If you've ever bought a cheap VPN account from a small Telegram reseller — a QR code, a subscription link, 50 GB a month, expires in 30 days — there is a good chance the person selling it never touched a config file by hand. They were using Marzban.

Marzban is an open-source web panel that sits on top of Xray-core and turns raw proxy protocols into accounts: per-user data limits, expiry dates, IP limits, share links, and subscription URLs. It is the boring infrastructure behind a huge chunk of the indie VPN economy in countries where censorship is real and the big commercial VPNs are priced out of reach. Understanding it matters whether you buy VPN accounts or run your own server — because it is exactly the same tool both sides use.

What the panel actually does for an operator

Xray-core by itself is a JSON config file. Every inbound is a protocol on a port: VLESS, VMess, Trojan, Shadowsocks, TUIC. Every client is an entry in that config. Managing a few hundred clients by editing JSON is madness, so Marzban provides the primitives an operator needs:

  • Users, not configs. A user is one row in a dashboard with a data cap, an expiry date, and an IP limit. One user can hold several protocols at once — VLESS for the laptop, Trojan for the phone.
  • One subscription link. The panel generates a single URL the customer pastes into V2RayNG, NekoBox, sing-box, or Clash. Change the plan, rotate the keys, cut them off for non-payment — the same link updates, no new QR code needed.
  • Multi-inbound on one port. Using Xray's fallback support, a single 443 can serve several protocols at once, with TLS or REALITY wrapping the traffic to look like ordinary HTTPS.
  • Multi-node. One panel can manage nodes spread across several VPS providers, so an operator's customers stay online when one server dies or one country's routes go bad.
  • Accounting. Per-user and per-inbound traffic stats, with periodic resets — the difference between a hobbyist and a business is knowing who burned through their quota.

The stack is Python with a React frontend, SQLite by default (upgrade to PostgreSQL when you outgrow it), a full REST API, a Telegram bot for remote management, and a CLI. There is no license fee, which is precisely why the reseller scene standardized on it.

The customer's side of the same coin

Here is the part most customers never think about: your VPN account is a database row. The reseller who sold it to you can kill it with one click, throttle it, or migrate you to a slower node mid-month. That is not an accusation — it is the architecture. Every "50 GB, 30 days, one device" plan you have ever bought was enforced by exactly these fields.

Knowing this changes how you shop. A reseller on Marzban who offers a panel-generated subscription link is a reseller with real tooling, and you should expect real tooling behavior: if you pay and the account never activates, that is a business failure, not a technical mystery. And if privacy is the point rather than convenience, remember the operator always sees your connection metadata — no panel feature changes that.

The self-hoster's version

The genuinely interesting move is the opposite direction: install Marzban on your own VPS and become your own reseller of one. The panel removes the operational pain that pushes people toward commercial VPN subscriptions in the first place — creating the VLESS+REALITY inbound, provisioning users, handing out subscription links to family members — without requiring you to hand-edit Xray configs.

A few operator notes if you go this route: put the panel behind TLS and a strong admin password from minute one (it is a remote admin interface to your entire proxy infrastructure), keep the panel itself off the same IP you advertise if you care about censorship resistance, and enable fail2ban-style protection on login endpoints. The cheapest possible setup — one VPS, one panel, one node — is how most resellers start. You can stay there forever; multi-node is a scaling answer to a problem you may never have.

Marzban does not make Xray's protocols better or worse. It makes them manageable, and manageability is what turns a protocol into a service. The indie VPN economy figured that out years ago. There is no reason a self-hoster can't run the same playbook for themselves.

Sources: