paqet-tunnel

Easy installer for tunneling VPN traffic through a middle server using paqet — raw packet-level tunneling that bypasses network restrictions.

Version: v2.0.0

How it works

Clients connect to Server A (the Iran entry point), which tunnels traffic over an encrypted paqet/KCP link to Server B (abroad), where your V2Ray/X-UI runs. You only change the IP in your VPN client from Server B to Server A — nothing else.

Client ──▶ Server A (Iran) ══ paqet tunnel ══▶ Server B (abroad) ──▶ V2Ray

Install

Run on both servers (as root):

bash <(curl -fsSL https://raw.githubusercontent.com/g3ntrix/paqet-tunnel/main/install.sh)

The first run is a guided wizard: it asks whether this machine is the abroad server or the Iran server, auto-detects the network, and walks you through the rest.

Setup (two steps)

1. Server B (abroad) — choose Abroad server (B):

• Confirm the detected network, pick the paqet port (default 8888), enter your V2Ray port(s).
• Copy the Connection String it prints at the end (paqet://…).

2. Server A (Iran) — choose Iran entry server (A):

• Give the tunnel a name, then paste the Connection String — it fills in the IP, port, key, and ports automatically.
• A health check confirms the tunnel is live.

Then point your VPN client at Server A's IP instead of Server B's.

To reach more abroad servers, run Server A setup again with a different tunnel name.

⚠️ Required: V2Ray must listen on 0.0.0.0

On Server B, set your V2Ray/X-UI inbound Listen IP to 0.0.0.0 (not the public IP, not empty). paqet delivers traffic to 127.0.0.1:PORT, so V2Ray must accept localhost connections.

Handy menu options

• c — Health check (verify the tunnel end-to-end)
• k — Show the Connection String again (Server B)
• 3 Status · 5 Edit config · 6 Manage tunnels · u Uninstall
• i — Install as the paqet-tunnel command (then just run paqet-tunnel)

Commands

# Server B
systemctl status paqet
journalctl -u paqet -f

# Server A (per tunnel — <name> is your tunnel name)
systemctl status paqet-<name>
journalctl -u paqet-<name> -f

Troubleshooting

• connection lost, retrying / health check fails — on Server A, the paqet port must be Server B's tunnel port (e.g. 8888), not the V2Ray port. Re-run setup, or paste the Connection String so it's filled in automatically.
• Clients can't connect — confirm V2Ray listens on 0.0.0.0, and the cloud firewall allows the paqet port on Server B.
• Download blocked in Iran — grab the paqet binary from releases and give the installer the local file path when prompted.
• High latency — usually the underlying Iran↔abroad route. Compare with a direct ping between the two servers; the tunnel can't go faster than that baseline.

Requirements

Linux (Ubuntu / Debian / CentOS), root access, libpcap and iptables (auto-installed).

Credits & License

Built on paqet by hanselime. MIT License.