woodlyer / gostexample

Some examples for building proxy and tunnel with gost.

gost Example

Help you to use gost.
gost is a very good tunnel tool.
But it's document is not very clear.
And gost itself is very very complicated, because it's powerful.

Here, I want to show some examples to help ordinary users to use gost.
It doesn't mean gost can only do this. Just because gost is too powerful for everyone to handle. A little sample is enough for we to surf internet.

Introduce

version 2 is here https://github.com/ginuerzh/gost
version 3 is here https://github.com/go-gost/gost
version 3 is now under developing. Not for publishing. But gost v3 has some new features

Offical DOC site for version 2: https://v2.gost.run/
Offical DOC site for version 3: https://gost.run/

Download and run

Open release page to down the binaries for your platform.
version 2: https://github.com/ginuerzh/gost/releases
version 3: https://github.com/go-gost/gost/releases

In version 3 release page,there is gost_amd64v3.tar.gz, It means the cpu support amd64v3, If you don't know what's amd64v3, use amd64.tar.gz.

On windows, if you don't want to see the black terminal, you can use gostGUI to run gost.exe in the background.
On Android, May be you can use ShadowsocksGostPlugin .
On IOS, May be you can use shadowrocket .

gost basic

gost default works as a socks5+http proxy server.

It can support socks5 and http proxy protocol at the same time.

# gost listen socks5 on :1080
gost -L :1080
gost -L admin:123456@:1080
gost -L :1080?auth=YWRtaW46MTIzNDU2
# you can use curl to test the proxy.
curl -x socks5://localhost:1080 https://google.com
curl -x http://localhost:1080   https://google.com

# auth is base64(user:pass). generation method: 
echo -n 'user:pass' | base64
echo YWRtaW46MTIzNDU2 | base64 -d

gost use -F to forward the socks5 request to the server

gost -L :1080   # socks5 listen on server.com
gost -L :1080   -F server.com:1080

gost can also works as a tunnel(port mapping).

A tunnel is basicly a port mapping

# port mapping :22 to local 192.168.0.100:22
gost -L tcp://:22/192.168.0.100:22

Add -F to forward port mapping to remote host.

# run gost on server
gost -L relay://:9000
# run gost on client
# here the 192.168.0.100 is server side host ip address
gost -L tcp://:22/192.168.0.100:22  -F  relay://server.com:9000

Application protocol and Transport protocol

Protocals supported list by gost:
These application protocals work up on the transport protocols.
Application protocol is used to do proxy.
Transport protocol is used to do transport.

you can join them with "+", like this:

relay+kcp
relay+tls
relay+mtls

http+kcp
http+tls

1. Application Protocols

• http - HTTP
• http2 - HTTP2
• socks4 - SOCKS4 (2.4+)
• socks4a - SOCKS4A (2.4+)
• socks5 - SOCKS5
• ss - Shadowsocks
• ss2 - Shadowsocks with AEAD support (2.8+)
• sni - SNI (2.5+)
• forward - Forward (usually used to break down protocal, such as kcp+ss to kcp and ss). always work with tcp like this: "-L=tcp:// -F forward+kcp"
• relay - TCP/UDP relay (2.11+). relay is always used to do tcp relay or udp relay.

2. Transports Protocols
   Tunnel based on these transport protocals.
   You may change the transport protocal in examples to a kind protocal listed here.

• tcp - raw TCP
• tls - TLS
• mtls - Multiplex TLS, add multiplex on TLS (2.5+)
• ws - Websocket
• mws - Multiplex Websocket (2.5+)
• wss - Websocket Secure Websocket based on wss
• mwss - Multiplex Websocket Secure, multiplex on TLS secured Websocket (2.5+)
• kcp - KCP (2.3+)
• quic - QUIC (2.4+)
• ssh - SSH (2.4+)
• h2 - HTTP2 (2.4+)
• h2c - HTTP2 Cleartext (2.4+)
• obfs4 - OBFS4 (2.4+)
• ohttp - HTTP Obfuscation (2.7+)
• otls - TLS Obfuscation (2.11+)

3. How to choose a good transport protocol?
   kcp and quic are based on udp. If udp is OK you cannot use them.
   kcp support tcp mode. use like this: ./gost -L=kcp://:9000?tcp=true
   tls / mtls is widely used when use tcp.
   ws / wss / http is a little lower efficiency than tls.

What's Tunnel?

gost is named from "GO Simple Tunnel", and it was always used as a tunnel.
Although gost can works as a proxy.

