diff --git a/docs/client-development.md b/docs/client-development.md
index 9bab12f..f9d5239 100644
--- a/docs/client-development.md
+++ b/docs/client-development.md
@@ -780,7 +780,7 @@ ip6tables -t nat -A POSTROUTING -s <VPN_V6_SUBNET> -o <物理网卡> -j MASQUERA
 | `readyTimeout` | 30s | 等待 ready 超时 | `internal/vpn/tunnel.go:19` |
 | `pingPeriod` | 30s | Ping 周期 | `internal/vpn/tunnel.go:20` |
 | `maxMessageSize` | 1 MB | 单消息上限 | `internal/vpn/tunnel.go:21` |
-| `maxConnsPerUser` | 3 | 单用户并发连接上限 | `internal/vpn/tunnel.go:22` |
+| `maxConnsPerUser` | 30（可配置） | 单用户并发连接上限 | `internal/model/vpn.go` (`VpnSetting.MaxConnsPerUser`) |
 | `tokenExpire` | 24h | JWT 有效期 | `internal/middleware/auth.go:15` |
 | 登录限流 | 5/min·IP | `/api/login` 限流 | `internal/middleware/ratelimit.go:76` |
 | 密码认证限流 | 5/min·(IP+用户名) | WebSocket 密码认证限流 | `internal/vpn/auth.go:15,41` |
diff --git a/frontend/src/locales/en.ts b/frontend/src/locales/en.ts
index c077f45..37b8880 100644
--- a/frontend/src/locales/en.ts
+++ b/frontend/src/locales/en.ts
@@ -133,6 +133,7 @@ export default {
     serverConfigTunIp: 'Server Configures TUN IP',
     autoConfig: 'Auto',
     manual: 'Manual',
+    maxConnsPerUser: 'Max Connections Per User',
     saveSettings: 'Save Settings',
     saveSuccess: 'Saved successfully',
     user: 'User',
@@ -168,7 +169,7 @@ export default {
       'Admin and user roles with full user CRUD, enable/disable, and password changes, plus self-protection rules.',
     multiDevice: 'Multi-Device Concurrent',
     multiDeviceDesc:
-      'Up to 3 concurrent connections per user with automatic tunnel IP assignment.',
+      'Supports multi-device concurrent connections per user, configurable in admin panel.',
     dualStack: 'IPv4/IPv6 Dual-Stack',
     dualStackDesc:
       'Supports both IPv4 and IPv6 subnets with NAT dual-stack forwarding and anti-spoofing.',
diff --git a/frontend/src/locales/zh.ts b/frontend/src/locales/zh.ts
index dec89d1..7ac506c 100644
--- a/frontend/src/locales/zh.ts
+++ b/frontend/src/locales/zh.ts
@@ -132,6 +132,7 @@ export default {
     serverConfigTunIp: '服务端配置 TUN IP',
     autoConfig: '自动配置',
     manual: '手动',
+    maxConnsPerUser: '每用户最大连接数',
     saveSettings: '保存设置',
     saveSuccess: '保存成功',
     user: '用户',
@@ -165,7 +166,7 @@ export default {
     userManageDesc:
       '管理员与普通角色，支持用户增删改、启用禁用与改密，内置自保护规则。',
     multiDevice: '多设备并发',
-    multiDeviceDesc: '每用户最多 3 个并发连接，自动分配隧道 IP 地址。',
+    multiDeviceDesc: '每用户支持多设备并发连接，可在管理后台配置上限。',
     dualStack: 'IPv4/IPv6 双栈',
     dualStackDesc: '同时支持 IPv4 与 IPv6 子网，NAT 双栈转发与源地址反欺骗。',
     reservation: '静态 IP 预留',
diff --git a/frontend/src/views/VpnView.vue b/frontend/src/views/VpnView.vue
index e7f786f..e80bcc1 100644
--- a/frontend/src/views/VpnView.vue
+++ b/frontend/src/views/VpnView.vue
@@ -16,6 +16,7 @@ interface Settings {
   allow_client_to_client: boolean
   do_local_ip_config: boolean
   do_remote_ip_config: boolean
+  max_conns_per_user: number
 }
 interface ClientInfo {
   user_id: number
@@ -83,6 +84,7 @@ const form = ref<Settings>({
   allow_client_to_client: false,
   do_local_ip_config: true,
   do_remote_ip_config: true,
+  max_conns_per_user: 30,
 })
 
