---
title: VPN and IPv6 proxy nodes
description: Prepare Linux hosts as VPN nodes (cmp-agent) and IPv6 proxy nodes: operating system, IP addresses and IPv6 prefixes, ports, sysctl, install and heartbeat.
url: https://nexcmp.com/docs/infrastructure/vpn-proxy-nodes/
applies_to: NexCMP 1.6.1
updated: 2026-11-02
---

# VPN and IPv6 proxy nodes

> **Where in the admin:** Infrastructure › VPN & Proxy nodes › Agents & external nodes (`/agents`), VPN IP pools (`/vpn/pool`), IPv6 Proxy nodes (`/vpn/proxy6/nodes`). The services themselves are under Services › VPN and Services › IPv6 Proxy. Both modules are switched on in System › Admin › License & updates.

## What it does

NexCMP sells VPN and proxy access that exits from **IP addresses you own**, on servers you operate. Two kinds of node exist:

- **VPN node.** A small Go program, `cmp-agent`, runs on your Linux host. It discovers the public IPv4 addresses on the host, opens a SOCKS5, an HTTP and a UDP listener on each address that is sold, and sends traffic out from the **same IP** the customer connected to (same-IP egress). It reports to the panel every few seconds.
- **IPv6 proxy node.** A proxy service that gives customers addresses from an IPv6 prefix you route to the host. The panel installs it for you over SSH.

Use them to resell clean IP addresses in the countries where you have servers.

## Requirements

### VPN node

| Item | Requirement |
|---|---|
| Operating system | A Linux distribution with systemd and a kernel of 4.15 or newer (IPv6 free-bind support). The shipped agent binary is **x86_64** (amd64) only. |
| Privileges | root, for the install. The service keeps only `CAP_NET_ADMIN`, `CAP_NET_RAW` and `CAP_DAC_READ_SEARCH`. |
| Tools | `curl` or `wget`, and `sha256sum` (the installer refuses to continue without checking the file). |
| Public addresses | Public IPv4 addresses assigned on an interface of the host (one `/32` each), **or** a prefix routed to the host that you add as an extra subnet (IPv4 /16 to /32, IPv6 /48 to /128). Private, CGNAT and documentation ranges are ignored. |
| Network, inbound | Customers connect to each sold public IP on **ports 65001-65535** (TCP for SOCKS5 and HTTP, UDP for UDP associate). Each endpoint uses a set of three consecutive ports. |
| Network, outbound | HTTPS (443) to your panel's domain. The agent also looks up its own country on `ip-api.com` (HTTP) and `ipinfo.io` (HTTPS), with a 3.5-second limit. |
| Mail | Outbound connections to port 25 are always blocked; there is no setting to open it. |
| Docker, VPN and virtual interfaces | Interfaces named `docker*`, `veth*`, `br-*`, `cni*`, `flannel*`, `virbr*`, `cali*`, `tun*`, `tap*`, `wg*` and `tailscale*` do not contribute addresses. |
| Depends on | The module **VPN**, a zone (created automatically from the host's country) and the NexCMP panel reachable over HTTPS. |

### IPv6 proxy node

| Item | Requirement |
|---|---|
| Operating system | Linux with systemd on **x86_64**. The commands `systemctl`, `nft`, `ip`, `ss`, `sysctl` and `useradd` must exist; otherwise the install stops and names the missing command. |
| Access for the install | A public IPv4 address (private, loopback and CGNAT addresses are refused), the SSH port, an account with root or `sudo` rights and its **password**. The password is used for the install only and is not stored. |
| Free ports | **80, 443 and every port above 60000** must be free. The installer never stops or changes services that are already running; it reports the busy ports and stops. |
| IPv6 | A public prefix between **/32 and /64** inside `2000::/3` that the host can use as a source for outbound traffic, delivered either **routed** to the host or **on-link** with NDP proxy (see below). |
| Network | Customers connect to the node's IPv4 on port 80 (HTTP proxy), port 443 (SOCKS5) and ports 60001-65535 (one port per static IP). The node has no certificate, so there is no HTTPS proxy. Traffic leaves over IPv6 only, and only to destinations that have an IPv6 address. The node pulls its configuration from the panel over HTTPS. |
| Node software on the panel server | The node daemon and its network script ship in the NexCMP release package. The panel copies them from its install folder (`/opt/nexcmp/releases/<version>/bin`, or `/opt/nexcmp/bin` on a custom build) to each node during the install. The panel server also needs `sshpass` and an SSH client; the installer adds `sshpass`, and on a server installed before 1.4.2 you add it with `sudo apt-get install -y sshpass`. |
| Depends on | The module **IPv6 Proxy**, and the panel URL that nodes call back to (**IPv6 Proxy › Settings › Panel URL for nodes**, default `https://<your license domain>`). |