When gost works as tunnel, the network is like this.
Gost client and gost server set up a tunnel to serve for proxy server run on.

gost Tunnel Example

The first line is for gost server, running on VPS.
The second line is for gost client, running on your PC.

Suppose you are running SS(shadowsocks) or v2ray on 8388, on the client side, the gost tunnel works on 127.0.0.1:8083 links to SS or V2ray on your server.
You should modified the server_ip to your own domain name or ip address.
Gost supports many protocol. Such as quic, kcp, wss, tls etc. You may change the protocal to the one you need.
!!!caution!!!
In the example, I write "tcp://127.0.0.1:8083", gost only serve for this PC.
If you want to serve for other PC, you should write "tcp://:8083" .

• kcp tunnel
  I recommend you use kcp. kcp protocal is based on udp.
  kcp can speed up your connection and keep your connection secure.

# server,  ss or v2ray listen on 8083 
./gost -L kcp://:9000/:8083 
./gost -L tcp://127.0.0.1:8083  -F forward+kcp://server_ip:9000

If you want to change some parameter of kcp. you can write a file named "kcp.json" and append it into cmd.
like this:

./gost -L kcp://:9000/:8083?c=./kcp.json 
./gost -L tcp://127.0.0.1:8083  -F forward+kcp://server_ip:9000?c=./kcp.json

More info about kcp parameter. see: https://github.com/xtaci/kcptun
kcp.json default value:

{
    "key": "it's a secrect",
    "crypt": "aes",
    "mode": "fast",
    "mtu" : 1350,
    "sndwnd": 1024,
    "rcvwnd": 1024,
    "datashard": 10,
    "parityshard": 3,
    "dscp": 0,
    "nocomp": false,
    "acknodelay": false,
    "nodelay": 0,
    "interval": 40,
    "resend": 0,
    "nc": 0,
    "sockbuf": 4194304,
    "keepalive": 10,
    "snmplog": "",
    "snmpperiod": 60,
    "tcp": false
}

change the "key" or "crypt" to be more secure.
"crypt" can be: aes, aes-128, aes-192, salsa20, blowfish, twofish, cast5, 3des, tea, xtea, xor, sm4, none
change "rcvwnd" and "sndwnd" to 2048 to make kcp faster.
Other parameters doesn't need changed, if you don't know what it means.

• tls tunnel

./gost -L tls://:443/:8083
./gost -L=tcp://127.0.0.1:8083 -F relay+tls://server_ip:443

• quic tunnel

./gost -L quic://:1443/:8083
./gost -L tcp://127.0.0.1:8083  -F "relay+quic://server_ip:1443"

• dtls tunnel.
  dtls is only available in v3.

./gost -L dtls://:1443/:8083
./gost -L tcp://127.0.0.1:8083  -F "relay+dtls://server_ip:1443"

• icmp tunnel.
  icmp tunnel is only available in v3.

echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all
./gost -L icmp://:0
./gost -L :8080 -F "relay+icmp://server_ip:12345?keepAlive=true&ttl=10s"

gost Proxy Examples

When gost act as a socks5 proxy.
you can connect socks5://127.0.0.1:1080 to connect the internet. Use kcp or other different protocal to pass the wall.

• tls proxy

./gost -L tls://:443
./gost -L :1080 -F tls://server_ip:443

• mtls proxy

./gost -L mtls://:443
./gost -L :1080 -F mtls://server_ip:443

• kcp proxy

./gost -L=kcp://:9000
./gost -L=:1080 -F=kcp://server_ip:9000

• kcp proxy with fake tcp

./gost -L=kcp://:9000?tcp=true
./gost -L=:1080 -F=kcp://server_ip:9000?tcp=true

Port forward

If You want to connect remote_ip and port. But you cann't for some reason.
So, You let the server do the port forward. client directly connect to gost client to connect target. client -> [gost client:port] -> [gost server] -> [target ip+port]

The cmd is like this, kcp can be replaced with tls,quic,socks,etc... client connect 127.0.0.1:9000 as connect to [remote_ip:port] This cmd only need change the para(remote_ip:port) on client.
It's very good for user.

# client easily change the remote_ip and port
./gost -L relay://:9000  
./gost -L=tcp://127.0.0.1:8388/remote_ip:port   -F relay://server_ip:9000   

using relay+tls to do the relay

./gost -L relay+tls://:9000 
./gost -L=tcp://127.0.0.1:8388/remote_ip:port  -F relay+tls://server_ip:9000

Another methods to do remote port forward.

