Secure the XProxy Dashboard: Password & IP Whitelist
Protect your XProxy dashboard with a password, an IP whitelist or domain-only access. You set it up in General Settings → System Setting → Security, and the SSH password and the dashboard port are in the same page.
You need: the dashboard open on your local network. Dashboard password, IP whitelist and domain-only access are included on every plan, Free too (Pricing).
In short
Switch on Dashboard Auth and set a username and password. The IP whitelist, Force LAN Auth and Tailscale options all need it.
Add your IPs to the whitelist, or switch on Domain Only to refuse visits by IP address.
Change one setting at a time. Check that you can still open the dashboard before you close the window.
How do I protect the dashboard?
Step 1 of 2
Open General Settings → System Setting and click the Security tab. In Password Authentication for dashboard, switch Dashboard Auth on 1.
Type a Username 4 and a Password 5, then click Save 6.
Who can open the XProxy dashboard?
The box checks every visit in this order. The first rule that fits lets the visitor in.
| The visitor is | What it needs |
|---|---|
| The box itself (localhost) | Nothing. |
| A device on your Tailscale network | Nothing, only when the Tailscale switch is on. |
| Someone with the right username and password | The login you saved, only when Dashboard Auth is on. |
A device on your local network (an address like 192.168.x.x or 10.x.x.x) | Nothing, unless Force LAN Auth is on. |
| An IP address on your whitelist | Nothing, only when IP Auth is on. |
| Anyone else | Refused. The panel answers 401. |
What do Force API Auth and Force LAN Auth do?
| Switch | When it is off | When it is on |
|---|---|---|
| Force API Auth (Basic auth for all API) | The rotation, status and reboot links work without a login, from anywhere. | Every API call needs your login. A device on your local network, a whitelisted IP and (if allowed) a Tailscale device still pass without it. |
| Force LAN Auth (Enable when selling proxies) | A device on your local network opens the dashboard and the API without a login. | That device needs the login too. |
Rotation and status links are explained in How to change the IP. The login is the same Basic username and password as in the REST API.
Can I let another person manage the box?
Yes, with Tailscale. After you connect the box to Tailscale, a Share Device to another Email button appears next to its status. It opens the Tailscale admin console, where you send an invite to that person's email. The steps are in Remote access with Tailscale or ZeroTier.
What do the error messages mean?
| You see | What to do |
|---|---|
| Need enable Dashboard Authentication when filled Username/Password! | Switch Dashboard Auth on, or clear the username and the password. |
| Need fill Username/Password when enabled Dashboard Authentication! | Type both a username and a password. |
| Need enable Password Authentication when Whitelist IP Authentication enabled! (also for Force LAN Auth and Tailscale) | Save a dashboard login first. These options sit on top of it. |
| A page Access Denied with a 403 | Domain Only is on. Open the dashboard with its domain name instead of the IP address. |
| Current password is incorrect | The SSH change needs the current Linux password of the user you picked. |
| Please choice the port in the range (80-65535) | Pick a port number from 80 to 65535. |
| Unauthorized. Your IP: … from an API call | The call came from an IP that is not on the list. Add your login to the call, or add the IP to the whitelist. |
FAQ
How do I set a password on the XProxy dashboard?
Open General Settings → System Setting → Security, switch Dashboard Auth on, type a username and a password and click Save. Devices outside your local network now need that login.
How do I open the dashboard from the internet safely?
Use a password at least. Add an IP whitelist for fixed places like your office, or switch on Domain Only so a visit by IP address is refused. You can also skip open ports and reach the box through Tailscale. To publish the box, see NAT Forwarding or VPS Forwarding.
What is the difference between the IP whitelist and domain-only access?
The whitelist lets chosen IP addresses in without the password. Domain-only refuses every visit that uses an IP address, whoever it comes from, and only allows a domain name. They solve different problems, and you can use both.
How do I change the SSH password of my proxy box?
Use System Setting → Security → SSH Password Management. Pick the user, type the current password and the new one twice. The new password needs at least 6 characters.
Does the dashboard port change my proxy ports?
No. The Default dashboard port (80 unless you change it) is only the address of the panel and its API. Your proxy ports are separate, see Proxy Settings.
What next?
Reach the box from outside, call it from code, or find it on your network again.