## Prepare the infrastructure

### VPN node

1. **Provision the host** with a supported Linux and the public IPv4 addresses you want to sell, either configured on the network interface or routed to the host.
2. **If you sell a routed block**, plan to enter it as an **Extra subnet** when you add the node. The agent installs a route `local <block> dev lo` so the host accepts traffic for every address in the block, then reports the addresses it finds. The agent also reads the host's real routing table and never sells or captures a **gateway** address: if the block contains the next-hop of one of the host's routes (for example the router address of an on-link block), the agent installs `local` routes only for the parts of the block around it, reports the gateway to the panel, and the panel keeps that address out of the pool and out of every allocation. It removes the routes it installed when the extra subnet changes or the agent stops.
3. **Open the firewall.** Allow inbound TCP and UDP **65001-65535** on the public addresses, and outbound HTTPS to the panel.
4. **Optional: per-IP byte counters.** Conntrack accounting (`net.netfilter.nf_conntrack_acct = 1`) lets the monitoring role count bytes per IP. The panel can switch it on by sending the agent an `acct` command, which also writes `/etc/sysctl.d/99-cmp-agent.conf`. The VPN role itself does not need it.
5. **Check the panel from the node:**

   ```bash
   curl -fsS -o /dev/null -w '%{http_code}\n' https://cloud.example.com/install.sh
   ```

### IPv6 proxy node

An IPv6 prefix reaches the node in one of two ways. The installer tests both with real outbound connections and keeps what works.

| Kind | What it means | What you configure |
|---|---|---|
| **Routed** | Your upstream routes a prefix (for example a /48 or /56) **to the node's own address**. Outbound packets can use any address in the prefix as their source and replies come back to the node. | Ask your provider for a routed prefix whose next hop is the node. Nothing more on the node: the proxy service uses transparent sockets, a fixed policy-routing table and `nft`. |
| **On-link** | The /64 sits on the same LAN as the node. Replies work only if the node answers neighbour discovery for each address in use (**NDP proxy**). | The service sets, on that interface only, `net.ipv6.conf.<if>.accept_ra=2`, `forwarding=1` and `proxy_ndp=1`, remembers the old values, restores them when it stops, and blocks forwarding of the pool's addresses so the node does not become a router for the pool. |

How the check works: the node tries a TCP connection to a public IPv6 address (port 443) from a random address of the candidate prefix, within 6 seconds. Candidates are global addresses on interfaces with a prefix of /64 or shorter, plus routes of type `local`, `unreachable` or `blackhole` between /16 and /64. A prefix that is shorter than /64 is accepted as **routed** if a random /64 inside it works.

::: warning Do not use the same prefix twice
A prefix may not overlap a prefix of another node, and may not be wider than a prefix that already belongs to the panel's own IPv6 pool. A /64 **inside** the panel's pool is allowed. Overlaps are reported as "assign range … (node …)" in the install result, and the prefix is skipped.
:::

Restrictions the node applies by itself: customers cannot send mail (ports 25, 465, 587, 2525) from the pool addresses, and the daemon's own IPv4 traffic is limited to replies and to the panel and DNS.

## Connect in NexCMP

### VPN node

1. On **System › Admin › License & updates**, switch **VPN** on. See [Modules](https://nexcmp.com/docs/infrastructure/modules/).