# server do the port forward
./gost -L kcp://:9000/remote_ip:port  
./gost -L tcp://127.0.0.1:8388 -F forward+kcp://server_ip:9000


# set dest ip:port at client
./gost -L kcp://:9000   
./gost -L tcp://127.0.0.1:9000/remote_ip:port -F kcp://server_ip:9000

TCP Port Mapping for relay on one PC

Use gost listen on 22 to connect 192.168.1.100:22. Other clients which cannot connect to 192.168.1.100 can connect gost to dest. client -> gost[:22] -> 192.168.1.100:22

gost -L tcp://:22/192.168.1.100:22
# ssh
ssh [email protected] -p 22   

gost "rtcp" reverse port forward

"rtcp" means the dest is entry, it can reach your address.
The direction of rtcp is reverse to tcp port mapping.

Forward the port :2222 on the server to the host(192.168.1.1:22) in client side.

# server
./gost -L kcp://:9000
# client
./gost -L=rtcp://:2222/192.168.1.1:22  -F=kcp://server_ip:9000

# ssh cmd
ssh root@server_ip -p 2222

gost cmds to run KCP + SS

run gost and ss on server, SS client connect to 127.0.0.1:8838 as connect to remote server.

# server 
wget --no-check-certificate  https://github.com/ginuerzh/gost/releases/download/v2.11.5/gost-linux-amd64-2.11.5.gz
gzip -dk  gost-linux-amd64-2.11.5.gz
mv  gost-linux-amd64-2.11.5  gost
chmod +x  gost
./gost -L kcp://:9000/:8388  -L ss://aes-256-gcm:[email protected]:8388 

# client
./gost  -L tcp://:8388  -F "forward+kcp://server_ip:9000"

# ss param
ss://aes-256-gcm:[email protected]:8388 

ss cipher method contains:

1. AES-256-CFB  
2. AES-128-CFB  
3. CHACHA20  
4. CHACHA20-IETF  
5. AES-256-GCM  
6. AES-128-GCM  
7. RC4-MD5  

gost cmds to run KCP + V2ray

v2ray is a little complicated than ss.
but more popular.
If you want to run gost tunnel to support v2ray, please see v2ray dir in this repository.

Compare to other tools

• gost is a tunnel or proxy. gost support many protocol(such as tls,wss,quic,kcp...).
  quic with gost is slow.
• hysteria is based on quic(modified), tcp or udp, act as tunnel or proxy. It support obfs, so will not be blocked for using quic.
• tuic is based on standard quic, and is the most fast. But maybe blocked for quic.
• kcptun is a good kcp tunnel, but it is blocked now. Use kcp of gost is OK.
• xray or v2fly. It's used by many people. They are the main enemy of GFW. based on tcp.

hysteria: https://github.com/apernet/hysteria
tuic: https://github.com/EAimTY/tuic
kcptun: https://github.com/xtaci/kcptun
xray: https://github.com/XTLS/Xray-core

Some tips

how to run gost at background

• run gost at background in Linux
  use nohup to run gost in background and the log redirect to gost.log

  nohup ./gost -L mtls://:443  >> gost.log  2>&1 &

• run gost as a service
  use systemd to install gost as a service.
  more info see gost service.

run gost in openwrt

Some openwrt system has can install gost easily by opkg. https://github.com/SuLingGG/OpenWrt-Rpi
The gost build for openwrt info is here: https://github.com/kenzok8/openwrt-packages/tree/master/gost
luci-app-gost is the web page to admin gost. see: https://github.com/kenzok8/openwrt-packages/tree/master/luci-app-gost

security caution

Remember to add user and password autication, when you listen a socks5 server on 0.0.0.0
Or you just listen on 127.0.0.1 like this:

gost -L admin:123456@:1080  # default listen on 0.0.0.0
gost -L 127.0.0.1:1080      # only available on self

gost v3 tips

gost version 3 is different from v2.

rtcp need bind parameter

when you use gost v3 to do rtcp, you need add bind=true to allow server bind operation.

gost -L relay://:9000?bind=true
gost -L rtcp://:80/:8080 -F relay://server.com:9000

kcp use tcp

gost v3 doesn't support tcp=true.

gost -L kcp://:9000?tcp=true   # no use
gost -L kcp://:9000?c=tcp.json # use tcp.json to set tcp protocol

tcp.json content

{
    "tcp": false
}

Doesn't have a VPS?

Oh, It's very easy. Buy one.

• bandwagonhost $49.9 for 1 year.
• vultr.com Easy to use.
• DMIT Many data center.
• racknerd.com It's very cheap. Click this link to buy is cheap BlackFriday. Only $10.28 for 1 year. If you want the net is fast, you should buy $24 vps, and select Location to Los Angeles.
• arvancloud.ir It's used by many Iran people. It support bitcoin and USDT.
• ApeWeb Cheap, accepts customers globally including Iran and takes crypto currency. Servers in Europe.
• PQ Hosting Europe vps provider, only 4.77€ per month. Very cheap.

