VPN platform
Open Source proxy and VPN billing for your IPv4 nodes
NexCMP is self-hosted billing and customer-portal software that sells VPN-style access from servers you run. Each customer gets dedicated IP addresses served over SOCKS5, HTTP and UDP, ordered from your price list, paid from a wallet and managed in a portal, with a Linux agent on every node you own.
The real protocols are SOCKS5, HTTP and UDP on the customer's own IP. There are no WireGuard or OpenVPN tunnels and no branded client apps. The VPN module is part of NexCMP Free and Source and is off until you switch it on.NexCMP Source: full source code for $499, one-time. Use, modify and self-host for your own business. You may sell the services you operate; you may not resell or redistribute the source code or builds. Source license terms
What the VPN module is, and what you need
Despite the name, this module does not build VPN tunnels. Each IP address you sell answers on three ports: a SOCKS5 port (CONNECT and UDP ASSOCIATE), an HTTP proxy port with basic authentication, and a UDP port. Customers use any SOCKS5 or HTTP client, or an app that reads a subscription link.
NexCMP sells, bills and manages the access. It does not provide IP addresses, bandwidth or an IP network: the servers, the addresses and the prefixes are yours.
To start you need Linux x86_64 servers with public IPv4 addresses, the NexCMP agent installed on each of them, and the VPN module switched on under License & updates. Orders are paid from the same prepaid wallet as the rest of NexCMP.
How your customers manage a VPN subscription
Every screen is a tab of the service page in the customer portal, shown with sample data. Pick a tab, use the arrows or the left and right keys, or open the full-screen viewer.
Overview
IP list
Bandwidth
Billing
Authorized IPs
Pro features
How the pieces fit together
Customers never touch your panel's data path: they connect straight to the IP they bought on your node.
Node management and setup
Nodes are managed in the admin console under Agents and the VPN IP pool.
Add server over SSH
Enter the node's public IPv4, SSH login, a name, the role (VPN node, VPN node with DDoS monitoring, or monitoring only), the zone, optional extra subnets and whether its IPs are sold automatically. The panel connects over SSH and runs the installer.
Install by hand with a token
Generate an install command and run it on the server. The token is shown once and only enrolls the machine for monitoring; the VPN role is assigned by an admin afterwards, under Roles in the machine's detail page.
The IP pool fills itself
The agent finds the public IPv4 addresses on the node, plus the extra subnets you declared, and the panel turns them into the pool. The zone comes from the node's location, or you pick one.
Your gateway is never sold
From NexCMP 1.4.2 the agent reads the node's real routing table and leaves the gateway address out of the blocks it serves. The panel keeps it out of the pool and out of every allocation.
Status and removal
A VPN node checks in every 5 seconds and is online when its last check-in is within 60 seconds. Removing a machine from the list does not uninstall the agent: run install.sh --uninstall on the server.
Plans and pricing
You set every price. Nothing below is a fixed NexCMP price.
Dedicated IPs in price tiers
Each IP belongs to one customer, with its own username, password and ports. One order holds 1 to 10,000 IPs, and the tier an order reaches sets the price per IP for the whole order.
Billing cycles
Daily, weekly, monthly and yearly. Daily and weekly prices are a share of the monthly price, and the yearly discount is yours to set; all are editable.
Edit the price list
Prices are entered in USD under Admin > VPN > Price list. New prices apply to new orders; running plans keep their price. Every change is audited with the old and new values.
Wallet payment
The customer sees a quote, then the wallet is charged. If the IPs cannot be allocated the charge returns to the wallet, and an order with no free IPs is refused before any charge.
Auto-renew and expiry
Auto-renew is on by default and renews one term when 24 hours or less remain. An expired plan keeps its IPs for 3 days, then releases them. A cancellation is immediate and not refunded.
Bandwidth and limits
Read this part before you write your sales page.
Bandwidth tiers are measured and enforced
A plan carries a bandwidth tier in GB per period for the whole plan, not per IP. From NexCMP 1.5.1 the panel adds up the traffic that the node agent reports and cuts the plan's proxies when the period's GB are used up. They open again within seconds after a bandwidth upgrade or when the next period starts. Unlimited plans are never cut. The cut-off is exact to the heartbeat, so a plan can run a little past its limit. Update the node agent to 1.5.1: older agents are still counted but can miss bytes after a network error or a restart, and a plan on a node that has not reported usage yet is shown as Not measured and is never cut. For a hard speed limit, the separate IPv6 Proxy module limits Mbps per plan.
Upgrade mid-term
A customer can move up to a higher tier at any time and pays the difference for the days left. Add-ons, such as a higher Authorized IPs limit, are paid at once when added; removal applies from the next term.
Egress, ports and mail
Traffic leaves from the IP the customer connected to, to destinations of the same address family. Each IP gets three consecutive ports in 65001 to 65535 that customers cannot change. Outbound port 25 is always blocked.
Account quotas
The quota key vpn.ips limits how many VPN IPs one account can hold. It is checked before any money is taken, and an order over the limit is refused.
Defaults depend on how much real money the customer has topped up, in five levels. The general quota switch is off by default. You edit the defaults in Settings and override one customer in their detail page, with a reason that goes to the audit log.
IP changes and blacklist reports
VPN endpoints are not rotated: an IPv4 endpoint keeps its address for the life of the plan. Rotation exists only in the IPv6 Proxy module. If an address gets blocked, the customer reports it instead.