      ![The Module card with the VPN and IPv6 Proxy switches](https://nexcmp.com/docs/images/infrastructure/vpn-proxy-nodes-01-modules.webp)

2. Open **Infrastructure › VPN & Proxy nodes › Agents & external nodes**. You have two ways to add a node.

   **a. Install over SSH.** Click **+ Add server (SSH)** and fill in:

   | Field | Example value |
   |---|---|
   | Server IPv4 address | `192.0.2.50` |
   | SSH port | `22` |
   | SSH user | `root` |
   | SSH password | `XXXX` |
   | Display name | `node-ny-1` (empty: named after the IP) |
   | Server role | External VPN / Proxy Node |
   | Zone assignment | Auto by GeoIP (create / assign Zone), or an existing zone |
   | Extra subnet (optional) | empty to auto-scan the interfaces, or a routed block such as `203.0.113.0/24` |
   | Enable for sale after install | on to mark every detected address sellable |

   Click **Connect & install**. The panel connects over SSH, runs the one-line installer on the node with a one-time ticket, and shows the node name, GeoIP location and detected ranges.

      ![Add Node via SSH dialog with an example server address and role](https://nexcmp.com/docs/images/infrastructure/vpn-proxy-nodes-02-add-server-ssh.webp)

   **b. Install by hand.** Click **Generate manual install token**. The command appears **once**; copy it and run it on the node:

   ```bash
   curl -fsSL https://cloud.example.com/install.sh | sudo sh -s -- --token XXXX --name node-ny-1
   ```

   A token install enrolls the machine for monitoring only: for safety the panel does not let a machine that holds the shared token give itself the VPN role (adding `--roles vpn` to the command has no effect). After the machine appears in the list, open it and add the **VPN** role yourself. Installing over SSH (option a) gives the node the VPN role from the start. A new token cancels the old one; hosts that already enrolled keep working because they use their own key.

      ![Install command dialog showing the one-time token command](https://nexcmp.com/docs/images/infrastructure/vpn-proxy-nodes-03-install-command.webp)

   What the installer does: it downloads `cmp-agent-linux-amd64` from your panel, **verifies its SHA-256**, installs it to `/usr/local/bin/cmp-agent`, enrolls with the token, writes `/etc/cmp-agent/agent.json`, and starts the systemd service `cmp-agent`. To remove it: `curl -fsSL https://cloud.example.com/install.sh | sudo sh -s -- --uninstall`.

3. After the first heartbeat the node appears in the list. Its country is detected by GeoIP (the node's own lookup first, then the panel's database); a **zone** for that country is created and made public if none exists, and the addresses found on the host become pool ranges.
4. Open **Infrastructure › VPN & Proxy nodes › VPN IP pools** to see the ranges, their zone and node, and to change the zone, node or **Sellable** switch of each range. **Enable range** allows new orders to use its free IPs; **Disable range** only stops new allocations, leased IPs keep running.

      ![VPN IP pools with ranges reported by a node](https://nexcmp.com/docs/images/infrastructure/vpn-proxy-nodes-04-vpn-pool.webp)

5. Open **Services › VPN**, set the price list and turn sales on. The **Sell VPN** switch on **Subscriptions** is the same switch as the VPN module in License & updates.
6. **Optional: rename the service.** In **Settings › Branding**, **VPN service display name** changes how the VPN service is named in the customer menu, order page, detail page and deploy list (for example `IPv4 Proxy`, `Datacenter Proxy` or `Static Residential Proxy`; up to 40 characters, empty keeps `VPN`). It changes labels only: routes, data and the API do not change.

### IPv6 proxy node

1. On **System › Admin › License & updates**, switch **IPv6 Proxy** on.
2. Open **Infrastructure › VPN & Proxy nodes › IPv6 Proxy nodes** and click **Add node (SSH)**. Enter the node's IPv4 address, SSH port, user, password, an optional name, and a **Reason** (it goes to the audit log), then click **Install**.

