Hashem Panel
Tunnels between an Iran server and foreign servers, managed from one web panel.
Users connect to the Iran server's public IP; their traffic reaches services on your foreign servers through GRE, FRP, Backhaul, Xray, SSH or a spoofed pipe, with health checks, failover and safe updates built in.
English · فارسی · Website · Telegram · YouTube
How it works
flowchart LR
U([Users]) --> HUB
subgraph IR["Iran server"]
HUB["Public ports<br/>frps · Backhaul · Xray"]
P["Panel :7777"]
end
HUB <== "GRE · 6to4 · 4in6 · WSS" ==> A["Foreign server A<br/>FRP over GRE"]
HUB <-- "Backhaul, no GRE" --> B["Foreign server B"]
HUB <-- "Xray / SSH" --> C["Foreign server C"]
The Iran server owns the public ports users connect to. Each foreign server runs your services (for example an Xray panel) and is linked to the Iran server by a tunnel. The same panel runs on both sides: you set up the Iran server, copy one setup bundle, and paste it on the foreign server.
Tunnels
| Tunnel | How it travels | Pick it when |
|---|
| GRE + FRP | FRP over a GRE link (tcp, kcp, quic, websocket, wss) | the default: most options, free |
| Backhaul | with or without GRE (tcpmux, ws, wss, udp, …) | GRE is blocked, or you want Backhaul's transports |
| Xray | VLESS with Reality, XHTTP, gRPC, mKCP or a CDN | the path needs to look like normal HTTPS |
| Bagher | FRP inside a pool of SSH connections | only SSH gets through |
| Spoof | spoofed-source pipe with WireGuard on top | the firewall whitelists source IPs |
The GRE link itself can be wrapped four ways: Direct (protocol 47), WSS (TLS on a web port), 6to4 (protocol 41) and 4in6 (over IPv6). Not sure what gets through? Path test (Benchmark tab) checks every transport between your two servers before you build anything. Details: docs/ENGINES.md.
Features
- One health model for the dashboard, the map and every card, with latency per link and alerts by webhook or Telegram when a tunnel changes state.
- Swap a tunnel's carrier from either server; both switch, and both go back if the new one does not connect within 45 seconds.
- Cluster: several foreign servers behind one Iran port (failover, balance, sticky, least connections), Iran servers backing each other up, and DNS failover. Guide
- Nodes: manage all your servers from one panel: add them with one line or SSH, open any server's pages from the central, make a tunnel between two of them from one page, update and back them up, and get their alerts in one place. Guide
- Customers (Pro): sell tunnels: each customer brings foreign servers, you set the plan (days, volume, speed), and their tunnels stop when it ends. Guide
- Watchdog, encrypted backups and diagnostics (
hashem doctor), with Quick Repair.
- Updates you can undo: stable and dev channels, SHA-256 verified, automatic rollback after a bad start.
- Hardened panel: argon2id passwords, CSRF, optional 2FA, audit log; the web terminal is off by default.
- Everything from SSH too:
hashem opens a terminal app with the same menus as the panel.
Quick install
Run on both servers:
bash <(curl -fsSL https://raw.githubusercontent.com/pdnczone/hashem-panel/main/install.sh)
- Iran server: choose
1, pick the tunnel and ports, and copy the bundle it prints (hsh1_…).
- Foreign server: choose
2 and paste the bundle.
- Open the panel at the URL printed at the end (
http://<server-ip>:7777/<secret>). Lost it? hashem show-panel-url; new password: hashem reset-password.
More foreign servers are added from the panel's Setup tab. To read the installer first, or pin it to a release's checksums.txt, see Installing safely.
[!IMPORTANT]
The panel uses plain HTTP on a long random path by default. Before exposing it, add TLS with hashem tls issue <domain> or a reverse proxy (docs/DEPLOYMENT.md).
Requirements
- Linux with systemd,
amd64 or arm64 (developed on Ubuntu), and root on both servers. The installer adds missing packages.
- The GitHub releases reachable from both servers, for install and updates.
- Between the servers, whatever your tunnel uses:
| Tunnel or wrap | Open |
|---|
| Direct GRE · 4in6 | IP protocol 47 (over IPv4 · over IPv6) |
| 6to4 | IP protocol 41 |
| WSS wrap | TCP 8443 (default) |
| FRP · Backhaul · Xray | the control port you choose (UDP too for kcp, quic, udp) |
| Panel | TCP 7777, or 7443 once HTTPS is on |
Hashem Pro
GRE + FRP, the panel and updates are free. A Pro license unlocks Backhaul setup, Xray, Bagher, Spoof, limits, the cluster, the path test, diagnostics, performance tuning, the watchdog and the benchmark. Every Pro key opens every Pro feature, including ones added later, and tunnels and settings that already run keep running without one. pdnczone.ir
Documentation
Persian versions exist for the README and the IPv6, Xray, cluster and FRP guides.
Contributing and license
Issues and pull requests are welcome; read CONTRIBUTING.md and branch from dev. Report vulnerabilities privately (SECURITY.md).
Licensed under the GNU AGPL-3.0: if you run a modified version as a network service, publish your changes under the same license. The Pro features need a license from the author.
