3xui + docker + nginx proxy manager

[zero-proger]

Question

I have such a problem.
I use 3xui in a docker container

services:
  xray:
    image: 'bigbugcc/3x-ui:latest'
    container_name: xray
    restart: unless-stopped
    networks:
      - npm_npm
    volumes:
      - './db:/etc/x-ui'
      - './cert:/root/cert'
      - ./logs:/var/log
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 1G
        reservations:
          cpus: '0.25'
          memory: 256M

networks:
  npm_npm:
    external: true

There is NPM (Nginx Proxy Manager) and its configuration in docker

services:
  npm:
    container_name: npm
    image: 'docker.io/jc21/nginx-proxy-manager:latest'
    restart: unless-stopped
    ports:
      - '81:81'
      - '80:80'
      - '443:443'
    volumes:
      - ./data:/data
      - ./letsencrypt:/etc/letsencrypt
    networks:
      - npm

networks:
  npm:
    driver: 'bridge'
    ipam:
      config:
        - subnet: 10.10.1.0/24
          gateway: 10.10.1.1
          ip_range: 10.10.1.0/24

They are on the same network and there is a rule in NPM to use the panel in the proxy-host.

Domain: xray.example.com
Scheme: http
Host: xray
Port: 2053
Certificate: Received by letsencrypt

Domain: vless.example.com
Scheme: http
Host: xray
Port: 8443
Certificate: Received by letsencrypt

---

When I want to create an inbound in the 3xui panel:

Protocol: vless
Port: 8443
Authentication: none
Transmission: TCP (RAW)
External proxy: vless.example.com (configured in NPM to forward port 443 to xray:8443)
Security: Reality
uTLS: Random
Target: vk.com:443
SNI: vk.com
Public Key (Private Key) Get New cert
Sniffing: HTTP TLS QUIC

---

For some reason, nothing works for me, I also tried different tranfers and different protocols.
I need to be sure to use port 443 to connect to vless.

Checklist

• This question is written entirely in English.

[Frew777]

VLESS + Reality behind Nginx Proxy Manager will not work because Reality requires end-to-end TLS that reaches Xray directly. NPM always terminates TLS and proxies at the HTTP layer, so it cannot forward a Reality handshake intact. HTTP-based transports like WS, gRPC, or xHTTP can be proxied through NPM, but Reality cannot. External Proxy settings only affect headers and real IP propagation — they do not enable raw TLS passthrough.

[Frew777]

VLESS + Reality cannot work behind Nginx Proxy Manager (NPM). This is not a 3x-ui bug, but a fundamental architectural limitation.

Reality is a VLESS transport that requires a direct, end-to-end TLS connection between the client and Xray. Xray must receive the original TLS ClientHello in order to handle SNI, uTLS fingerprinting, and Reality’s handshake logic. There must be no TLS termination or MITM proxy in between.

Nginx Proxy Manager is an HTTP reverse proxy. It always terminates TLS on itself and then forwards traffic at the HTTP layer (HTTP, WebSocket, or gRPC). NPM does not support raw TCP/TLS passthrough and does not forward the client’s TLS handshake to backend services.

Because of this:

• Reality traffic never reaches Xray intact
• Xray cannot process the Reality TLS handshake
• VLESS + Reality behind NPM is impossible by design

HTTP-based transports (VLESS over WebSocket, gRPC, or xHTTP) work with NPM because they are proxied at layer 7 after TLS termination. Reality is not an HTTP-based transport and cannot be encapsulated this way.

External Proxy / real IP settings in 3x-ui do not change this behavior. They only affect HTTP headers (e.g., X-Forwarded-For) and do not provide TLS passthrough.

To use VLESS + Reality, Xray must be exposed directly to the client or placed behind a layer-4 proxy that supports TLS passthrough and SNI-based routing (e.g., nginx stream, HAProxy). Nginx Proxy Manager cannot fulfill this role.

[Frew777]

I also tried setting up VLESS using this kind of scheme. I have a server running Nginx Proxy Manager on port 443. In theory, if NPM supported PROXY protocol, it would be possible to place a plain nginx in front of NPM as a front proxy and configure SNI-based routing there. However, this approach will not work in practice because NPM does not support PROXY protocol.
As a result, the client’s TLS connection cannot be forwarded intact, and transports like Reality cannot function behind NPM.

[zero-proger]

I understand that setting up streams in NPM won't help you achieve your goal?

[nebulosa2007]

https://github.com/XTLS/Xray-examples/tree/main/All-in-One-fallbacks-Nginx

[lxpcfc]

services:
xray:
networks:
- npm_npm

services:
npm:
networks:
- npm

they're in different networks

[zero-proger]

services: xray: networks: - npm_npm

services: npm: networks: - npm

they're in different networks

it's one network, they're just in different files, and npm has become npm_npm, by the name of the network and the service where it was created.