 async function fetchSettings() {
@@ -403,6 +405,10 @@ onMounted(() => {
             <option :value="false">{{ t('vpn.manual') }}</option>
           </select>
         </div>
+        <div>
+          <label class="block text-sm font-medium text-gray-700 dark:text-gray-300 mb-1">{{ t('vpn.maxConnsPerUser') }}</label>
+          <input v-model.number="form.max_conns_per_user" type="number" min="1" max="1000" class="w-full px-3 py-2 border border-gray-300 dark:border-gray-600 rounded-lg bg-white dark:bg-gray-700 text-gray-900 dark:text-white" />
+        </div>
       </div>
       <div class="flex items-center gap-4 mt-6">
         <button
diff --git a/internal/db/db.go b/internal/db/db.go
index 1ea8f4f..1aeb66f 100644
--- a/internal/db/db.go
+++ b/internal/db/db.go
@@ -105,21 +105,30 @@ func seedDefaultAdmin(cfg *config.DatabaseConfig) error {
 func seedDefaultVpnSettings() error {
 	var s model.VpnSetting
 	if err := DB.First(&s, model.VpnSettingSingletonID).Error; err == nil {
+		needSave := false
 		if s.Subnet6 == "" {
 			s.Subnet6 = "fd00:dead:beef::/112"
+			needSave = true
+		}
+		if s.MaxConnsPerUser == 0 {
+			s.MaxConnsPerUser = 30
+			needSave = true
+		}
+		if needSave {
 			DB.Save(&s)
 		}
 		return nil
 	}
 	s = model.VpnSetting{
-		ID:               model.VpnSettingSingletonID,
-		Enabled:          false,
-		Subnet:           "192.168.77.0/24",
-		Subnet6:          "fd00:dead:beef::/112",
-		MTU:              1420,
-		InterfaceName:    "",
-		DoLocalIPConfig:  true,
-		DoRemoteIPConfig: true,
+		ID:                model.VpnSettingSingletonID,
+		Enabled:           false,
+		Subnet:            "192.168.77.0/24",
+		Subnet6:           "fd00:dead:beef::/112",
+		MTU:               1420,
+		InterfaceName:     "",
+		DoLocalIPConfig:   true,
+		DoRemoteIPConfig:  true,
+		MaxConnsPerUser:   30,
 	}
 	return DB.Create(&s).Error
 }
diff --git a/internal/handler/vpn.go b/internal/handler/vpn.go
index 10af5db..443b30f 100644
--- a/internal/handler/vpn.go
+++ b/internal/handler/vpn.go
@@ -22,6 +22,7 @@ type vpnSettingsResponse struct {
 	AllowClientToClient bool   `json:"allow_client_to_client"`
 	DoLocalIPConfig     bool   `json:"do_local_ip_config"`
 	DoRemoteIPConfig    bool   `json:"do_remote_ip_config"`
+	MaxConnsPerUser     int    `json:"max_conns_per_user"`
 }
 
 type updateVpnSettingsRequest struct {
@@ -33,6 +34,7 @@ type updateVpnSettingsRequest struct {
 	AllowClientToClient *bool   `json:"allow_client_to_client"`
 	DoLocalIPConfig     *bool   `json:"do_local_ip_config"`
 	DoRemoteIPConfig    *bool   `json:"do_remote_ip_config"`
+	MaxConnsPerUser     *int    `json:"max_conns_per_user"`
 }
 
 func loadVpnSettings() (model.VpnSetting, error) {
@@ -131,6 +133,7 @@ func GetVpnSettings(c *gin.Context) {
 		AllowClientToClient: s.AllowClientToClient,
 		DoLocalIPConfig:     s.DoLocalIPConfig,
 		DoRemoteIPConfig:    s.DoRemoteIPConfig,
+		MaxConnsPerUser:     s.MaxConnsPerUser,
 	})
 }
 
@@ -185,6 +188,13 @@ func UpdateVpnSettings(c *gin.Context) {
 	if req.DoRemoteIPConfig != nil {
 		s.DoRemoteIPConfig = *req.DoRemoteIPConfig
 	}
+	if req.MaxConnsPerUser != nil {
+		if *req.MaxConnsPerUser < 1 || *req.MaxConnsPerUser > 1000 {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "每用户最大连接数范围 1-1000"})
+			return
+		}
+		s.MaxConnsPerUser = *req.MaxConnsPerUser
+	}
 
 	if err := db.DB.Save(&s).Error; err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "保存设置失败"})
diff --git a/internal/model/vpn.go b/internal/model/vpn.go
index 1ebe842..1362acf 100644
--- a/internal/model/vpn.go
+++ b/internal/model/vpn.go
@@ -14,6 +14,7 @@ type VpnSetting struct {
 	AllowClientToClient bool   `gorm:"default:false"`
 	DoLocalIPConfig     bool   `gorm:"default:true"`
 	DoRemoteIPConfig    bool   `gorm:"default:true"`
+	MaxConnsPerUser     int    `gorm:"default:30"`
 	UpdatedAt           time.Time
 }
 
diff --git a/internal/vpn/tunnel.go b/internal/vpn/tunnel.go
index 30a7480..5e81b84 100644
--- a/internal/vpn/tunnel.go
+++ b/internal/vpn/tunnel.go
@@ -21,8 +21,7 @@ const (
 	writeTimeout    = 10 * time.Second
 	readyTimeout    = 30 * time.Second
 	pingPeriod      = 30 * time.Second
-	maxMessageSize  = 1 << 20
-	maxConnsPerUser = 3
+	maxMessageSize = 1 << 20
 )
 
 var (
@@ -99,7 +98,11 @@ func runTunnel(conn *websocket.Conn, user *model.User) {
 	}
 
 	activeConnsMu.Lock()
-	if activeConns[user.ID] >= maxConnsPerUser {
+	maxConns := VPN.Settings().MaxConnsPerUser
+	if maxConns <= 0 {
+		maxConns = 30
+	}
+	if activeConns[user.ID] >= maxConns {
 		activeConnsMu.Unlock()
 		_ = sendJSON(conn, controlMessage{Type: "error", Message: "连接数已达上限"})
 		return