Why choose CYV

3x-ui, Amnezia, Remnawave and CreateYourVPN all help you run a VPN on your own server. That is where the similarity mostly ends: the products are built for different goals and for a different amount of work the owner is willing to do by hand.

3x-ui and Remnawave are self-hosted panels. You install them on your own infrastructure, get a wide range of settings, and take care of domains, updates, hardening, monitoring and repairs yourself. Amnezia Self-hosted is an application built first of all for a simple personal VPN: it can set up a VPN on a single VPS without a terminal and share access with others. CreateYourVPN, or CYV, is a managed platform: the servers stay yours, while the day-to-day operations are handled by the service.

So the real question is not "which panel has more switches" but how much manual work is left after the first launch. If you want to learn Xray, Docker and Linux, a self-hosted panel gives you plenty of room. If you want a working VPN for yourself, your family or your customers without taking on a second job as a system administrator, CYV covers far more of that out of the box.

What follows compares built-in capabilities. An extra script, an external bot or custom development can in theory add almost anything to any panel, but that becomes a separate system you have to choose, connect, update and maintain.

In short: the main difference

CYV starts working earlier than a regular VPN panel. It does not just install a VPN component, it prepares the VPS itself: it creates a dedicated user, moves SSH to keys, closes unnecessary ports, turns on the firewall, fail2ban and security updates. After the installation the platform keeps watching the server instead of handing it over to the owner with a manual.

If a service or an inbound stops working, CYV does not stop at a red indicator. Automatic workers try to restore the node, the incident history shows what happened, and an unreachable entry point stops being handed out to users while the route still has a healthy alternative.

For networks with blocking there is a separate layer: a masking site scanner, Reality checks run from the node itself, mutual checks between servers, a quorum for detecting blocks, and the experimental OLCRTC emergency protocol for allowlist-only networks.

Finally, CYV is not only infrastructure. One system already includes a user cabinet, plans, payments, a white-label storefront, emails, a Partner API and MCP integration with AI assistants. What usually has to be assembled around a self-hosted panel as separate projects works here as a single product.

1. Setup and day-to-day operations

Security starts before the VPN is installed

On a fresh VPS, SSH is usually on its standard port, password login is allowed, and the network rules depend on the hoster's image. A panel installer may add the panel itself, but that does not mean the whole operating system has become secure.

When a server is connected, CYV runs a separate preparation stage:

• creates a service administrator and enables SSH key login;
• turns off password login and direct root login;
• moves SSH to a non-standard port;
• enables UFW with a "deny everything except what is needed" rule;
• restricts service ports to the addresses of the control plane;
• turns on fail2ban and automatic installation of security updates;
• sets up rotation and short retention of system logs.

The root password entered when adding a server is used only for the first connection and is not stored. After the preparation stage CYV works through a separate key. The whole process is described in the servers lesson and in the first launch guide.

The panel is not another server to maintain

3x-ui and Remnawave have to be installed, exposed to the internet through a safe address, given TLS, updated and backed up. Remnawave additionally requires the panel, the nodes, a domain and a reverse proxy to be deployed. That is a normal model for a self-hosted product, but along with control the owner gets one more production service.

CYV is already hosted and updated as a single platform. The owner connects their VPS machines, while the versions of the server components and service agents are rolled out centrally. There is no need to log into every server and repeat the update by hand.

Monitoring should answer the question "what do I do next"

CPU load and a green process status are useful, but on their own they do not explain why a particular user cannot connect. In CYV, diagnostics tie together the state of the server, the inbound, the route and the subscription, and describe the problem in plain language.

If the failure is already over, a seven-day history remains: when the problem started, how long it lasted, whether it had happened before, whether a repair ran, whether the panel was restarted and whether a notification was sent. That makes it possible to tell a random network hiccup from a systematic problem at the hoster.

More on this: monitoring and the mesh, server metrics and routes.

Support is part of the product

A support request to CYV can be sent straight from the panel at any time. That matters most for a newcomer: you do not have to work out first which component broke and whose GitHub Issues to go to. Open-source projects have documentation, communities and chats, but community help is not the same as a built-in support channel of a service.

