Open Source IPv6 proxy panel and billing platform

• Add a node over SSH

  In the Add IPv6 node (SSH) box enter the server's public IPv4, SSH port, user and password, a name, the total speed cap in Mbps and a reason. The password is used for the install only and is not stored.

• Background install

  The panel installs the proxy daemon in the background and shows an install log. It takes a few minutes. The panel host needs sshpass and an SSH client.

• Prefix probe

  The node tests real outbound traffic and reports whether your prefix is routed to it or on-link. Accepted prefixes run from /32 to /64 inside 2000::/3. A prefix assigned to another node is refused.

• Zone by location

  The node's country comes from its IPv4 address. It joins your zone for that country, or a new zone is created switched off for you to enable.

• Status and controls

  A node is new, installing, active, in error or disabled. You can read the install log, change the Mbps cap, disable it and delete it once no plan holds addresses on it. Deleting does not uninstall the software.

• Panel URL and audit

  Nodes call your panel over HTTPS at an address you can set under IPv6 Proxy > Settings. Adding, capping, disabling and deleting a node ask for a reason and are written to the audit log.

• Mbps per plan, both ways

  Each plan has a speed limit, applied to upload and download separately. It is the plan's speed plus 50 Mbps per add-on unit.

• Node-wide cap

  Each node has a total cap per direction, set when you add it and changeable later with a reason. Every plan on the node shares it.

• Connection limits

  A plan has a maximum number of open connections and of new connections per second. Repeated wrong passwords are slowed down.

• Traffic and logs

  Nodes report bytes every minute, shown as a chart on the Bandwidth tab. Customers can also search a per-minute connection log with 30 days of history.

Rotation exists for IPv6 only. A rotated address is a new address in a different /64. Static plans do not rotate. Rotate and no-data-cap plans rotate three ways.

• By hand: the Rotate now button or one call to the rotate endpoint of the API, at most once every 3 seconds per plan. On a Rotate plan it uses one rotation.
• By public link: a secret link that rotates the address with no login, for scripts that cannot hold an API key. The customer can replace it at any time. It accepts one call every 3 seconds, and anyone holding it can use up rotations.
• By schedule: an interval from 30 to 600 seconds, or off. The panel runs the schedule.
• Nodes pick up the new address within about 5 seconds. The Rotation tab keeps the history.

Customers export the address list in seven formats: host:port:user:pass lines, user-and-password lines, SOCKS5 URLs, HTTP URLs, the plain list of exit IPv6 addresses, Clash and sing-box. Exports are refused when someone signs in as the customer on their behalf, because they contain the password.

Customer API keys have scopes for reading, details, changes and ordering. Ordering needs an idempotency key, so a retry cannot charge twice. The rotation link is not shown to API keys. The OpenAPI document and the cmp command-line tool cover buying, renewing, rotating, releasing a device, resetting a password, exporting and reading logs.

GET /v1/proxy6/subscriptions/{id}/export?format=socks5
formats: hostport, userpass, socks5, http, ips, clash, singbox

• Order and pay

  Choose plan, location, add-ons and cycle, and pay from the wallet. Only zones that are on and have a running node are offered.

• Connect and rotate

  Copy the connection details, reset the password, rotate now, set a schedule or call the public link.

• Export and watch

  Download the list in seven formats, read the traffic chart and the connection log.

• Manage the plan

  Renew, switch auto-renew, release a locked device, cancel or remove the plan from the list.

You provide the servers and the address space. The install steps are in the docs at https://nexcmp.com/docs/infrastructure/vpn-proxy-nodes/.

• A node on Linux x86_64 with systemd and the systemctl, nft, ip, ss, sysctl and useradd commands.
• Ports 80, 443 and every port above 60000 free. The installer does not stop other services.
• A public IPv4 address for SSH and for customers to connect to, and HTTPS from the node to your panel.
• An IPv6 prefix routed to the node, or on-link with NDP proxying, such as a range like 2001:db8::/32 in the documentation.
• Enough address space. In a routed prefix each address you sell gets its own /64, so you need as many /64s as addresses sold at once: a /51 holds 8,192, enough for a 5,000-address static plan. On a single on-link /64 shared with your router, each address sold is one /128 inside that /64, so one /64 serves many addresses.
• Mail ports 25, 465, 587 and 2525 are blocked. Customers reach only websites with an IPv6 address (AAAA record).

The IPv6 Proxy module is included in NexCMP Free and Source, with no fee per node, plan or address. NexCMP Free is $0 for the first year, then $99 per year, for operators with their own ASN and subnet; applications are reviewed by hand. NexCMP Source is $499 one time. The slides above show the customer portal.

• Pricing and plans
• Billing, wallets and invoices
• Frequently asked questions
• Contact

• nexcmp.com/docs/infrastructure/vpn-proxy-nodes/