Welcome to the Backhaul
project! This project provides a high-performance reverse tunneling solution optimized for handling massive concurrent connections through NAT and firewalls. This README will guide you through setting up and configuring both server and client components, including details on different transport protocols.
This project offers a robust reverse tunneling solution to overcome NAT and firewall restrictions, supporting various transport protocols. It’s engineered for high efficiency and concurrency.
Extract the archive (adjust the filename
if needed):
tar -xzf backhaul_linux_amd64.tar.gz
Run the executable:
./backhaul
You can also build from source if preferred:
git clone https://github.com/musixal/backhaul.git
cd backhaul
go build
./backhaul
The main executable for this project is backhaul
. It requires a TOML configuration file for both the server and client components.
To start using the solution, you'll need to configure both server and client components. Here’s how to set up basic configurations:
Server Configuration
Create a configuration file named config.toml
:
[server]# Local, IRAN
bind_addr = "0.0.0.0:3080" # Address and port for the server to listen on (mandatory).
transport = "tcp" # Protocol to use ("tcp", "tcpmux", "ws", "wss", "wsmux", "wssmux". mandatory).
token = "your_token" # Authentication token for secure communication (optional).
keepalive_period = 75 # Interval in seconds to send keep-alive packets.(optional, default: 75s)
nodelay = false # Enable TCP_NODELAY (optional, default: false).
channel_size = 2048 # Tunnel channel size. Excess connections are discarded. Only for tcp and ws/wss mode (optional, default: 2048).
heartbeat = 40 # In seconds. Ping interval for tunnel stability. Min: 1s. Only for tcp and ws/wss mode. (Optional, default: 40s)
mux_session = 1 # Number of mux sessions for tcpmux/wsmux/wssmux. (optional, default: 1).
mux_version = 1 # SMUX protocol version (1 or 2). Version 2 may have extra features. (optional)
mux_framesize = 32768 # 32 KB. The maximum size of a frame that can be sent over a connection. (optional)
mux_recievebuffer = 4194304 # 4 MB. The maximum buffer size for incoming data per connection. (optional)
mux_streambuffer = 65536 # 256 KB. The maximum buffer size per individual stream within a connection. (optional)
sniffer = false # Enable or disable network sniffing for monitoring data. (optional, default false)
web_port = 2060 # Port number for the web interface or monitoring interface. (optional, default disabled).
sniffer_log ="/root/log.json" # Filename used to store network traffic and usage data logs. (optional, default backhaul.json)
tls_cert = "/root/server.crt" # Path to the TLS certificate file for wss/wssmux. (mandatory).
tls_key = "/root/server.key" # Path to the TLS private key file for wss/wssmux. (mandatory).
log_level = "info" # Log level ("panic", "fatal", "error", "warn", "info", "debug", "trace", optional, default: "info").
ports = [
"443", # Listen on local port 443 and forward to remote port 443 (default forwarding).
"4000=5000", # Listen on local port 4000 (bind to all local IPs) and forward to remote port 5000.
"127.0.0.2:4001=5001", # Bind to specific local IP (127.0.0.2), listen on port 4001, and forward to remote port 5001.
"4002=1.1.1.1:5002", # Listen on local port 4002 and forward to a specific remote IP (1.1.1.1) on port 5002.
"127.0.0.2:4003=1.1.1.1:5003", # Bind to specific local IP (127.0.0.2), listen on port 4003, and forward to remote IP (1.1.1.1) on port 5003.
]
To start the server
:
./backhaul -c config.toml
Client Configuration
Create a configuration file named config.toml
for the client:
[client] # Behind NAT, firewall-blocked
remote_addr = "0.0.0.0:3080" # Server address and port (mandatory).
transport = "tcp" # Protocol to use ("tcp", "tcpmux", "ws", "wss", "wsmux", "wssmux". mandatory).
token = "your_token" # Authentication token for secure communication (optional).
connection_pool = 8 # Number of pre-established connections. Only for tcp and ws/wss mode (optional, default: 8).
keepalive_period = 75 # Interval in seconds to send keep-alive packets. (optional, default: 75s)
nodelay = false # Use TCP_NODELAY (optional, default: false).
retry_interval = 3 # Retry interval in seconds (optional, default: 3s).
dial_timeout = 60 # Sets the max wait time for establishing a network connection. (optional, default: 60s)
mux_session = 1 # Number of mux sessions for tcpmux/wsmux/wssmux. (optional, default: 1).
