Quantum Panel

Controller fleet

—

Agents online

—

Agent tunnels active

—

Agent versions

—

Recent events

—

Server System

—

CPU

—

RAM

—

Disk

—

Uptime

—

Server Live Traffic

Download—

Upload—

Total transferred—

Server Connections

—

Server Traffic Throughput

Real-time download and upload speeds over time

Live

DownloadUpload

Server Active Connections

Established TCP and UDP connections on this server

—

Server Traffic Usage

Server-wide traffic history saved every minute and retained for seven days.

…

Name	Iran	Foreign	Tunnels	Status	Actions

Output

Tunnel Status

—

Speed and volume limits

—

One speed for both directions and a volume for each foreign server, or unlimited. When a server's volume is used up, its links are cut until the next reset; the other servers keep working.

Tunnel Health

not tested yet

Test All Tunnels checks every tunnel's service, its control session and a real data probe through one of its ports.

GRE wrap

How the main tunnel's GRE packets travel between the two servers. Direct GRE is the fastest. WSS wraps them in TLS on a web port, for networks that block or slow down GRE (protocol 47). 6to4 and 4in6 carry them over IPv6.

Direct GRE

Active wrap — —

Link to other server — —

WSS wrap — —

Switching changes both servers over the Peer Link and reconnects the tunnel for a few seconds; if the tunnel does not answer within 45 seconds, both go back. Re-apply sets up the current carrier again, which can fix a stuck link.

WSS settingsUse the same port on both servers. The SNI is the host name shown in the TLS handshake; leave it empty to send none. The address can be IPv4, IPv6 or a host name: give the other server's IPv6 to carry WSS over IPv6.

WSS port

SNI (optional)

Address of the other server

Enrollment Tokens

One token enrolls exactly one endpoint agent. The token is shown once — copy it and run the command on the endpoint server.

Agent role

Label (optional)

Expiry (days)

Token	Role	Label	Status	Expires	Actions

Agents

Endpoint servers enrolled with a token. Online agents take Matrix desired state and relay commands; revoked agents can never connect again.

Matrix Tunnels (Agents)

Each tunnel pairs one Iran hub agent with one foreign node agent. Both endpoints must advertise the Matrix capability and 1-20 forwarded ports are required.

Cluster

Several servers back each other up, so one failure does not take your users down.

Checking…

Cluster Map

Click any part of the map to see and change it. Line thickness is the share of new connections; color is health.

Carries traffic Healthy, idle Standby, DNS or linked hub Down Drained or not serving

Pools

One public port on this server, served by several foreign servers. When one fails, its users move to the others within seconds.

Tunnels on This Server

Each foreign server's link, checked every second. A tunnel in a pool listens on a private address; the pool sends users to it.

Tunnel	Foreign Server	Health	Latency	Ports

Iran Hubs

Other Iran servers that back this one up. When every foreign server of a pool is down here, its port is forwarded to a hub where the same pool works.

Forward a pool to another hub when no foreign server here can serve it

DNS Failover

A domain that always points to the Iran hubs that work. Users who connect by name move to a working hub when one dies. Cloudflare (DNS only, grey cloud), or a webhook for any other DNS provider.

Off

Record name

TTL (seconds)

Provider

Cloudflare API token (Zone, DNS, Edit)

Keep the record pointed at the working hubs

Health Check

How fast a failed foreign server is taken out and put back. Lower is faster; too low can take a server out on a short hiccup.

Check every (ms)

Out after failed checks

Back after good checks

Show Kernel Rules

Iran Hubs This Server Serves

Serve several Iran servers from this foreign server: when one Iran server dies, users who connect through the others keep working.

Hub	Iran Server	Status	Unit

Join Another Iran Hub

On the other Iran server: Setup, add a foreign server with this server's IP and the same ports.
Copy the bundle it prints and paste it here.

Bundle (hsh1_, bh1_ or gh1_)

Name (optional)

Events

Quick setup: one tunnel, two serversTwo servers, one tunnel. Answer on this machine; the Iran side gives you a token to paste on the Foreign side.

Which server am I on right now?

Pick one. Iran always listens; Foreign always dials.

Tunnel Engine

High-stability Linux GRE kernel tunnel paired with FRP reverse proxy.

Connection Parameters

Iran public IP (auto, editable)

Remote public IP (the other server)

Name of the foreign server (optional)

Local GRE IP

Peer GRE IP

Control / Bind port

Transport Protocol

Token & apply

Token is auto-generated. After setup, copy the bundle below to the Foreign side — one paste fills everything there.

