Thirteen transports target filtered routes
BackPack's 13 transport choices are the reason to consider it. The usual reverse shape exposes ports on an Iran server while an overseas client dials inward and hands traffic to the real service. A direct mode lets the Iran side dial out instead, and the whole-IP mode joins both hosts on a private network. That range addresses networks where a plain reverse proxy connects poorly or cannot connect at all.
Five of the 13 choices, plain TCP, TCP Mux, UDP, WS, and WS Mux, send the tunnel token as-is. The transport guide says to choose an encrypted option on an untrusted path. Stealth uses Noise, WSS uses TLS with a session-bound credential, and KCP derives a key from the token. This is a menu of different security properties, so choosing by speed alone is a mistake.
What happened when we ran it
Our sandbox installed commit 9bbeecf in 107 seconds and fetched 91 packages. The build finished successfully in 43 seconds. That checkout occupied 11 MB before installation and contained 675 files with about 113,038 lines of source. The green result shows that a fresh unprivileged Debian container could obtain the Go dependencies and compile the measured commit without secrets.
Tests took 233 seconds in the same 3-CPU, 8 GB container. Go reported 64 passed and 0 failed out of 64. Our measurement method found 2 CI workflow files, no Dockerfile, and no tests directory even though Go test files are distributed through the source tree. Those facts cover repository mechanics at 9bbeecf. We did not measure tunnel throughput, packet loss, latency, or behavior on an Iran route.
One installer controls two rooted servers
A normal deployment controls 2 Linux servers and writes into host-level locations. The documented installer runs as root, places the binary in /usr/local/bin, stores tunnel state under /etc/backpack, and keeps release files below /root/BackPack. Each tunnel becomes its own systemd service. That isolation is sensible for recovery, but it also means BackPack sits beside the firewall and service manager rather than inside an ordinary user account.
Setup still requires a correct 64-character token, the same transport on both ends, a control port, forwarded-port mappings, and firewall rules on the Iran server. The dashboard normally uses port 7777. A source build has another wrinkle: go.mod declares Go 1.26.0, while our base image was Go 1.24. The build succeeded in our sandbox, but a pinned internal toolchain should honor the declared version instead of assuming an older compiler is enough.
Four presets do not remove network judgment
BackPack supplies 4 performance presets and a Link Test that measures the route before recommending a transport. That helps with the first choice, especially when TCP stalls or UDP is filtered. The maintainers also label xDi and IP Spoofing experimental. Both need Linux and root, while the whole-IP tunnel needs /dev/net/tun plus network-administration capability. These modes are specialist escape routes, not harmless toggles.
The setup guide names 4 common failure points before it reaches tuning: server roles, the shared token, port mappings, and firewall rules. UDP forwarding is off by default. A bare mapping such as 443 sends traffic to port 443 on the overseas machine itself, which is easy to misread. Health Check can point at a bad configuration, but an operator still needs to understand where every listener and backend lives.
Updates have safeguards, while the history is short
Release v1.8.1 shipped on 2026-09-15, and the repository was pushed again on 2026-09-21. The update flow saves a restore point, verifies the downloaded archive against published SHA-256 data, restarts the tunnels, and rolls back when its health check fails. An offline path accepts a copied archive and checksum, which matters when the server itself cannot reach GitHub.
The repository was created on 2026-07-11. GitHub showed 355 stars and 7 open issues and pull requests on 2026-09-21, split into 1 issue and 6 pull requests. The open issue's reporter later said their repeated PCK restarts came from their own configuration. Issue 41 is the sharper warning: two users reported panel 404s after v1.7.7.5, and one said rolling back to v1.7.5 restored access. The thread does not establish the cause.
AGPL-3.0 forks need attribution and a new name
BackPack uses AGPL-3.0, and its README states 2 additional obligations for modified versions. The required attribution must remain in the notice, README, version output, and panel notices. A modified fork must also use a different product name and logo. Those terms are clearly written, which makes the decision easier, but a company expecting Apache-2.0 or MIT terms should stop before deployment.
The documentation is deep enough to explain each of the 13 transports, firewall openings, backups, update recovery, and Persian summaries. One current-main seam needs cleanup. docs/web-panel.md calls the panel monitoring-only, while docs/access-control.md defines 3 scopes and says the write scope can create and edit tunnels, restart services, and upgrade. Check the exact release you deploy before designing operator roles around either description.
The 64-test result earns a controlled trial
All 64 tests passing makes BackPack credible enough for a spare pair of VPS hosts. Its best audience already knows why plain TCP, KCP, WSS, or an ICMP carrier would behave differently on the route in question. Start with the documented basic transport, confirm port and UDP behavior, then exercise update rollback before any user traffic depends on the link.
For ordinary NAT traversal, frp or rathole asks you to accept a smaller operational surface. GOST fits operators who want to assemble proxy behavior from a broader toolkit. BackPack earns its extra root-level reach when filtering forces you to switch among 13 carriers and you want one control plane to watch them. If you cannot name the carrier you need, choose the smaller proxy.