mobile data, switch to VLESS when on stable fiber).

Conclusion: Orchestrating the Proxy Fleet

Multi-user and multi-protocol deployment transforms a single server into a versatile proxy fleet, capable of handling diverse user needs and network conditions. By mastering policy levels, user identification, the API for automation, and strategic routing, administrators can consolidate all access methods into one highly manageable and resilient core. This centralized, automated approach is the final stage of V2Ray mastery, ensuring maximum efficiency, fairness, and long-term stability for a growing user base.