Connect this server to Iran

Setup bundle or token (from Iran side)

Name of the Iran server (optional)

Reverse ports (ranges & mappings allowed)

FRP Transport Protocol

Encryption (AES/TLS) Compression (Snappy) PROXY Protocol v2 (real client IP: turn on acceptProxyProtocol in the Xray inbound first)

Paste any bundle (hsh1_, bh1_, gh1_, BAGHER:) → all fields auto-fill. A legacy token works too.

Advanced (optional)

Manual addresses & control port

Leave everything here empty to auto-join — the panel discovers Iran's settings from the live tunnel. Only fill these in if auto-join fails.

Foreign public IP (auto, editable)

Iran public IP

Local GRE IP

Iran GRE IP

Control port

Add another foreign server (keeps this tunnel)

Connect another foreign server

✓ This is the safe way to add a server. It creates a separate tunnel with its own token — existing tunnels keep running untouched. (Re-running the Iran form above instead would replace this server's tunnel and disconnect old Foreign sides.)

Name (label for this tunnel)

Tunnel Engine

Transport Protocol

Foreign public IP

Iran public IP (auto, editable)

Iran GRE IP (unique)

Foreign GRE IP

Control port (unique per peer)

Reverse ports (ranges & mappings allowed)

Each peer gets its own token. Ports already used by another tunnel are rejected — pick a different one.

Matrix tunnel

—

An encrypted tinc mesh between this server and its peer, independent of the main tunnel. The hub runs on the Iran side; the foreign side registers with the bundle. IPv4 rides the server's IPv4, IPv6 rides its global IPv6.

Logs

Live

Live Activity Stream

Side panel with the latest events. Wide screens (1200px+) only.

Peer tunnels appear here when added.

Search (filters lines)

Level

Lines

—

(pick a service)

Panel errors

Every failed panel action is recorded here with its code — newest last.

Performance

—

Speed settings for the tunnel engine and the server's network stack. The defaults suit traffic that is already encrypted, such as VLESS, Reality and Trojan.

FRP transport

—

Work-conn pool (frpc / frps)

—

Network stack

—

FRP Transport

—

The FRP options of this tunnel. Encryption, compression and multiplexing only cost CPU and speed for VLESS, Reality and Trojan, whose traffic is already encrypted: leave them off unless a service needs them.

Proxy Encryption transport.useEncryption

Encrypts traffic between frpc and frps with AES-128. Only worth it for plain, unencrypted services.

Proxy Compression transport.useCompression

Snappy compression per proxy. Helps plain text services; encrypted traffic does not compress, so for VPN traffic it only uses CPU.

TCP Multiplexing transport.tcpMux

Carries every user connection inside one TCP connection. Over GRE this roughly halves throughput (measured 460 against 1010 Mbit). It must be the same on the Iran server and every foreign server, or frpc cannot log in.

—

PROXY Protocol transport.proxyProtocolVersion

Sends each user's real IP to the service on this server, so Xray logs, limits and IP checks see real users instead of 127.0.0.1. Turn on Proxy Protocol (acceptProxyProtocol) in the Xray inbound first: without it every connection fails.

Bandwidth Limit per Port transport.bandwidthLimit

MB/s

A cap on each forwarded port, for all its users together (megabytes per second). 0 means no limit.

Health Check healthCheck

frpc checks the service on this server every 10 seconds and closes its port on the Iran server while it is down, so users fail at once instead of hanging.

Auto Pool (FRP work connections)

Sizes frpc poolCount and frps maxPoolCount from pool-full errors, active connections, CPU and free RAM. Scales up fast, scales down slowly, restarts only frpc and only when few users are connected.

Auto

Auto Pool (recommended)

When off, the manual values below are written to frpc.toml / frps.toml as typed.

Last decision

—

Pool-full errors (last tick)

—

Last frpc restart

—

Client Pool Count (frpc)

Pre-opened work connections on foreign spokes.

Max Pool Count (frps)

Server-side maximum work connection headroom (always at least 1.5 × poolCount).

Network Stack

Kernel settings that decide speed on long, lossy links. Optimize Network sets all of them and saves the current values first, so Restore can bring them back.

—

Tunnel Watchdog

—

Checks the tunnel every minute: the GRE link and the FRP service, or for Backhaul its control session. Sends Telegram alerts and, if you turn it on, restarts the tunnel after consecutive failures.