mux_version = 1 # SMUX protocol version (1 or 2). Version 2 may have extra features. (optional)
mux_framesize = 32768 # 32 KB. The maximum size of a frame that can be sent over a connection. (optional)
mux_recievebuffer = 4194304 # 4 MB. The maximum buffer size for incoming data per connection. (optional)
mux_streambuffer = 65536 # 256 KB. The maximum buffer size per individual stream within a connection. (optional)
sniffer = false # Enable or disable network sniffing for monitoring data. (optional, default false)
web_port = 2060 # Port number for the web interface or monitoring interface. (optional, default disabled).
sniffer_log ="/root/log.json" # Filename used to store network traffic and usage data logs. (optional, default backhaul.json)
log_level = "info" # Log level ("panic", "fatal", "error", "warn", "info", "debug", "trace", optional, default: "info").
To start the client
:
./backhaul -c config.toml
Server:
[server]
bind_addr = "0.0.0.0:3080"
transport = "tcp"
token = "your_token"
keepalive_period = 75
nodelay = true
heartbeat = 40
channel_size = 2048
sniffer = false
web_port = 2060
sniffer_log = "/root/backhaul.json"
log_level = "info"
ports = []
Client:
[client]
remote_addr = "0.0.0.0:3080"
transport = "tcp"
token = "your_token"
connection_pool = 8
keepalive_period = 75
dial_timeout = 60
nodelay = true
retry_interval = 3
sniffer = false
web_port = 2060
sniffer_log = "/root/backhaul.json"
log_level = "info"
Details:
remote_addr
: The IPv4, IPv6, or domain address of the server to which the client connects.
token
: An authentication token used to securely validate and authenticate the connection between the client and server within the tunnel.
channel_size
: The queue size for forwarding packets from server to the client. If the limit is exceeded, packets will be dropped.
connection_pool
: Set the number of pre-established connections for better latency.
nodelay
: Refers to a TCP socket option (TCP_NODELAY) that improve the latency but decrease the bandwidth
Server:
[server]
bind_addr = "0.0.0.0:3080"
transport = "tcpmux"
token = "your_token"
keepalive_period = 75
nodelay = true
mux_session = 1
mux_version = 1
mux_framesize = 32768
mux_recievebuffer = 4194304
mux_streambuffer = 65536
sniffer = false
web_port = 2060
sniffer_log = "/root/backhaul.json"
log_level = "info"
ports = []
Client:
[client]
remote_addr = "0.0.0.0:3080"
transport = "tcpmux"
token = "your_token"
keepalive_period = 75
dial_timeout = 60
retry_interval = 3
nodelay = true
mux_session = 1
mux_version = 1
mux_framesize = 32768
mux_recievebuffer = 4194304
mux_streambuffer = 65536
sniffer = false
web_port = 2060
sniffer_log = "/root/backhaul.json"
log_level = "info"
Details:
mux_session
: Number of multiplexed sessions. Increase this if you need to handle more simultaneous sessions over a single connection.
