Xray. Multi-hop mode

Multi-hop mode links two independent BeAdmin installs into an entry → exit chain. Traffic goes device → entry hop → exit hop → internet: the device connects to the first server, but reaches the internet from the second. Multi-hop is a fit when a single Xray server stops working — its REALITY handshake is already recognized by DPI, or its IP has become unreachable.

This article covers why you'd want a chain and how to assemble one from two servers: create the exit hop, link an entry hop to it, and check that the chain works. If you're just getting to know the module, start with Xray quick start; how the traffic masking works is in Xray. How the service works.

Why a multi-hop chain

With a regular Xray user, traffic reaches the internet from your server's IP, and the provider sees a connection to that same server. As long as the server stays off the radar, that's enough. But if its REALITY handshake is already recognized by DPI, or its IP has become unreachable, you need a different egress address.

A chain splits apart the two points the server is visible from on the outside:

• entry hop — what the user's provider sees. To it, this is an ordinary REALITY server, indistinguishable from a website.
• exit hop — what the internet sees. Destination sites receive requests from the exit hop's IP, on another network and, as a rule, in another country.

Even if the entry hop becomes unreachable, the egress address stays out of the way — and vice versa. This is not Tor-grade anonymization: the chain adds exactly one intermediate hop to change the egress IP, no more.

What you'll need

• At least two BeAdmin servers in different locations — otherwise a chain makes no sense: its whole job is to spread the entry and the exit across different networks. The Xray module must be installed on each server. Let's call them install A (the future entry) and install B (the future exit).
• Take the entry hop as close to the client's location as you can — ideally in the same country: the device connects to the entry directly, and the shorter that leg is, the more stable the link. The far point is the exit hop — it's the one that gives you the egress IP you want.
• Access to both panels with edit rights: linking is done by hand, by copying a link from one panel into the other.

If you haven't picked the servers for the entry and exit hops yet, our partners offer a VPS with BeAdmin already installed — in a choice of several countries: take the entry close to the user, and the exit in the location you need.

Proven over 15 years in hosting. Your VPS with BeAdmin is ready to go out of the box.

• Germany
• Netherlands
• Sweden
• Switzerland
• Spain
• USA

Select server

European reliability made simple. Launch BeAdmin with your VPS in just one click.

• Germany
• Netherlands
• Sweden
• Estonia
• Romania
• Switzerland
• Spain
• United Kingdom
• USA

Sign up

ℹ️ The role belongs to a user, not a server

Multi-hop mode is the role of a particular user, not a mode of the whole install. Standalone users, entry hops, and exit hops happily share one server. A single install can be the entry for some users and the exit for others at the same time — that is, work in both directions.

ℹ️ A chain needs two users

A chain is built from two users: an exit hop on one server and an entry hop on the other. Each one takes up a slot in its server's licence. If you need more than one multi-hop connection, you'll have to purchase a licence on both servers.

How to link two servers

There's no shared management between the two panels — they don't know about each other. The link is one-way and assembled by hand: the exit hop issues a special bemh://… link, and you copy it and paste it into the entry hop on the other server. Order matters — exit first, then entry.

Step 1. The exit hop on install B

1. On install B, open the Xray module and click Create user.
2. In the Mode field pick Multi-hop, and in the Role in the chain field that appears — Exit hop. Fill in the required fields and create the user.
3. The exit hop has no link or QR code of its own — in their place the expanded row shows the note "Exit hop — no connection settings". That's expected: this user only releases someone else's traffic to the internet, it doesn't connect directly.
4. Click the Link for the entry hop button — the panel generates and copies a link of the form bemh://…. It encodes the connection parameters of this exit hop. Pass it to install A any way that's convenient.

Step 2. The entry hop on install A

1. On install A, open the Xray module and click Create user.
2. In the Mode field pick Multi-hop, and in the Role in the chain field — Entry hop.
3. An Exit hop link field appears — paste the bemh://… link you copied in step 1 here.
4. Fill in the required fields and create the user.

The exit-hop link can be pasted either at creation time or later — the Edit dialog of an existing entry hop has the same field.

The entry hop is a full-fledged user with its own vless://… link and QR code. Those are what you hand to the end device, just like with a regular user (see Xray. Managing users). From there the traffic travels the chain on its own.

Multi-hop status

The entry hop's expanded row gains a Multi-hop status tile — it shows whether the entry reaches its exit. Next to it, once the link is set up, a tile with the exit hop's address appears.

Status	What it means and what to do
Active	The link is up, the exit hop is reachable — the chain is working.
Checking…	The panel is polling the exit hop right now. Wait — the status will update on its own.
Exit not bound	The exit-hop link hasn't been pasted yet. Open the entry hop for editing and paste the bemh://… link (step 2).
Exit unreachable	The exit hop isn't responding. Check that the Xray service is running on install B, the server is on and reachable over the network, and the exit's address and port haven't changed.
Version mismatch	The Xray version on the exit hop is below the minimum the link requires. Update the Xray module on install B (see Xray. Managing the module) and generate the link for the entry hop again.

Rebinding and unbinding

The entry hop's link to its exit can be changed at any time:

• Rebind to a different exit. Get a new bemh://… link on the exit hop you want and paste it into the entry hop's Exit hop link field — the previous link is replaced with the new one.
• Unbind. In the entry hop's expanded row click Unbind (or clear the link field in the edit dialog). The user returns to a direct exit to the internet — traffic goes through the entry hop itself again, without the second server.

Change the exit point

To release traffic from a different location, set up a new exit hop and rebind the entry to it:

1. Take a server in the location you want, deploy BeAdmin on it, and bind a licence — it's a standalone install, just like the first.
2. On it, create a user in Multi-hop → Exit hop mode and copy its Link for the entry hop (as in step 1 of assembling the chain).
3. On the entry hops, paste the new link into the Exit hop link field. The end devices re-import nothing — the entry keeps its existing vless://… link.

What multi-hop does not do

• Does not unify management of the two panels. Installs A and B stay independent; all the linking is manual, via the link. The entry install's name isn't shown on the exit side — there's no reverse channel between the panels, and the exit hop doesn't know who's connected to it.
• Does not replace anonymization. The destination site sees the exit hop's IP — that's a change of address, not a hiding of identity.

What's next

• Xray. Managing users — the Mode selector, roles in the chain, and editing users.
• Xray. How the service works — why two hops are needed and how the traffic is masked.
• Xray. Managing the module — starting and stopping the service, updating the module, changing the port and the masquerade domain.