Packet-level tunnel for Linux VPS
PaqetPremium carries traffic inside crafted raw TCP packets (libpcap) and runs KCP or QUIC with smux multiplexing — built for an Iran entry node and a foreign exit node.
Why PaqetPremium
A self-hosted, open tunnel that stays resilient on lossy, filtered links.
Packet-level
Crafted raw TCP over libpcap to slip past simple filtering, with KCP or QUIC as the carrier.
Multi-upstream
Several exit servers with failover, round-robin, weighted, or least-latency strategies + health checks.
All-ports range
Transparently tunnel any port to the server with one rule — no per-port config.
Forward & SOCKS5
TCP/UDP port-forward and a SOCKS5 entry (CONNECT + UDP ASSOCIATE).
Self-healing
Dead tunnels rebuild automatically with backoff — no manual restarts.
FEC tuning
Optional forward error correction trades a little bandwidth for far fewer retransmits.
Live dashboard
Built-in web dashboard plus Prometheus metrics over the admin API.
systemd-native
One-line installer, multi-instance tunnels, .deb/.rpm packages.
How it works
Users hit the Iran node; traffic is tunneled to the foreign node, which relays it to the open internet.
KCP or QUIC + smux"| S subgraph KH["Foreign VPS — role: server"] S["Relay + iptables"] end S --> NET["Open Internet"]
Quick start
Two Linux VPSes (amd64/arm64). Run the guided installer on each. Both ends share the same secret key.
1 · Foreign server (exit)
curl -fsSL https://raw.githubusercontent.com/iPmartNetwork/paqetpremium/master/scripts/install-linux.sh | sudo bash -s -- server
Pick a port, transport (KCP/QUIC) and a secret key. The installer prints the public address to use on the client.
2 · Iran client (entry)
curl -fsSL https://raw.githubusercontent.com/iPmartNetwork/paqetpremium/master/scripts/install-linux.sh | sudo bash -s -- client
Enter the server's PUBLIC address + the same key, then choose port-forward, SOCKS5, or all-ports range mode.
Install from a package
sudo dpkg -i paqetpremium_*.deb # Debian / Ubuntu sudo rpm -i paqetpremium-*.rpm # RHEL / Fedora
Configuration examples
Both ends must agree on the same transport and secret key.
KCP (default) with FEC
transport:
protocol: kcp
conn: 6
kcp:
mode: fast
block: aes-128-gcm
key: SHARED_SECRET
mtu: 1150
data_shard: 10 # FEC (optional) — both ends must match
parity_shard: 3Multi-upstream (failover)
upstream:
strategy: failover # failover | round_robin | weighted | least_latency
health_check: { interval: 10s, timeout: 3s, fail_threshold: 3, recover_threshold: 2 }
servers:
- { name: de-1, addr: 45.1.1.1:8888, key: SHARED_SECRET, priority: 1, weight: 3 }
- { name: nl-1, addr: 45.2.2.2:8888, key: SHARED_SECRET, priority: 2 }All-ports range mode (client)
range: enabled: true protocol: tcp redirect_port: 47999 target_host: "127.0.0.1" # services on the server ports: "1-65535" # or "443,8443,2000-3000" exclude: "22" # keep SSH reachable
Load-balancing strategies
| Strategy | Behaviour | Use when |
|---|---|---|
| failover | Always the highest-priority healthy server; switches on failure | One primary + backups |
| round_robin | Even rotation across healthy servers | Equal servers |
| weighted | Share proportional to weight | Different capacities |
| least_latency | Lowest measured RTT | Always fastest |
Dashboard & management
A live dark dashboard ships in the admin API (bound to 127.0.0.1). View it over SSH:
| Upstream | Health | RTT |
|---|---|---|
| ● kharej-1 | healthy | 62.4 ms |
| kharej-2 | healthy | 88.1 ms |
ssh -L 9090:127.0.0.1:9090 root@SERVER_IP # then open http://localhost:9090 (add ?token=... if a token is set)
Manage individual tunnels from the installer:
sudo ./install-premium.sh tunnels # list with details sudo ./install-premium.sh edit client # edit one tunnel + restart sudo ./install-premium.sh remove v2ray-1 # delete a single tunnel
FAQ
Does it work behind NAT?
Yes. The server crafts packets with its interface IP and the provider NAT rewrites it; configure the client with the server's PUBLIC IP.
Which panel protocols are supported?
Any TCP-based inbound (VLESS/Reality, VMess+WS, Trojan, gRPC, …) works transparently. UDP-based ones (QUIC/Hysteria2/TUIC) work over UDP forwarding with preserved datagram boundaries.
KCP or QUIC?
KCP is the default and tuned for lossy links; QUIC uses TLS 1.3 with a certificate pinned to your shared secret. Both ends must match.