Auto-Restart on Failure (Disabled by default to prevent CPU spike storms; alerts only)

Tunnel Health

—

Not checked yet

Consecutive Fails

0 / 2

Alert threshold: 2

Last Check

—

Runs every 1 min

Telegram Alerts

Direct

Receive instant Telegram notifications when the tunnel drops or recovers. Middle of bot token is never exposed.

Bot Token

Chat ID

Telegram Route

Direct (standard HTTPS) Via Tunnel (SOCKS5 through tunnel port)

Tunnel Auto-Restart Schedule

Disabled

Periodically refreshes the tunnel interfaces and restarts FRP/Backhaul relay services gracefully without interrupting the web panel or losing configuration.

Restart Interval

Next restart: Not scheduled

Encrypted Backups

Off

Full backup of FRP tomls, panel settings, peers registry, and systemd units encrypted with OpenSSL AES-256-CBC keyed from your panel password.

Backup Schedule

Disabled Every N hours Daily at HH:MM

Stored Backups (/var/backups/quantum)

No backups yet.

Backup encryption key

Backups are encrypted with a key stored only on this server. Keep a copy elsewhere, or a downloaded backup cannot be opened if the server is lost.

Watchdog Event Log

Last 10 events

No events recorded yet.

— /100

Tunnel Diagnostics & Health

—

Run Diagnostics checks the tunnel end to end: every tunnel's service, session and data path, ping inside and outside the tunnel, MTU, throughput and kernel settings.

Issues & Recommendations

No report yet. Press Run Diagnostics.

Latency & Jitter —

—

Ping through the GRE tunnel

Packet loss—

Jitter—

Min / Max—

Peer public IP—

Path MTU —

—

Largest packet that crosses the tunnel unfragmented

Interface MTU—

Recommended TCP MSS—

MSS clamp rule—

Throughput —

—

iPerf3 through the GRE tunnel

iPerf3 server here—

Kernel & TCP Stack —

—

Congestion control algorithm

BBR—

IP forwarding—

Listen backlog—

Engine open-files limit—

Path Test Before Any Tunnel

Finds which transports get through between your Iran and foreign servers, with the real FRP and Backhaul cores. Nothing is set up for good: temporary servers run for a few minutes and are removed. Safe next to a running tunnel: the test uses its own free ports and its own GRE interface and never touches the tunnel.

Not running

Foreign server IP (optional)

Used for the GRE and SSH (Bagher) checks. Left empty, it is taken from the foreign server when it connects.

Options

First port

Minutes

Foreign SSH port

This server's IP

Empty: the first free ports from 41000 are used, never the ports of a running tunnel. The test listens on the first port and the next 10 (TCP and UDP); enter a port to test that one.

Engine	Transport	Result	Latency	Speed	Port

Smart Multi-Protocol Carrier Benchmark Ready

Independent end-to-end benchmark across all 7 Quantum protocols before establishing tunnel

Current Server Role Role

On Iran server, enter foreign server address to probe all 7 protocols outwards.

Foreign Server Public IP or Domain (Destination) Auto Detect

Enter destination host to benchmark and discover the best protocol for lowest packet loss.

Custom Benchmark Ports (Optional) ▼ Expand

Best Protocol

—

Top Recommendation

Active Tunnel Carrier

—

Running Carrier

Lowest RTT Latency

—

Round-Trip Time

Packet Loss Rate

Dropped Packets

#	Protocol & Carrier	Transport Core	Destination Port	RTT Latency	Packet Loss	Jitter	Quality Score	Status	Actions

Inter-Panel Link Probing...

Real-time telemetry and state synchronization with peer panel.

Server Role —

Peer Panel URL —

Internal Tunnel IP —

Peer Latency — ms

Last Sync —

Automatic Failover [ OFF ] Manual Mode

Default: OFF. When enabled, watchdog automatically promotes the healthiest backup carrier upon packet loss spike.

Enable Carrier Auto-Failover

Packet Loss Trigger Threshold (%) If the current carrier packet loss exceeds this threshold, the tunnel seamlessly switches to the best candidate.

Last Auto Failover —

Switch Counter 0

Spoof Tunnel

A tunnel that forges its source IP on both servers to cross whitelist-based Layer-3 firewalls, wrapped with WireGuard for a real encrypted link. Test which spoof IPs get through first, then bring the tunnel up.

Not configured

Xray Tunnel

Forward ports from the Iran server to a foreign server over Xray: Reality, XHTTP, gRPC or mKCP, direct or reverse. It runs its own Xray-core next to any Xray panel (3x-ui, Marzban) and never touches its files, services or ports.

