Setting up multi-hop VPN in BeAdmin

Cascade mode links two independent BeAdmin installations into an "entry → exit" chain: your device connects to the first server, but reaches the internet through the second. This helps when a single Xray server stops working — its REALITY handshake has been detected by DPI, or its IP has become unreachable. The cascade separates the connection point and the exit address across different networks, so even if one of them goes down, the other stays out of reach.

How the cascade works

For a regular Xray user, traffic reaches the internet from your server's IP, and the provider sees the connection to that same server. The cascade splits apart the two points where the server is visible from the outside:

• Entry node — what the user's provider sees. To it, this is an ordinary REALITY server, indistinguishable from a website.
• Exit node — what the internet sees. Destination sites receive requests from the exit node's IP, on a different network and usually in a different country.

This isn't Tor-level anonymization: the chain adds exactly one intermediate node to change the exit IP, nothing more.

What you'll need

• At least two BeAdmin servers in different locations — otherwise the cascade makes no sense. The Xray module must be installed on each. Let's call them installation A (the future entry) and installation B (the future exit).
• Place the entry node closer to the user, ideally in the same country: the device connects to it directly, and the shorter this leg, the more stable the link. The distant point is the exit node — it provides the exit IP you need.
• Edit access to both panels — linking is done manually, by copying a link from one panel into the other.

If you haven't picked servers for the entry and exit nodes yet, we offer NVMe-based VPS with full root access in several countries — put the entry close to the user and the exit in the location you need. Order a VPS.

Creating the exit node on installation B

The link is one-way and built by hand: the exit node issues a special bemh://… link, which you copy and paste into the entry node on the other server. Order matters — exit first, then entry.

1. On installation B, open the Xray module and click Create user.
2. In the Operating mode field, select Cascade, and in the Cascade role field that appears, select Exit node. Fill in the required fields and create the user.
3. The exit node has no link or QR code of its own — instead, the expanded row shows the label "Exit node — no connection settings". This is normal: such a user only forwards other traffic to the internet and doesn't connect directly itself.
4. Click Link for entry node — the panel generates and copies a link in the form bemh://…. It encodes this exit node's connection parameters. Send it to installation A by any convenient means.

Exit node row: a "Link for entry node" button instead of a QR code

Creating the entry node on installation A

1. On installation A, open the Xray module and click Create user.
2. In the Operating mode field, select Cascade, and in the Cascade role field, select Entry node.
3. In the Exit node link field that appears, paste the bemh://… link you copied in the previous step.
4. Fill in the required fields and create the user.

Creating an entry node: Cascade mode, Entry node role, and the pasted bemh:// link

The entry node is a full-fledged user with its own vless://… link and QR code. Those are what you hand out to the end device, just like a regular user (see Managing Xray users). From there, traffic follows the chain on its own.

Checking the cascade status

The entry node's expanded row shows a Cascade status tile — it indicates whether the entry can reach its exit. Next to it, once the link is set up, a tile with the exit node's address appears.

Status	What it means and what to do
Active	The link is up and the exit node is reachable — the chain is working.
Checking…	The panel is polling the exit node. Wait — the status will update on its own.
Exit not linked	The exit node link hasn't been pasted yet. Open the entry node for editing and paste the bemh://… link.
Exit unreachable	The exit node isn't responding. Check that the Xray service is running on installation B, the server is on and reachable over the network, and the exit address and port haven't changed.
Version mismatch	The Xray version on the exit node is below the minimum required by the link. Update the Xray module on installation B and regenerate the link for the entry node.

Relinking and unlinking the exit node

You can change the entry node's link to its exit at any time:

• Relink to a different exit. Get a new bemh://… link on the desired exit node and paste it into the entry node's Exit node link field — the previous link is replaced by the new one.
• Unlink. In the entry node's expanded row, click Unlink (or clear the link field in the edit dialog). The user returns to a direct internet exit — traffic again goes through the entry node itself, without the second server.

When you switch exits, end devices re-import nothing: the entry node keeps its existing vless://… link.

What the cascade doesn't do

• It doesn't merge management of the two panels. Installations A and B remain independent, and all linking is manual, via the link. There's no reverse channel between the panels: the exit node doesn't know who's connected to it.
• It doesn't replace anonymization. The destination site sees the exit node's IP — it's a change of address, not a way to hide your identity.