3x-uiOutbounds & Routing
Shape egress in 3x-ui — WARP and NordVPN outbounds, outbound subscriptions (server pools), routing rules, and load balancers.
Inbounds accept clients; outbounds decide where their traffic goes next. 3x-ui can route traffic through Cloudflare WARP, NordVPN, or arbitrary outbound pools imported from a subscription, and select between them with routing rules and balancers.
Editing outbounds & routing
Outbounds, routing rules, balancers, DNS, and logging all live in the Xray configuration (the config template you edit under Xray Settings). There's no separate per-rule UI — you edit the JSON, and the panel reloads Xray. The panel also offers an outbound connectivity test and a route test (ask the running core which outbound a given destination would use).
Cloudflare WARP
WARP lets your server egress through Cloudflare's network. 3x-ui can register a
WARP account for you and wire it into a WireGuard outbound tagged warp:
Add a warp-tagged outbound
Create a WireGuard outbound with the tag warp in your Xray config.
Register WARP
From the panel's WARP controls, register an account. 3x-ui fills the outbound's keys, addresses, reserved bytes, and peer endpoint automatically.
(Optional) auto-rotate the IP
Set a WARP update interval (in days) to periodically rotate the WARP IP. A free license can also be applied.
Route the traffic you want (for example specific domains) to the warp outbound
with a routing rule.
NordVPN
3x-ui can fetch NordVPN (NordLynx/WireGuard) credentials from an access token (or accept a private key directly) and list countries/servers, so you can build a NordVPN outbound.
Outbound subscriptions (server pools)
An outbound subscription imports a remote share-link subscription and injects its servers as outbounds into the running Xray config — without touching your saved template. This is the recommended way to subscribe to a pool of servers.
| Field | Default | Meaning |
|---|---|---|
url | — | The remote subscription URL (SSRF-guarded). |
tagPrefix | auto | Prefix for generated outbound tags (e.g. hk-); blank = subN-. |
updateInterval | 600 | Refresh interval in seconds. |
prepend | false | Place these outbounds before your manual ones. |
priority | 0 | Merge order (lower first). |
Imported outbounds get stable tags: the same server keeps the same tag across
refreshes, so exact-tag routing/balancer selectors stay pinned — while
prefix/wildcard selectors (e.g. hk-*) automatically pick up new servers as the
pool changes. Supported link schemes: vmess, vless, trojan, ss,
hysteria2 (hy2), and wireguard (wg). The panel refreshes enabled
subscriptions on a timer and reloads Xray when something changes.
Balancers
Reference outbound tags (including wildcards) in an Xray balancer to spread or fail over traffic across a pool. The panel can report balancer status and let you override a balancer to a specific outbound for testing.
Outbounds that reach external services are fetched with SSRF protection — by default private/internal addresses are blocked unless you explicitly allow them per source.