Server:
[server]
bind_addr = "0.0.0.0:8080"
transport = "ws"
token = "your_token"
channel_size = 2048
keepalive_period = 75
heartbeat = 40
nodelay = true
sniffer = false
web_port = 2060
sniffer_log = "/root/backhaul.json"
log_level = "info"
ports = []
Client:
[client]
remote_addr = "0.0.0.0:8080"
transport = "ws"
token = "your_token"
connection_pool = 8
keepalive_period = 75
dial_timeout = 60
retry_interval = 3
nodelay = true
sniffer = false
web_port = 2060
sniffer_log = "/root/backhaul.json"
log_level = "info"
Details:
Server:
[server]
bind_addr = "0.0.0.0:8443"
transport = "wss"
token = "your_token"
channel_size = 2048
connection_pool = 8
keepalive_period = 75
nodelay = true
tls_cert = "/root/server.crt"
tls_key = "/root/server.key"
sniffer = false
web_port = 2060
sniffer_log = "/root/backhaul.json"
log_level = "info"
ports = []
Client:
[client]
remote_addr = "0.0.0.0:8443"
transport = "wss"
token = "your_token"
keepalive_period = 75
dial_timeout = 60
retry_interval = 3
nodelay = true
sniffer = false
web_port = 2060
sniffer_log = "/root/backhaul.json"
log_level = "info"
Details:
tls_cert
and tls_key
.Server:
[server]
bind_addr = "0.0.0.0:3080"
transport = "wsmux"
token = "your_token"
keepalive_period = 75
mux_session = 1
mux_version = 1
mux_framesize = 32768
mux_recievebuffer = 4194304
mux_streambuffer = 65536
nodelay = true
sniffer = false
web_port = 2060
sniffer_log = "/root/backhaul.json"
log_level = "info"
ports = []
Client:
[client]
remote_addr = "0.0.0.0:3080"
transport = "wsmux"
token = "your_token"
keepalive_period = 75
dial_timeout = 60
nodelay = true
retry_interval = 3
mux_session = 1
mux_version = 1
mux_framesize = 32768
mux_recievebuffer = 4194304
mux_streambuffer = 65536
sniffer = false
web_port = 2060
sniffer_log = "/root/backhaul.json"
log_level = "info"
Server:
[server]
bind_addr = "0.0.0.0:443"
transport = "wssmux"
token = "your_token"
keepalive_period = 75
nodelay = true
mux_session = 1
mux_version = 1
mux_framesize = 32768
mux_recievebuffer = 4194304
mux_streambuffer = 65536
tls_cert = "/root/server.crt"
tls_key = "/root/server.key"
sniffer = false
web_port = 2060
sniffer_log = "/root/backhaul.json"
log_level = "info"
ports = []
Client:
[client]
remote_addr = "0.0.0.0:443"
transport = "wssmux"
token = "your_token"
keepalive_period = 75
dial_timeout = 60
nodelay = true
retry_interval = 3
mux_session = 1
mux_version = 1
mux_framesize = 32768
mux_recievebuffer = 4194304
mux_streambuffer = 65536
sniffer = false
web_port = 2060
sniffer_log = "/root/backhaul.json"
log_level = "info"
To generate a TLS certificate and key, you can use tools like OpenSSL. Here’s a step-by-step guide on how to create a self-signed certificate and key using OpenSSL:
If you don't already have OpenSSL installed, you can install it using your system's package manager.
sudo apt-get install openssl
To generate a 2048-bit RSA private key, run the following command:
openssl genpkey -algorithm RSA -out server.key -pkeyopt rsa_keygen_bits:2048
This will create a file named server.key
, which is your private key.
Create a Certificate Signing Request (CSR) using the private key. This CSR is used to generate the SSL certificate:
openssl req -new -key server.key -out server.csr
You will be prompted to enter information for the CSR. For the common name (CN), use the domain name or IP address where your server will be hosted. Example:
Country Name (2 letter code) [AU]:US
State or Province Name (full name) [Some-State]:California
Locality Name (eg, city) []:San Francisco
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Your Company Name
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:example.com
Email Address []:
Use the CSR and private key to generate a self-signed certificate. Specify the validity period (in days):
openssl x509 -req -in server.csr -signkey server.key -out server.crt -days 365
This will generate a certificate named server.crt
, valid for 365 days.
server.key
: Your private key.server.csr
: The certificate signing request (used to generate the certificate).server.crt
: Your self-signed TLS certificate.To create a service file for your backhaul project that ensures the service restarts automatically, you can use the following template for a systemd service file. Assuming your project runs a reverse tunnel and the main executable file is located in a certain path, here's a basic example:
/etc/systemd/system/backhaul.service
:[Unit]
Description=Backhaul Reverse Tunnel Service
After=network.target
[Service]
Type=simple
ExecStart=/root/backhaul -c /root/config.toml
Restart=always
RestartSec=3
LimitNOFILE=1048576
[Install]
WantedBy=multi-user.target
sudo systemctl daemon-reload
sudo systemctl enable backhaul.service
sudo systemctl start backhaul.service
sudo systemctl status backhaul.service
journalctl -u backhaul.service -e -f
Q: How do I decide which transport protocol to use?
tcp
: Use if you need straightforward TCP connections.tcpmux
: Use if you need to handle multiple sessions over a single connection.ws
: Use if you need to traverse HTTP-based firewalls or proxies.wss
: Use this for secure WebSocket connections that need to traverse HTTP-based firewalls or proxies. It encrypts data for added security, similar to WS but with encryption.This project is licensed under the AGPL-3.0 license. See the LICENSE file for details.
</a>