No tunnel yet

Panel Update DEV

—

Installed version

—

GitHub access token

—

Releases live in the private Dark-modem/quantum repository. Paste a fine-grained token with Contents: Read-only on that repo (GitHub → Settings → Developer settings → Fine-grained tokens). It is stored only on this server and is sent only to github.com.

Channel & Versions

Update channel

Install a specific version

For going back to an older release. Install the same version on the other server too.

Firewall & Ports

Planned — engine integrated, UI pending

The Session 1 engine is integrated in this build: multi-backend detection (active UFW, owned-chain iptables, native nftables refused), snapshot → plan → apply with revert, and the controller port-ownership registry. The graphical port manager and the typed Agent firewall operations are the next milestone — until then this section intentionally shows no simulated data.

Agent

Listening ports (from the agent)

Plan and apply are available for Quantum-owned changes; the agent refuses mutations without an explicit confirmation step and records every operation in the audit log.

Network Optimization

Planned — engine integrated, UI pending

The Session 2 engine is integrated: hardware detection that refuses aggressive profiles over unreadable facts, conservative/balanced/performance plans, owned sysctl files, an apply journal with rollback, and the real-pair measurement harness in tests/netopt. The HTTP API and per-Agent desired-state operations are the next milestone — until then no values are invented here.

Agent

Tuning status on the agent

Apply/rollback run only with an explicit confirmation step and a justify string; profiles are chosen per node after hardware detection. No values on this page are simulated.

Settings

Current panel password

New panel password

Minimum 12 characters, uppercase, lowercase, numbers, and symbols (NIST 800-63B). Changing it invalidates all other sessions.

Carrier advisor

Collecting data…

Advice only — the panel never switches the carrier by itself. Suggestions for a new port / SNI:

Link history (last hours)

Link

Window

Sampled every 30 s, kept in memory for 24 h (cleared on panel restart).

Prometheus metrics

Disabled. Rotate a token to enable GET …/metrics for your scraper (header Authorization: Bearer <token>). The token is shown once.

External alerts

Get a message when a tunnel goes down or recovers. Only state changes are sent (never every refresh), with a minimum gap per link so a flapping tunnel cannot spam you. The first reading after a restart is only a baseline.

Enable alerts

Webhook URL (Slack/Discord/ntfy/any JSON endpoint)

Also send to Telegram Also alert on degraded ⇄ healthy

Minimum seconds between alerts per link

Panel access (port / login / address)

Changing any of these restarts only the panel web service — tunnels keep running. After saving, reopen the panel at the new address shown.

HTTP port (1–65535)

Address path (after IP:port/…)

—

Current password (confirm)

Session idle timeout

Sign out automatically after this many minutes without clicks or key presses. Background refresh does not count as activity. 0 = off.

Minutes (0, or 5–1440)

Two-factor authentication (TOTP)

Loading…

Appearance

Pick an accent colour. Every preset is contrast-checked for both dark and light themes.

Table density

Interactive terminal

—

Root shell in the browser over WebSocket + PTY — same login session, single shell at a time, auto-killed after 10 idle minutes (30 min cap). Enable only after testing; toggle is the rollback switch.

Terminal tab is hidden until enabled.

Allowed IPs / CIDRs (one per line, empty = any)

Domain & HTTPS (Decoupled Web Layer)

—

Configure a custom domain for Web Panel access. Tunnel infrastructure (FRP / Backhaul / GRE) is 100% independent and will never be restarted or disconnected.

Panel domain

Email for expiry notices (optional)

Not checked yet.

HTTPS serves on dedicated port 7443 alongside HTTP on port 7777.

HTTPS on this server's IP (self-signed)

No domain needed. The panel creates its own authority, signs a certificate for the IP (825 days), and serves HTTPS. Install the CA file below in your browser/OS once — afterwards the IP page shows no warning. Regenerate rotates only the server certificate; the CA stays trusted.

Server IP

Use your own certificate

Paste a matching certificate + key, upload both files, or point at files already on this server. Validated before install; the previous certificate is kept as backup.

Certificate (PEM)

Private key (PEM)

…or upload files

…or server paths

Key path

Reverse Proxy Configuration (Nginx & Caddy)

Copy and paste into your Nginx or Caddy server on this machine. Real client IPs and WebSocket upgrades are automatically supported.

Nginx:

Caddy:

Terminal

disconnected

Root shell on this server · single session · 10m idle kill · 30m cap · type quantum for the tunnel menu

Idle kill 10m · cap 30m · commands are audit-logged (secrets redacted) in Logs → Panel errors.

Quantum Tunnel

Tunnel Diagnostics & Health

—