2. Blocking resistance, routing and networking

CYV helps you stop guessing the masking site

VLESS + Reality makes a VPN connection look like an ordinary HTTPS visit to a real website. How well the disguise holds depends on the chosen site: it has to support TLS 1.3 and HTTP/2, be reachable from the server's country and answer fast enough.

In CYV the server scans its own network neighbourhood automatically and looks for nearby sites that meet those requirements. A close site usually gives minimal latency and a traffic pattern that is natural for a data centre. The candidates appear in the panel as ready-made suggestions, and the chosen address is verified from the node itself, not from the owner's browser in another country.

The scan runs during installation and can be repeated manually at any time. How it works and why it checks for TLS 1.3 + HTTP/2 is explained in the masking scanner lesson.

Servers look at each other from the outside

A self-check sees that Xray is running and the port is listening. It cannot see the case where the IP address is blocked at the user's provider: the server considers itself healthy, but from the outside nobody can reach it.

That is why CYV servers form a mesh. Every node checks the other servers and their inbounds, and the decision is made not on a single random timeout but on a sustained series of failures and the votes of several independent checkers. A server in your customers' country can be marked as a trusted checker, so its view is closer to the real user network.

When a block is confirmed, the owner gets an email and the affected inbound stops being handed out as long as the same route still has a healthy entry point. On the next subscription refresh the user moves to a working server without needing a new link. The system does not promise to see every network in the world: the checks show the view from your own servers, which is exactly why a checker in the right country is so useful.

A route is a stable line, not one particular server

In the user's app a single route looks like one location. Inside it there can be several inbounds on different servers.

CYV distributes users across servers. The panel works out which server is the least loaded right now and sends the next user there: the load is measured as free bandwidth per connected user, so a weak, busy machine will not get new people. There is also plain round-robin with coefficients, for when servers differ in power and you want to set the proportion by hand.

If one server drops out, the route stays. If no healthy inbound is left at all, the empty line temporarily disappears from the subscription and comes back after recovery. Because of that, replacing or repairing a single VPS does not turn into sending new configurations to the whole audience.

For a more complex topology there is multi-hop: the user enters through a server in one country and reaches the internet through another. The chain is assembled in the panel without editing the Xray configuration by hand.

Split tunneling reaches apps and routers

In CYV you can define which domains, site categories and countries go through the VPN and which go directly. The geosite and geoip values are validated against a catalog before saving: a typo will not end up in the config and will not break the app on the user's device.

Ready-made rules can be imported from Clash, sing-box, Xray or a plain list. The source is refreshed once a month, and a potentially dangerous expansion of the rules that would send too much traffic around the VPN requires the owner to review it again.

The same rules reach compatible apps and home routers running OpenWrt with Nikki. Separately, torrent and ad blocking can be enabled on the server, so users cannot get around it by editing their local config. A good place to start is the lessons on inbounds and connecting OpenWrt.

OLCRTC is the backup path for allowlists

When a network allows only a short list of services, ordinary VPN protocols may not establish a connection at all. For that case CYV has the experimental OLCRTC emergency protocol.

The user creates a fresh video call in a supported service, passes the link through the cabinet or by email, and gets a temporary connection. To the restricting network the traffic looks like taking part in an allowed video conference. OLCRTC is slower than a normal VPN and depends on the video service being available, so it is used as a lifebuoy rather than as the main transport. It is best to prepare in advance following the emergency access instructions.

3. Users, storefront and money

Not just a link, but a user cabinet

A subscription link and a QR code exist in several products, and the table says so honestly. What sets CYV apart is that a complete user journey is already built around that link.

The customer signs in with a one-time code from their email and sees:

• their subscription and a QR code;
• app installation buttons and instructions;
• the term, traffic and access status;
• plans and a payment button;
• the support contacts of your service;
• the link and instructions for OpenWrt with Nikki;
• emergency access, if it is enabled.

The storefront can be installed on a phone's home screen as a PWA with your own name and icon. When a server, a route or a rule changes, the user does not receive a new file: the app picks up the update through the same subscription. This is shown in more detail in the lessons on users and storefront customization.