- The customer selects the IPs, gives a reason (listed on a blocklist, blocked by a site, or other) and a description.
- NexCMP checks the address against public DNS blocklists at once. A plan can have up to 10 open reports.
- You, or the reseller who owns the customer, approve or reject. Approve and the IP is replaced by a clean one in the same zone, free, with the same username, password and ports. Reject and you give a reason the customer receives.
- If no clean IP is available nothing changes. The old IP is set aside for at least 30 days.
Authentication: user/pass and IP auth
Username and password per IP
Every IP has its own generated username and password, used on both its SOCKS5 and HTTP ports.
Authorized IPs
A customer lists source addresses that connect without a password, on SOCKS5 and HTTP. The default is 3 entries and an add-on raises it to 1,000. IPv4 entries are /16 to /32, IPv6 entries /32 to /128; a catch-all range that covers every address is refused.
Export and API
Customers copy or download their endpoints as socks and http (URL form), socks_plain and http_plain (ip:port:user:pass), json, clash, singbox or v2rayn, or scan a QR code carrying a socks:// link.
Each plan also has a subscription link: a public URL with a secret token, served as v2rayn (the default), shadowrocket, clash or singbox. Apps that read subscription links, such as Clash, sing-box, v2rayN and Shadowrocket, can import it. They list SOCKS5 proxies, not VPN servers, and NexCMP does not ship or support them. Replacing the token kills the old link.
API keys carry the scopes vpn:read, vpn:detail, vpn:write, vpn:create (it spends money and needs an Idempotency-Key header) and vpn:destroy; catalog:read covers the public catalog and quotes. An OpenAPI spec and the cmp command-line tool cover the same calls.
socks5://USER:[email protected]:SOCKS_PORT
http://USER:[email protected]:HTTP_PORTThe VPN module in the admin console and the portal
Screenshots from a lab install with sample data.
What your customers can do
Each item is something a customer does in the portal or with a scoped API key.
Order and pay
Choose a zone, number of IPs, bandwidth tier, add-ons and cycle, read the quote and pay from the wallet.
Use and share endpoints
Search the IP list, copy or download endpoints, scan a QR code or take the subscription link, and set Authorized IPs.
Upgrade and renew
Move up a bandwidth tier, change add-ons, renew several terms ahead, switch auto-renew, or cancel.
Report and transfer
Report a blocked IP and follow the report, or use the Transfer tab to hand a plan to another account.
What you can do as the operator
Each item is in the NexCMP admin console.
Run nodes and the price list
Add servers, edit a machine's roles and extra subnets, manage ranges and zones, and set tiers, add-ons and cycles.
Module switch
Switch the VPN module on under License & updates; the Sell VPN switch on the Subscriptions page is the same switch.
Subscriptions and reports
Filter plans, read an IP history, approve or reject IP reports, and revoke a plan. A revoke is a cancellation without refund and needs a reason.
Quotas and branding
Set VPN IP quotas by top-up level, and give the service your own display name, such as IPv4 Proxy or Datacenter Proxy. Renaming changes labels only.
Resellers
Each reseller has a Sell VPN switch under Features, effective while the module is on. They have wholesale and retail prices and handle IP reports of their own customers.
Audit
Price-list changes, revokes and quota overrides are audited, and customer actions on a plan appear in Events.
Infrastructure requirements
You provide the servers and the addresses. Full steps: https://nexcmp.com/docs/infrastructure/vpn-proxy-nodes/.
- A Linux x86_64 server with systemd and root access for the install; the agent is built for x86_64 only.
- curl or wget, and outbound HTTPS from the node to your panel.
- Public IPv4 addresses on the server, or a public prefix routed to it and declared as an extra subnet (IPv4 /16 to /32).
- Inbound TCP and UDP on 65001 to 65535 for each sold IP.
- The agent can also serve public IPv6 addresses it finds on the node; an IPv6 endpoint reaches IPv6 destinations only.
Fit check
A good fit: you hold public IPv4 addresses on Linux servers and want to sell dedicated SOCKS5 and HTTP endpoints with per-IP credentials, a portal, a wallet, renewals, an API and a subscription link.
Not a fit: customers who need WireGuard or OpenVPN tunnels or a branded client app, a transfer quota enforced on the node, or IPv4 addresses that change on a schedule.
Responsibility: you are responsible for where your IP addresses come from, for obeying the law that applies to you and your customers, and for the acceptable-use policy you set. NexCMP does not provide IPs or bandwidth, and this page is not legal advice.
Free and Source
The VPN module is included in NexCMP Free, which is $0 for the first year and then $99 per year, and in NexCMP Source, a $499 one-time purchase. It is off by default; you switch it on under License & updates. Free is for network operators with their own ASN and a subnet registered in their own name, and applications are reviewed. The servers and the IP addresses are yours.
VPN platform: frequently asked
Does NexCMP support WireGuard or OpenVPN?
Which protocols do my customers use?
How is bandwidth sold, and is data usage enforced?
Can customers upgrade bandwidth during a term?
How do customers get their configuration?
Can I offer IPv6?
What if an IP gets blacklisted?
How do I add a node?
Does NexCMP provide the IPs or bandwidth, and who answers for their use?
Sources
NexCMP documentation for the VPN module.
Get NexCMP free
Free, with the VPN module and every other module included. Install it on your server today, or look at the customer portal screens first.
Last updated: