VPN Panel Comparison 2025 - Marzban vs V2Board vs Remnawave vs X-UI

# Marzban Architecture (2025)
Backend: FastAPI + SQLAlchemy
Database: SQLite/MySQL/PostgreSQL
Frontend: React + TypeScript
Core: Xray-core
Queue: Celery (optional)
Cache: Redis (optional)
 
# Deployment
docker run -d \
  --name marzban \
  -p 8000:8000 \
  -v /var/lib/marzban:/var/lib/marzban \
  gozargah/marzban:latest

# V2Board Architecture (2025)
Backend: Laravel 10+
Database: MySQL
Frontend: Vue.js 3
Core: V2Ray/Xray
Cache: Redis
Queue: Laravel Queue
 
# Installation
composer install
php artisan migrate
php artisan key:generate
php artisan v2board:install

# Remnawave/Hiddify Architecture (2025)
Backend: Go + Gin
Database: SQLite/PostgreSQL
Frontend: Flutter (cross-platform)
Core: Xray-core + Sing-box
Protocol: Reality, VLESS, Hysteria2
 
# Key Features
- Cross-platform client (iOS, Android, Desktop)
- Built-in anti-censorship
- Warp+ integration
- Fragment support

# X-UI Installation (2025)
bash <(curl -Ls https://raw.githubusercontent.com/mhsanaei/3x-ui/master/install.sh)
 
# Features
- Web-based management
- Multi-protocol support
- Traffic statistics
- User management
- Subscription system

# Test Configuration
Server: 4 vCPU, 8GB RAM
Bandwidth: 1 Gbps
Protocol: VLESS + Reality
Users: 1000 concurrent
Duration: 24 hours

Why V2Board:
  - Mature payment integrations
  - Extensive user management
  - Multi-language support
  - Large ecosystem
  - Plugin system
  - Proven at scale
 
Setup for Production:
  servers: 10+ nodes
  users: 10,000+
  features:
    - Automated billing
    - Subscription management
    - Traffic limits
    - Multiple payment gateways

Why Marzban:
  - Modern, clean codebase
  - Excellent API
  - Strong security focus
  - Active development
  - Docker-first approach
  - PostgreSQL support
 
# Production Deployment
docker-compose.yml:
version: '3.8'
services:
  marzban:
    image: gozargah/marzban:latest
    environment:
      - SQLALCHEMY_DATABASE_URL=postgresql://user:pass@db/marzban
    volumes:
      - /var/lib/marzban:/var/lib/marzban
    networks:
      - marzban-network
  
  postgresql:
    image: postgres:15
    environment:
      - POSTGRES_DB=marzban

Why Remnawave:
  - Best anti-censorship protocols
  - Reality + Hysteria2 support
  - Fragment implementation
  - Warp+ integration
  - Cross-platform clients
  - Low footprint
 
Perfect for:
  - China, Iran, Russia
  - High-censorship regions
  - Privacy activists
  - Journalists

Why X-UI:
  - Easiest setup
  - Lightweight
  - Simple interface
  - All-in-one solution
  - Perfect for < 100 users
 
Installation:
bash <(curl -Ls https://raw.githubusercontent.com/mhsanaei/3x-ui/master/install.sh)
 
# Access: https://your-ip:54321
# Default credentials: admin/admin

import httpx
from typing import List, Dict
 
class MarzbanClient:
    def __init__(self, base_url: str, token: str):
        self.base_url = base_url
        self.headers = {"Authorization": f"Bearer {token}"}
    
    async def create_user(self, username: str, data_limit: int, 
                         expire_days: int) -> Dict:
        async with httpx.AsyncClient() as client:
            response = await client.post(
                f"{self.base_url}/api/user",
                headers=self.headers,
                json={
                    "username": username,
                    "data_limit": data_limit * 1024 * 1024 * 1024,  # GB to bytes
                    "expire": int(time.time()) + (expire_days * 86400),
                    "protocols": ["vless", "vmess"],
                    "inbounds": {
                        "vless": ["VLESS TCP REALITY"]
                    }
                }
            )
            return response.json()
    
    async def get_user_usage(self, username: str) -> Dict:
        async with httpx.AsyncClient() as client:
            response = await client.get(
                f"{self.base_url}/api/user/{username}",
                headers=self.headers
            )
            return response.json()
    
    async def suspend_user(self, username: str):
        async with httpx.AsyncClient() as client:
            await client.put(
                f"{self.base_url}/api/user/{username}/suspend",
                headers=self.headers
            )
 
# Usage
async def main():
    client = MarzbanClient("https://panel.example.com", "your-token")
    
    # Create user with 100GB for 30 days
    user = await client.create_user("john_doe", 100, 30)
    print(f"Created user: {user['subscription_url']}")
    
    # Check usage
    usage = await client.get_user_usage("john_doe")
    print(f"Used: {usage['used_traffic'] / 1024 / 1024 / 1024:.2f} GB")

<?php
// V2Board Webhook Handler for Payment Processing
 
namespace App\Http\Controllers;
 
use Illuminate\Http\Request;
use App\Models\User;
use App\Models\Order;
 
class WebhookController extends Controller
{
    public function handlePayment(Request $request)
    {
        $signature = $request->header('X-Signature');
        
        // Verify webhook signature
        if (!$this->verifySignature($request->all(), $signature)) {
            return response()->json(['error' => 'Invalid signature'], 401);
        }
        
        $orderId = $request->input('order_id');
        $status = $request->input('status');
        
        $order = Order::find($orderId);
        
        if ($status === 'completed') {
            $this->activateSubscription($order);
            return response()->json(['success' => true]);
        }
        
        return response()->json(['success' => false]);
    }
    
    private function activateSubscription($order)
    {
        $user = User::find($order->user_id);
        
        // Add traffic
        $user->transfer_enable += $order->transfer_enable;
        
        // Extend expiry
        $user->expired_at = now()->addDays($order->plan->days);
        
        $user->save();
        
        // Send notification
        $this->sendActivationEmail($user);
    }
}

package main
 
import (
    "net/http"
    "sync"
    "time"
)
 
type Panel struct {
    URL      string
    Type     string  // "marzban", "v2board", etc.
    Health   bool
    Load     float64
    LastCheck time.Time
}
 
type LoadBalancer struct {
    panels []*Panel
    mu     sync.RWMutex
}
 
func NewLoadBalancer(panels []*Panel) *LoadBalancer {
    lb := &LoadBalancer{panels: panels}
    go lb.healthCheckLoop()
    return lb
}
 
func (lb *LoadBalancer) healthCheckLoop() {
    ticker := time.NewTicker(30 * time.Second)
    defer ticker.Stop()
    
    for range ticker.C {
        for _, panel := range lb.panels {
            go lb.checkPanel(panel)
        }
    }
}
 
func (lb *LoadBalancer) checkPanel(panel *Panel) {
    client := &http.Client{Timeout: 5 * time.Second}
    
    resp, err := client.Get(panel.URL + "/api/health")
    
    lb.mu.Lock()
    defer lb.mu.Unlock()
    
    if err != nil || resp.StatusCode != 200 {
        panel.Health = false
        return
    }
    
    panel.Health = true
    panel.LastCheck = time.Now()
}
 
func (lb *LoadBalancer) GetBestPanel() *Panel {
    lb.mu.RLock()
    defer lb.mu.RUnlock()
    
    var best *Panel
    lowestLoad := 1.0
    
    for _, panel := range lb.panels {
        if panel.Health && panel.Load < lowestLoad {
            best = panel
            lowestLoad = panel.Load
        }
    }
    
    return best
}

# 1. Enable HTTPS
docker run -d \
  --name marzban \
  -e UVICORN_SSL_CERTFILE=/cert.pem \
  -e UVICORN_SSL_KEYFILE=/key.pem \
  -v /etc/letsencrypt:/certs \
  gozargah/marzban:latest
 
# 2. Strong admin password
docker exec marzban marzban cli admin update \
  --username admin --password "strong-random-password"
 
# 3. Enable rate limiting
RATE_LIMIT_ENABLED=true
RATE_LIMIT_REQUESTS=100
RATE_LIMIT_PERIOD=60
 
# 4. Regular backups
docker exec marzban marzban cli backup > backup-$(date +%Y%m%d).json

// config/secure.php
return [
    'admin_path' => env('ADMIN_PATH', 'admin-' . Str::random(16)),
    'api_rate_limit' => 60,
    'enable_2fa' => true,
    'session_lifetime' => 120,
    'password_min_length' => 12,
];
 
// Enable IP whitelist for admin
'admin_whitelist' => [
    '192.168.1.1',
    '10.0.0.1'
],

import json
import httpx
 
async def migrate_xui_to_marzban():
    # Export from X-UI
    xui_users = get_xui_users()  # Your X-UI export
    
    marzban_client = MarzbanClient(
        "https://new-panel.com",
        "your-token"
    )
    
    for user in xui_users:
        try:
            await marzban_client.create_user(
                username=user['email'],
                data_limit=user['total_gb'],
                expire_days=calculate_days_remaining(user['expiry'])
            )
            print(f"Migrated: {user['email']}")
        except Exception as e:
            print(f"Failed: {user['email']} - {e}")
 
# Run migration
asyncio.run(migrate_xui_to_marzban())