FAQ

How do I set up a proxy server on a VPS?

1. Rent a VPS abroad and log in as root.
2. Run bash <(curl -fsSL https://psm.jinqians.com) to install PSM.
3. Run psm and install Xray from the Xray menu.
4. Create a VLESS REALITY node.
5. Import its share link or QR code into a client.

Step by step: Quick start.

Do I need a domain?

Not necessarily. VLESS REALITY and Shadowsocks 2022 work with just an IP, no domain or certificate. Vision and Trojan need a certificate for a domain; Hysteria2, TUIC and AnyTLS need a certificate, but a self-signed one works.

Which protocol should I use?

VLESS REALITY as the main line, Hysteria2 for lossy networks, and TUIC or AnyTLS as a spare. See Choosing a protocol.

My node does not connect. What should I check?

In order:

1. Run psm doctor; psm doctor --fix repairs what it can.
2. Make sure your cloud provider's security group / firewall allows the node port (TCP or UDP; Hysteria2 and TUIC need UDP). PSM only controls the server's own firewall.
3. Check the IP and port in the client link, and that the client is not too old.
4. For REALITY, try a different camouflage target.

The IP got blocked. Now what?

Get a new IP from your provider, or a new VPS, and move everything with psm migrate push root@new-server; nodes and credentials stay the same. See Moving to a new server. Running REALITY and Hysteria2 side by side means one line keeps working when the other is disrupted.

Can several people use it?

Yes: psm user gives each person their own account, with their own credentials, expiry date and subscription URL, and on Xray nodes a monthly traffic quota. See Per-user accounts.

Can the camouflage target be a site behind Cloudflare?

Better not. REALITY forwards connections that fail authentication to the camouflage target unchanged. If the target is behind a CDN, anyone can reach the whole CDN through your server, on your bandwidth. PSM checks for this and warns you; pick a site in your own datacenter that is not behind a CDN.

"REALITY: Listening on non-443 ports" in the log?

Ignore it for nodes on shared port 443: the node listens on loopback and the world sees 443. For a node on a public port other than 443 it is a valid warning; consider 443.

Which clients work?

Any client that imports standard share links or subscriptions: v2rayN, v2rayNG, Clash Verge Rev, Shadowrocket, Stash, sing-box, NekoBox, Hiddify and more. PSM also exports complete Clash Meta (mihomo) and sing-box configs.

How do I update or uninstall?

Update: run the install command again, or "Update PSM" in the menu. Uninstall: bash /opt/psm/uninstall.sh; shared components are confirmed one by one.

Will it overwrite my existing Nginx?

PSM manages only its own sites and the port 443 routing. If the server already runs important websites, back up /etc/nginx first.

Can I install it as a non-root user?

No. PSM installs system services, certificates and firewall rules, so it needs root. Once installed, the proxy cores themselves run unprivileged.

Can it manage many servers centrally?

Not at the moment. PSM manages one server at a time and has no multi-server panel; realm can relay traffic between servers.

How do I change the interface language?

"Language" in the main menu: Simplified Chinese, English, Korean or Russian; PSM_LANG=en psm switches for one session.

Is PSM free?

Yes, open source under AGPL-3.0, on GitHub. Use it within the law where you live.