MaxVPN
MaxVPN
MaxVPN runs a MaxVPN fleet through its masters (the fleet's control planes): the VPN nodes and forwarders, the people subscribed to them, and the links and profiles their apps fetch. MaxSuite mirrors each master's nodes, probes them every five minutes, and keeps a history the master cannot keep itself. Changes made here are sent to the master, which carries them out on the boxes.
In the sidebar under Domains & network → MaxVPN.
A toolbar has Refresh (and Add master, with maxvpn:admin). Where you have more than one master, most tabs ask which master to show.
Overview
Nodes up, Users online, Masters and Never probed, then the whole fleet in one table.
Nodes
Every node with its status and latency. A search box finds an account on every node at once. Click a node to open its drawer:
- Accounts: the node's accounts across Trojan, WireGuard, Snell and ShadowTLS. With the right permission you can add an account, read a client config, set limits, or remove an account. Live counters show each account's traffic and whether it is online.
- Settings: name, country, provider, SNI, the two TLS switches, the client DNS, and the node's own resolver.
- Diagnostics: Run health check, Read TLS certificate, DNS leak test, Probe now and Check accounts, then the repairs Re-sync accounts, Sync streaming domains, Repair auto-renew and Enforce quota & expiry now.
- Operations (with
maxvpn:admin): renew the certificate, back up the node, reinstall it, copy accounts from another node, restore from a backup, and move it to a new box. - Activity: the master's long jobs for this node, with progress.
Add a node
- Put the master's SSH key on the new box first (under Fleet).
- On Nodes, click Add node (needs
maxvpn:admin). - Choose the Kind: VPN node — full proxy stack, or Forwarder — kernel NAT relay only.
- Enter its address, and either a Subdomain prefix (MaxSuite writes the DNS record) or an Existing domain already pointing at the box.
- Optionally give a Country code and a Name, then submit. Follow the install under Activity.
Only a person can add a node, from the page. No agent tool does it.
Set a quota or expiry
In the drawer, click Limits on a Trojan account and set a Quota (GB), an Expires date, or both. Reaching either cuts the account off at the next hourly check.
Repair a node
- Check accounts finds a node that answers but refuses logins; Re-sync accounts fixes it.
- Repair auto-renew fixes unattended certificate renewal without restarting anything.
- Renew certificate and Reinstall run for minutes over SSH and can take the node off the air.
Subscribers
People with one credential and one subscription link across many nodes.
- Create a New subscriber.
- Under Nodes, put them on the nodes they should reach. Each creates a real account on that node.
- Under Sources, add nodes, catalogue configs, whole shared subscriptions, or single nodes of a proxy subscription, and choose what each contributes: Every protocol, Trojan only or Snell + ShadowTLS only.
- Under Links, hand over the subscription link or the managed Surge profile. Revealing a link needs
maxvpn:secrets.
Each subscriber shows usage by day, week or month. Issue a new link lets existing clients run until they refresh. Rotate password cuts everyone off now. Both need maxvpn:admin.
Forwarders
Relay legs. A forwarder runs no VPN software; it passes traffic on to a VPN node's exit address. Each shows its health and which accounts it can carry.
Configs
The master's catalogue of client configs, which subscribers can carry beside the fleet's own nodes. You can rename an entry or change its note.
Static & proxy subs
Static subscription files the master serves as they are, and other providers' subscriptions it re-serves from a cache. A proxy subscription can be pointed at a new upstream link, fetched again, and its nodes renamed for subscribers.
Fleet
Settings and history for the whole master: usage history by day, week or month, Default DNS, Names, Backups (fleet-wide backup and restore), SSH key, Admins (Telegram) and the Audit log.
The people under Admins can drive the master from Telegram. They bypass MaxSuite's permissions entirely, so that list is worth reading.
Masters
The connected control APIs, each with whether its last sync worked.
- Click Add master (needs
maxvpn:admin). - Enter a Name, the master's Control API address and a Token minted on the master. The token is stored encrypted and never shown again.
- Click Sync to bring in its nodes. Test checks that it answers.
Who can do what
| Permission | Label | Lets you |
|---|---|---|
maxvpn:read | View nodes, their status and their traffic | See every tab, node, relay, subscriber and report, without credentials |
maxvpn:write | Sync a master, and change what is recorded about a node | Sync and test masters; add and remove accounts and subscribers; change node settings, DNS, relays, sources and limits |
maxvpn:secrets | Reveal a client config — a working credential for a node | Read an account's client config and a subscriber's links |
maxvpn:admin | Hold the master credential — add, retoken or remove a control plane | Add, edit and remove masters; add nodes; run node operations; rotate links and passwords; manage Telegram admins and the SSH key |
What happens on its own
Notices go to the person who connected the master. See Notifications and alerts.
| Job | When | What it does |
|---|---|---|
poll | Every 5 minutes | Syncs each active master's node list, then probes every node. Says when a node goes down or comes back. |
check-limits | Every hour at minute 10 | Enforces quotas and expiry dates, and says whose accounts were cut off. |
cert-check | Every day at 07:20 UTC | Lists certificates about to expire, and whether unattended renewal will save each. |
daily-report | Every day at 08:00 UTC | Reports what the fleet did over the last day. |
daily-backup | Every day at 03:40 UTC | Makes each master take a backup and keep it. Says so when one fails. |
usage-summary | Every Monday at 09:00 UTC | One summary per master of who used what over the week. |
Needs
Nothing else needs to be switched on. You need a running MaxVPN master and a token from it.
What agents can do
No tool returns a password, a link or a backup's contents, and no tool adds a node. Reads run straight away. Every other tool asks a person first unless a standing rule allows it. See Agents and approvals.
Watch the fleet (read-only)
maxvpn.overview,maxvpn.nodes,maxvpn.node,maxvpn.nodeDetail(with relay layout),maxvpn.nodeHistory,maxvpn.nodeStats(live counters),maxvpn.nodeHealth,maxvpn.nodeCert,maxvpn.expiringCerts,maxvpn.accountReport,maxvpn.dnsLeakTest,maxvpn.migratePreflight,maxvpn.jobs,maxvpn.job.- Asks first:
maxvpn.probeNode(probe now),maxvpn.report(send the fleet report to you now).
Masters
- Read-only:
maxvpn.masters,maxvpn.admins,maxvpn.auditLog. - Asks first:
maxvpn.testMaster,maxvpn.syncMaster,maxvpn.backupMaster(backup of the whole fleet now).
Repairs and node settings (asks first)
maxvpn.resyncXray,maxvpn.fixAutorenew,maxvpn.syncStreamDomains,maxvpn.setNodeSettings,maxvpn.detectGeo,maxvpn.standardiseNames.- Read-only:
maxvpn.namePreview(what standardising names would do).
DNS
- Read-only:
maxvpn.nodeDnsLive,maxvpn.dnsDefaults,maxvpn.cloudflareLookup. - Asks first:
maxvpn.setNodeDns,maxvpn.setNodeOsDns,maxvpn.importDns,maxvpn.setDnsDefaults.
Accounts on one node
- Read-only:
maxvpn.nodeUsers,maxvpn.searchAccounts. - Asks first:
maxvpn.addUser,maxvpn.removeUser,maxvpn.setUserLimits,maxvpn.syncUsers,maxvpn.checkLimits.
Subscribers
- Read-only:
maxvpn.subscribers,maxvpn.subscriber,maxvpn.subscriberProfile,maxvpn.subscriberSources. - Asks first:
maxvpn.addSubscriber,maxvpn.removeSubscriber,maxvpn.setSubscriberNode,maxvpn.setSubscriberProfile,maxvpn.setSubscriberSource,maxvpn.setSubscriberProtocols,maxvpn.setSubscriberMirrorNode(one node of a proxy subscription instead of the whole feed).
Usage (read-only)
maxvpn.subscriberUsage,maxvpn.usageSummary,maxvpn.usageHistory(whole fleet for a day, week or month),maxvpn.subscriberUsageHistory(one subscriber, with the trend).
Relays
- Read-only:
maxvpn.forwarders,maxvpn.forwarderHealth,maxvpn.relayUsers. - Asks first:
maxvpn.addRelay,maxvpn.removeRelay,maxvpn.setSubscriberRelay.
Catalogue and shared subscriptions
- Read-only:
maxvpn.catalogue,maxvpn.sharedSubscriptions,maxvpn.mirrorNodes(the nodes of one proxy subscription). - Asks first:
maxvpn.editCatalogueEntry,maxvpn.refreshProxySubscriptions,maxvpn.setMirrorNodeName.
Over MCP the same tools are named maxvpn__overview and so on. See API keys and MCP access.