[Protocol] KCP (paqet)

[Drjacky]

https://github.com/hanselime/paqet

[shayanb]

Notes:

Paqet is a raw packet-level proxy that:

• Bypasses the OS TCP/IP stack entirely using pcap (packet capture/injection)
• Creates encrypted tunnels using KCP protocol over crafted raw TCP packets
• Bypasses kernel-level firewalls and connection tracking (packets are
  captured before firewall rules apply)
• Provides SOCKS5 proxy on client side

Architecture

[App] <-> [paqet Client:1080] <=== Raw TCP Packets ===> [paqet Server:PORT] <-> [Target]
SOCKS5 (Encrypted KCP) Public IP

Requirements for Docker Integration

Requirement: libpcap
Challenge Level: Easy
Notes: Just install in container
────────────────────────────────────────
Requirement: Root/privileged
Challenge Level: Medium
Notes: Needs --privileged or NET_RAW + NET_ADMIN caps
────────────────────────────────────────
Requirement: Host network mode
Challenge Level: High
Notes: Must use --network host - can't use Docker bridge
────────────────────────────────────────
Requirement: Gateway MAC address
Challenge Level: High
Notes: Must auto-detect or require manual config
────────────────────────────────────────
Requirement: iptables rules on HOST
Challenge Level: Medium
Notes: Need to add rules to prevent kernel RST packets

Key Challenges for MoaV Integration

1. Network Mode: Requires --network host which conflicts with MoaV's Docker network isolation. Other containers use moav_net bridge.
2. Gateway MAC Detection: Server config requires the gateway/router MAC address. This varies by VPS provider and must be auto-detected.
3. Interface Detection: Needs the host's network interface name (eth0, ens3, etc.) which varies.
4. iptables on Host: Requires adding rules to the HOST (not container) to prevent kernel interference:

iptables -t raw -A PREROUTING -p tcp --dport PORT -j NOTRACK
iptables -t raw -A OUTPUT -p tcp --sport PORT -j NOTRACK
iptables -t mangle -A OUTPUT -p tcp --sport PORT --tcp-flags RST RST -j DROP

5. User Bundle Complexity: Clients need to know their own network interface and gateway MAC - much harder than just importing a URL.

Feasibility Assessment

Aspect: Server-side Docker
Verdict: ✅ Possible with --network host + --privileged
────────────────────────────────────────
Aspect: Auto-config server
Verdict: ⚠️ Possible but needs interface/MAC detection scripts
────────────────────────────────────────
Aspect: Client usability
Verdict: ❌ Very complex - users need pcap, root, interface/MAC info
────────────────────────────────────────
Aspect: Coexistence with MoaV
Verdict: ⚠️ Tricky - needs host networking while others use bridge

[shayanb]

@Drjacky This is a bit tricky protocol but I did try, the initial implementation is here but needs extensive testing : #16

[Drjacky]

I haven't tried it myself but looks like this guy MatinSenPai did it successfully, in case you need help to implement&test:

https://t.me/MatinSenPaii/1925
https://www.youtube.com/watch?v=q4BbgdhPm-w

--

Also, this guy iaghapour did it successfully:

https://t.me/iaghapour/2147

[shayanb]

Thanks @Drjacky ,

I was managed to get it running on MoaV, but needs testing. Maybe @MatinSenPai or @iaghapour know what is the best approach?

#16 (comment)

you can run it using :

moav update -b paqet

ideally do it on a fresh install with git pull & git checkout paqet

then:

moav start paqet

[simons1010]

عزیز جان من این پروتوکل رو تست کردم
در کنار اینکه پیاده کردنش بیچارت میکنه
خیلی محدودیت داره ظاهرا
روی اینترنت همراه نمیشه
روی td-lte ایرانسل من نتونستم جواب بگیرم
ظاهرا فقط روی اینترنت کابلی جوابمیده مثل adsl

حتی توی ایشو های خودشون چندتا راه حل داده بودن برای اینترنت td-lte که هیچکدوم برای من کار نکرد