A device limit you can explain and service

A "one connection" limit often turns into a mysterious refusal with no information about which device took the slot. In CYV the user has device slots, and the owner sees the taken slots, the time of the last request and a 24-hour refusal counter. An inactive slot is freed after 14 days; when needed, the owner resets slots manually.

If a link leaks, the user can reissue it from the cabinet themselves, within a rate limit. The old secret and keys stop working, and the event stays in the security log. The owner does not have to find the customer and do it for them.

Remnawave also supports HWID restrictions, which is why it gets a ✅ in the device control row. It is an example of a similar feature that products solve in different ways.

The storefront becomes a service under your brand

At the base level CYV already gives you a cabinet. The Max plan adds a public landing page, your own domains and a full sales flow. The logo is automatically used as the favicon, the PWA icon and the social preview image; colours, name and support contacts are set by the owner.

The storefront has three separate addresses: landing page, cabinet and subscriptions. They can live on different domains, so blocking the public home page does not have to take user sign-in and configuration updates down with it. The customer sees the owner's brand, not CreateYourVPN, including the cabinet interface and the emails.

A payment turns into access right away

In CYV a plan is a term, traffic, a device limit, a price and signup rules. It can be granted by hand or sold through a connected payment provider. After a verified webhook, the system finds the user itself, activates or extends access, and protects against granting the same payment twice.

The money goes straight into the owner's account at the provider; CYV is not the seller and takes no commission from the revenue. The payment log shows processed events, errors and "unlinked" payments. The latter can be matched to a user and a plan manually, after which the next payment is recognised automatically.

The whole path is described in three lessons: plans, monetization and platform billing.

4. Automation, integrations and data safety

MCP lets you run the infrastructure by talking to it

3x-ui, Remnawave and CYV all have an API, so all three can be wired into your own automation. In CYV a remote MCP server already runs on top of the Partner API: a compatible AI assistant gets not a raw HTTP API but clear tools for servers, inbounds, routes, users, diagnostics and documentation.

The connection goes through OAuth. The owner picks the level: view only, view and configure, or full access. Permissions are checked on every call, dangerous deletions are additionally protected by a code from email, and the connection can be revoked from the panel. The action log shows which tool was called and how the operation ended; secrets and full email addresses never get into it.

You can connect ChatGPT, Claude, DeepSeek and other MCP clients. The architecture and the limits of access are covered in the MCP lesson, and a practical example is in the DeepSeek guide. For ordinary integrations there is the Partner API overview.

The backup leaves already encrypted, into the owner's storage

A backup saves the users, their terms, limits, subscription tokens and connection keys. CYV encrypts the file before uploading it and puts it into the owner's Google Drive or S3-compatible storage: AWS S3, Cloudflare R2, Backblaze B2, Wasabi and others.

The copy can be restored into a CYV cluster or into a clean compatible panel. That is a matter of principle: the backup stays useful even outside the platform, and users' already configured apps can keep working after a restore. The frequency and retention are set by the owner; the details are in the backups lesson and the backup instructions.

The Pro plan also includes cluster master swap. The control role moves to another node without replacing users' subscription links. Instead of an emergency manual migration you get a controlled operation with pre-checks and a rollback; more in the clusters lesson.

5. Verifiable security and privacy

Not "trust us", but claims that can be disproved

CYV publishes a security report. It consists not of general promises but of numbered claims: what happens to the first VPS password, what data ends up in logs, how accounts are separated and what is installed on the server.

The known limitations are published next to them. A researcher can not only find a classic vulnerability but also prove that one of the report's claims is wrong. There is an own bug bounty program for exactly that. Confirmed findings and fixes go into a public log, and the authors into the Hall of Fame.

This format matters for a managed platform: part of the work is done automatically, so trust has to rest on checkable technical promises and a track record of reacting to mistakes.

Minimal logs

On the VPN servers the Xray access log is force-disabled on every configuration push: the addresses users visit are not recorded. System logs on the VPS are kept for one hour, the load history for 24 hours, and anonymised infrastructure incidents and diagnostic results for up to seven days.

A general overview of these principles is in the CYV security centre.

What it actually costs

3x-ui, Amnezia Self-hosted and Remnawave can be used free of charge: that is one of their important advantages. But a zero licence price does not make running them free. The bill still includes a VPS for the panel, domains, backups, monitoring and, above all, the time of the person who updates the system and reacts to failures.