      ![Add IPv6 node dialog with an example address and reason](https://nexcmp.com/docs/images/infrastructure/vpn-proxy-nodes-05-proxy6-add-node.webp)

3. The panel then, in order: checks the machine and the ports, copies the daemon, the network script, the service unit and a node-specific environment file (a node token and a password-signing key), runs the **probe** for usable prefixes, records the prefixes in the pool, starts the service, and waits up to 90 seconds for the first report. **Install log** shows each step.
4. A new node creates its zone in the **off** state (from the GeoIP of the node's IPv4). Turn the zone on under **Infrastructure › Datacenter › Zone** so customers can choose it.
5. Set a total **Mbps cap** per node (10 to 100000 per direction). Under **Services › IPv6 Proxy** set the price list and turn sales on.
6. Check **IPv6 Proxy › Settings › Panel URL for nodes**. Nodes call this address (`https://host`, no path) to pull their configuration and send reports. Empty means `https://<your license domain>`. It must be a host whose address points straight at the panel, so the node's own IPv4 reaches it unchanged.

::: tip Rotation schedule
Customers can set an automatic rotation interval of 30 to 600 seconds. In NexCMP the panel runs that schedule (and the hourly clean-up of connection logs); nodes pick up a new address within about 5 seconds.
:::

### How a node reports

| | VPN node (`cmp-agent`) | IPv6 proxy node |
|---|---|---|
| Enrollment | One-time ticket or token over HTTPS, then its own key | One-time SSH install, then a node token |
| Heartbeat | Every **5 seconds** (10 s for a monitor-only agent); the panel can set 3 to 300 s. After a failure it backs off in steps of 5 s up to 60 s | The node sends a report about every 60 seconds and pulls configuration |
| Shown as online | A heartbeat within the last **60 seconds** | **alive** within the last **120 seconds**, otherwise **missed heartbeat** |
| Configuration change | Applied at the next heartbeat | Applied within about 5 seconds |
| Updates | The panel can send an `upgrade` command with the new version, URL and SHA-256 | Reinstall from the node row |

### Data allowance on a VPN node

From NexCMP **1.5.1** the VPN node agent sends the traffic it carried with every heartbeat, and the panel adds it to the plan's usage for the current period. The same number is shown to the customer (Overview and Bandwidth tabs) and to you (VPN › Subscriptions, column Used, and the node row).

- **Cut-off.** When a plan has used its GB for the period, the panel stops sending that plan's endpoints to the agent, so new connections are refused and open ones are closed. The cut happens within one heartbeat, so a plan can run a little past its limit. Plans with an Unlimited tier are never cut.
- **Open again.** The plan is served again within one heartbeat after the customer buys more bandwidth or when the next period starts.
- **Not measured.** A node whose agent has not sent usage (for example an older agent) is shown as **Not measured**, and its plans are never cut because of GB.
- **Update the agent.** Use agent **1.5.1** on the nodes. Older agents are still counted, but they can lose the bytes of a heartbeat that failed, of an endpoint that was stopped, or of a restart, and they do not close open connections when a plan is cut. Update from the node row (Reinstall) or with the `upgrade` command.
- Counting is of the payload that passes through the proxy, so it is slightly lower (about 1 %) than the bytes on the wire.

### Retired VPN add-ons

High IP Reputation, High Concurrency and High Priority Network are no longer offered on new orders. Existing subscriptions retain their add-on selections, but their renewal amounts have the retired fees removed. There is no refund of already-paid periods. The adjustment uses the add-on's current catalog price; if you changed that price or deleted the add-on, review the subscription's renewal amount before its next renewal.

## Verify

1. The node row is online. For a VPN node, **Agents & external nodes** shows its zone, country, role and detected ranges.
2. **VPN IP pools** lists the ranges with free IPs; the zone's detail page shows the VPN infrastructure.
3. Order a test VPN or proxy plan. The customer gets an endpoint `ip:port`, a user name and a password; connect through it and check that the visible public IP is the node's IP (for example `curl --proxy socks5h://USER:XXXX@IP:PORT https://ifconfig.me`).
4. On an IPv6 node, run on the host:

   ```bash
   systemctl is-active <node service>
   nft list tables | grep proxy6
   ss -ltn | grep -E ':(80|443|6[0-9]{4})\b'
   ```

