Daily traffic
Resistance Policy
Recent activity
https://cdn.example.com/sub?token=••••••••&b64
https://cdn.example.com/sub?token=••••••••&b64
🎁Free-service notice
A labelled node is baked into every config so users always know this is the free Nova service. It is fixed in the worker, so it cannot be turned off, renamed, or stripped by a reseller.
This service is FREE - Nova Proxy TeamThe same servers, ready in each app's format. Copy the one your app uses, or scan its QR. They all point to the same proxy.
🧪 Connectivity test
Check which key sites are reachable through your current connection.
Smart routing
Per-ISP pools
| ISP | ASN | Clean IPs |
|---|
WARP (Cloudflare WireGuard)
Custom routing rules
One rule per line: TYPE,value,OUTBOUND (DIRECT / REJECT / PROXY). Needs routing enabled.
Monthly data cap · سقف داده ماهانه
Auto-pauses all proxy traffic for the rest of the month once this much data is used — a backstop that protects your Cloudflare account from abuse-detection suspensions. 0 = no cap. · با رسیدن مصرف ماه به این مقدار، ترافیک تا پایان ماه متوقف میشود تا حساب Cloudflare از مسدودی در امان بماند. صفر = بدون محدودیت.
Preset rules
Secure DNS
https://example.com/dns-query
🥷 Disguise & secret paths (advanced)
Hide the panel from censors who fingerprint the Worker itself. With this on, your panel, login and subscription move to secret paths you choose — probing the default /admin or /login just returns a generic page. Leave OFF to keep the normal /admin, /login, /sub.
🛰 Backend mode (advanced)
Forward traffic to your own Xray/sing-box server instead of handling it in the Worker. This is the ONLY way to get VMess and working voice/video calls (UDP) — but it requires you to run a backend server (a VPS). Leave OFF to use the normal free in-Worker mode (VLESS/Trojan).
bash <(curl -fsSL https://raw.githubusercontent.com/IRNova/Tools/main/nova-backend.sh)
Paste this one line into your VPS over SSH. It installs Xray, writes the config, opens the firewall, and prints the exact Backend URL to paste above. Your VPS credentials are never sent anywhere — you run it yourself on your own server.
🛠 Change port / remove backend
Change the port — re-run the installer with a Cloudflare-allowed port (8080, 8880, 2052, 2082, 2086, 2095). Ports like 2076/3080/10000 do NOT work.
Remove the backend from your VPS — stops Xray and deletes it. (To stop using it in the panel, just turn the toggle off above; the client QR disappears.)
systemctl stop xray 2>/dev/null; systemctl disable xray 2>/dev/null; rm -rf /usr/local/etc/xray /usr/local/bin/xray /usr/local/share/xray /etc/systemd/system/xray.service /etc/systemd/system/xray@.service; systemctl daemon-reload; echo "Xray removed."
⚠️ Needs a real Xray/sing-box backend. Generate your client configs on the backend, then point them at Nova's domain — Nova will relay to the backend. Test with a real client before relying on it.
📍 Your datacenter
Where your connection currently exits Cloudflare's network.
🚀 Speed test
Find the fastest clean IPs for your current network and apply them automatically.
IP selection mode
Audit log
| Time | Event | Actor | IP | Status |
|---|
🚨Kill switch
Emergency stop. While on, every proxy connection and subscription fetch is refused (503). The admin panel stays reachable so you can switch it back off. Use it if your service is being abused.
Protocol & transport
Security
Domains (HOST)
One domain per line. The first is the main host. Connect each to your Worker first.
ECH & Central
Subscription
Password
Two-factor authentication
Require a 6-digit code at login. Works with Google Authenticator, Authy, and others.
Export all settings (config + network + users) to a file, or restore from one. The file contains secrets, so keep it safe.
Wipes everything from the database (settings, network, clean IPs, users, Cloudflare and Telegram keys) and restores the initial state. Your panel password is kept. This cannot be undone.
Update your Worker to the latest Nova version straight from here — no manual redeploy. It keeps your database, settings, and password. You provide a Cloudflare API token with Workers Scripts → Edit; it is used once and never stored.
Create a Cloudflare API token (My Profile → API Tokens → Create Custom Token) with permission: Account → Workers Scripts → Edit. Then paste it below.
Publishes your sub to a GitHub repo so users keep a permanent raw.githubusercontent.com link even if your domain gets filtered.
Worker requests
Telegram alerts
Users & quotas
Quick start
Tips
🔒 About ECH
What is ECH?
Is ECH blocked in Iran?
How should I use ECH?
🔐 WireGuard config
Build a WireGuard .conf to import into the WireGuard app. Defaults target Cloudflare WARP — edit any field as needed.
🛡️ Cloudflare CDN access
How the Worker reaches Cloudflare's network. Choose a mode, enter the proxy, hit Verify to probe it, then Save. This is the single source of truth — configs pull from here.
Find proxies
Fetch public lists (IRNova/Tools), pick by country, then Use. The PROXYIP list is large (~10MB) — give it a moment. SOCKS5/HTTP/HTTPS lists load once their files exist in the repo.
🧩 Core Node
Your node on every Cloudflare TLS port, using the Worker domain directly — separate from the subscription. Copy or scan any port.