CYV has no subscription fee per server. The first user is free; after that you can choose €0.10 per month per user in the database, or €0.20 only for a user who connected within the last 24 hours. Pro costs €0.99 per month and adds backups, OLCRTC and master swap. Max costs €4.99 per month, includes Pro and unlocks the landing page, your own domains, plans and sales.

So the comparison worth making is not "€0 against €0.10" but two ways of paying: with your own time for manual operations, or with a small predictable amount for automation. The current charging model, the trial period and how the balance behaves are described in detail in the billing lesson.

What stays yours

CYV does not sell a ready-made shared VPN and does not take the infrastructure for itself. The VPS machines are rented from the hosters you choose, the domains belong to you, customer payments go straight to your provider, and the backups sit in your Google Drive or S3.

The user base can be saved regularly into your own storage and restored from a copy outside CYV. This is not only an emergency feature but also an answer to the question of platform lock-in: the automation is provided by the service, while the core assets stay with the owner.

Which option fits whom

3x-ui suits people who want a free general-purpose panel with a wide choice of protocols and who want to manage every setting themselves. It has subscriptions, a REST API, multi-node support, backups and bots for administrators.

Amnezia Self-hosted is a strong option for a personal VPN on a single VPS. Installation happens without a terminal, several protocols are available, and access can be shared with family by key, file or QR code.

Remnawave is aimed at an experienced administrator who needs a modern self-hosted panel, several nodes, flexible Xray profiles, an API, metrics and a brandable subscription page.

CYV is worth choosing when what matters is not the maximum number of manual settings but a finished result: connect servers safely, keep them working automatically, detect blocking, give people a convenient cabinet and, if you want, turn all of it into a service under your own brand.

Frequently asked questions

Is CYV suitable for a single personal VPN?

Yes. You can stay in the simplified single-server mode and never turn on the business features. The first user is free, so for a personal setup you only pay for renting your VPS. If family or customers appear later, nothing has to be rebuilt from scratch.

Do I need to know Linux administration?

No. For the first launch it is enough to rent a compatible VPS and enter its connection details in the setup wizard. CYV prepares the operating system and installs the needed components itself. The terminal remains available to the owner, but it is not the usual way to manage things.

Does CYV replace a hosting provider?

No. You rent the VPS directly from any suitable provider, and CYV connects and operates it as a VPN server. The VPS bill is paid to the hoster separately.

What happens if a server gets blocked?

Your other servers will notice the sustained unreachability, and a trusted checker helps determine the direction of the block. CYV warns the owner and stops handing out a confirmed blocked inbound if the route has a healthy alternative. For allowlist networks there is the separate OLCRTC emergency path.

Do I need to develop my own VPN app?

No. Users connect with standard apps: Happ, Streisand, v2rayN, v2rayNG, Hiddify and others. The cabinet shows a suitable app and provides the link or QR code. A good starting point is the Happ guide.

Does CYV record the sites users visit?

No. The Xray access log on connected servers is force-disabled. The platform keeps only limited technical telemetry needed for server health, diagnostics and security; the retention periods are published in the report.

Can I connect my own bot or CRM to CYV?

Yes. For ordinary integrations there is the Partner API and a public Postman collection. For AI assistants there is MCP with OAuth and selectable permissions. Both let you automate work without handing over your panel password.

What happens to my users if I decide to leave?

The servers and domains stay yours. On Pro you can regularly export an encrypted user database into your own storage and then restore the copy into a clean compatible panel.

How we compared

We did not compare every Xray feature or the number of fields in forms. The criterion of this article is what the owner gets as a finished working process: installation, VPS security, detecting and repairing failures, reacting to blocking, delivering access to the user, sales and automation.

For the other products we used the official materials available on the article's update date:

• 3x-ui documentation and its sections on installation and subscriptions;
• Amnezia documentation on setting up a Self-hosted VPN and sharing access;
• Remnawave documentation on initial setup, environment variables and the official subscription page template.

Products evolve, so the tables capture the state on the date given above. If a comparable built-in feature appears in a competitor's official release, the comparison should be updated.