diff --git a/server/proxy/README.md b/server/proxy/README.md
index cc099926..bc282746 100644
--- a/server/proxy/README.md
+++ b/server/proxy/README.md
@@ -99,7 +99,7 @@ SG服务器总月流量: **2560 GB**
    → 通过邮件发送订阅URL到冰朔邮箱
 
 2. 冰朔在客户端添加订阅URL
-   → 客户端请求 https://server:3802/sub/{token}
+   → 客户端请求 http://server/api/proxy-sub/sub/{token}
    → 返回Clash YAML / Base64配置
    → 返回Header: subscription-userinfo (配额信息)
    → 客户端显示剩余流量
diff --git a/server/proxy/dashboard/update-dashboard.js b/server/proxy/dashboard/update-dashboard.js
index 277704fd..687babe9 100644
--- a/server/proxy/dashboard/update-dashboard.js
+++ b/server/proxy/dashboard/update-dashboard.js
@@ -71,7 +71,7 @@ function readRemoteQuota() {
     return Promise.resolve(null);
   }
   return new Promise((resolve) => {
-    http.get(`http://${host}:3802/quota`, { timeout: 10000 }, (res) => {
+    http.get(`http://${host}/api/proxy-sub/quota`, { timeout: 10000 }, (res) => {
       let data = '';
       res.on('data', (d) => { data += d; });
       res.on('end', () => {
diff --git a/server/proxy/deploy-proxy.sh b/server/proxy/deploy-proxy.sh
index 4ba5e030..cf30da70 100644
--- a/server/proxy/deploy-proxy.sh
+++ b/server/proxy/deploy-proxy.sh
@@ -268,6 +268,9 @@ update() {
     ensure_xray_root_user
     ensure_log_permissions
 
+    # 关闭3802外部端口 (订阅服务改为通过Nginx反代访问)
+    ufw delete allow 3802/tcp 2>/dev/null || true
+
     systemctl restart xray
     pm2 restart zy-proxy-sub zy-proxy-monitor zy-proxy-guardian 2>/dev/null || true
     health_check
diff --git a/server/proxy/service/send-subscription.js b/server/proxy/service/send-subscription.js
index 26c7947d..7b773ff8 100644
--- a/server/proxy/service/send-subscription.js
+++ b/server/proxy/service/send-subscription.js
@@ -116,7 +116,7 @@ function detectSmtpHost(email) {
 
 // ── 生成订阅邮件HTML ─────────────────────────
 function generateSubscriptionEmail(config) {
-  const subUrl = `http://${config.server_host}:3802/sub/${config.sub_token}`;
+  const subUrl = `http://${config.server_host}/api/proxy-sub/sub/${config.sub_token}`;
   const now = new Date().toLocaleString('zh-CN', { timeZone: 'Asia/Shanghai' });
 
   return `
diff --git a/server/proxy/setup/install-xray.sh b/server/proxy/setup/install-xray.sh
index 5c8214c6..4ce9c677 100644
--- a/server/proxy/setup/install-xray.sh
+++ b/server/proxy/setup/install-xray.sh
@@ -67,9 +67,14 @@ fi
 # ── 4. 防火墙配置 ────────────────────────────
 echo "[4/6] 配置防火墙..."
 ufw allow 443/tcp comment "Xray VLESS+Reality" || true
-ufw allow 3802/tcp comment "ZY-Proxy subscription service" || true
+# 端口3802不再需要外部直连 — 订阅服务通过Nginx反代(/api/proxy-sub/)访问
+if ufw delete allow 3802/tcp 2>/dev/null; then
+    echo "  ✅ 已移除3802端口外部访问规则"
+else
+    echo "  ℹ️ 3802端口规则不存在 (无需移除)"
+fi
 ufw reload || echo "⚠️ 防火墙重载失败，请手动检查"
-echo "  防火墙已配置: 443(Xray) + 3802(订阅服务)"
+echo "  防火墙已配置: 443(Xray) · 订阅服务走Nginx反代(端口80)"
 
 # ── 5. 生成密钥 ──────────────────────────────
 echo "[5/6] 生成密钥..."