## Limits and notes

- Windows hosts can run the monitoring agent but not the VPN role.
- Data allowance (GB per period) of a VPN plan: from NexCMP 1.5.1 the panel adds up the traffic reported by the VPN node agent and cuts the plan's proxies when the period's GB are used up (see "Data allowance on a VPN node" below). IPv6 Proxy plans have no GB allowance; they limit speed in Mbps per plan.
- IPv4 addresses of a VPN plan do not rotate. A customer reports a blacklisted IP; you or the reseller approve a replacement from the same zone. Only IPv6 Proxy rotates.
- At most 64 ranges are reported per heartbeat.
- A VPN endpoint set uses three ports per sold IP. With ports 65001-65535 each IP serves a limited number of endpoints (178 port sets); the panel skips sets that were used before.
- Deleting an IPv6 proxy node is allowed only when no plan holds an IP on it. It removes the node's ranges and token; the software on the host is not uninstalled.
- Reselling a range that also carries your own VMs is possible: VPN uses only ports 65001-65535, so it shares the IP with other services.

## Troubleshooting

| Symptom | Cause | Fix |
|---|---|---|
| "enrollment failed (invalid token or server unreachable)" | Wrong or already-used token, or the panel is unreachable | Generate a new token, or retry the SSH install. |
| "file signature mismatch - STOP" | The downloaded agent differs from the published SHA-256 | Check the panel's `/dl/` folder and that nothing rewrites the download on the way. |
| "this installer is for Linux only" / "architecture … is not supported yet" | Windows, or an architecture other than x86_64 (the release ships the agent for x86_64 only) | Use an x86_64 Linux host. |
| Node never appears | The node cannot reach the panel over HTTPS | Test `curl https://<domain>/install.sh` from the node; check DNS and the firewall. |
| Node appears with the wrong country | The country lookups failed, so the panel's address database was used | Allow outbound access to `ip-api.com` and `ipinfo.io`, or choose the zone explicitly in the SSH form. |
| No ranges detected | No public IPv4 on a non-virtual interface | Add a public address, or enter the routed block as **Extra subnet**. |
| VPN works, traffic exits from another IP | The sold IP is not assigned or routed to the host | Make sure the IP is on an interface or covered by `local … dev lo`. |
| "the panel server does not have sshpass" | The panel host cannot log in to nodes with a password | Run `sudo apt-get install -y sshpass openssh-client` on the panel server, then install the node again. |
| "not found in the installed package" when installing an IPv6 node | The panel is older than 1.4.2, or a custom build without the node files | Update NexCMP to 1.4.2 or later; for a custom build use `build.sh`, which now packs `brandy-proxy6d` and `brandy-proxy6-net`. |
| "SSH: …" at the start of an IPv6 install, or "SSH to internal/loopback addresses is not allowed" | Wrong port, user or password, SSH blocked, or the address is private | Use the node's public IPv4 and check access manually with `ssh -p PORT USER@IP`. |
| "architecture … not supported (x86_64 only)" | The node is not x86_64 | Use an x86_64 host. |
| "node missing command: …" | `nft`, `ip`, `ss`, `sysctl`, `systemctl` or `useradd` not installed | Install the packages, then run the install again. |
| "ports in use by another service on node: … — 80, 443, 60001-65535 must be free" | 80, 443 or a port above 60000 is busy | Move the other service; the installer does not stop it. |
| "no IPv6 prefix with Internet access found from node (real egress probe failed)" | No routed prefix, NDP proxy not possible, or no outbound IPv6 | Check the prefix is routed to the node, the interface has IPv6 connectivity, and nothing filters outbound traffic. |
| "all detected ranges already belong to another node" | The prefix is already used by another node | Remove it from the other node or pick another prefix. |
| Install ends with "no initial report received from node" | The service started but did not reach the panel within 90 seconds | Check the panel URL given to nodes and the node's HTTPS path to it; see the **Install log**. |
| Node row shows **missed heartbeat** | No report for 120 seconds | Check the service on the node, its clock and its path to the panel. |
| Customers see no IPv6 location | The zone is off | Enable the zone under **Zone**. |