Still don't know how to do?

If you have read this document and don't know how to use gost, maybe you don't need to waste some more time on it.
Please use some commercial mature VPN service.
Such as:

• 1.justMysocks.net
• 2.ExpressVPN
• 3.StrongVPN

Star

You have read to here, why not click the star button for once?

Welcome Pull Requests

gostexample's Issues

v2ray over ssh tunnel

hi my friend,

thanks for the repository and examples. It helped a lot; I have

1- ServerIran: Domestic VPS with outgoing udp blocked. So no udp will be allowed to go outside of Iran.
2- ServerPoland: Foreign VPS which has V2ray (vmess - could be any other protocol- running on 3443 port) installed

In your example, you have included kcp/tls/quic/wss

[xray client] -----tcp--->  [gost client:1234]-----kcp/tls/quic/wss----> [gost server:9000] ----tcp---->[xray server:1234]

I wanna achieve this:

[xray client] -----tcp--->  [gost client:1234]-----ssh tunnel----> [gost server:9000] ----tcp---->[xray server:1234]

From ServerIran to ServerPoland, I have a ssh tunnel (forward 9443 local to 3443 foreign) with port forwarding by running:

ssh -N -f  -L 9443:polanddomain.com:3443 [email protected]

On ServerIran, I have this:

gost -L tcp://:3443 -F=/:9443

Expectation is whatever comes through xray client on port 3443 will be forwarded to 9443 local and from 9443 will be forwarded through ssh and reach to PoalndServer. This doesn't work. Any idea why is that?

Kind of UDP over TCP help needed

Am a complete noob, please someone help me with config for this

For example:

server-ip 6.6.6.6
server port 443

wireguard port 10000

sni / host: www.bing.com

wireguard android client on port 10000

udp blocked on network
trying to listen on 443 forward to wireguard udp10000

my server:

./gost -L sni+tcp://:443/:10000/udp

client on termux:

./gost -L udp://:10000/127.0.0.1:10000 -F relay+sni://6.6.6.6:443?host=www.bing.com

wireguard android client endpoint 127.0.0.1:10000

am trying to achieve UDP over TCP through sni / host which is www.bing.com

Hope someone understands this and help with the right config

Help needed with TCP/Socks proxy

Would appreciate if you could help with this scenario:

My usecase

• App needs to connect to a TCP server that expects a dynamic PPV2 header. App uses JDBC but can configure SOCKS5 proxy.
• Connection needs to be on TLS since server will ultimately forward to another secure server expecting TLS.

Can I use gost between App and server and make gost add the header and establish TLS ? This will help multiple apps use gost and not need individual configuration.

go-gost/gost#371

Multiple port forwarding

I wanted to do port forwarding from an X server to a Y and Z server. I create a service and run gost and I use this command, now how to add another server?

gost -L=tcp://:8080 -F forward+tls://1.1.1.1:8443

Bypass domain

Hello dear developer, can I use gost to bypass the traffic of a specific domain and pass through the client server?

Help with Tunneling

Hello, I hope you're doing okay,
Thank you for these Examples, I have a question regarding the tunnel between two servers:

For Example, if we have Two Servers:
1- Server A Domestic VPS
2- Server B Foreign VPS ( Have V2ray Installed )

How can we configure a tunnel between these two servers so we can bypass the interanet situation and have access to free net,
Thank you very much

multiple port forwarding syntax

Hello friends ,

I'm trying to use 1 domestic server and send traffic to 2 foreign servers . I have a problem with syntax

in domestic vps I have :

-L=tcp://:2087/:2096 -F relay+ws://domain1.com:2053 -F=relay+ws://domain2.com:8443

in foreign vps I have :

-L=relay+ws://:2053/:2087 -L=relay+ws://:8443/:2096

is this syntax correct ?

gost-c gost.json 请教一下json格式，log记录为什么不生效？

"log": {
"output": "c:/to/aa.json",
"level": "debug",
"format": "json",
"rotation": {
"maxSize": 100,
"maxAge": 10,
"maxBackups": 3,
"localTime": false,
"compress": false
}
},

udp over tcp

hi
can i udp over tcp tunneling with gost v3 ?

双栈使用的问题

如下图；有一台VPS在日本，只有IPv6，没有V4, 国内有一台linux小主机，有V4和V6，想通过这台linux小主机连接日本V6 机器出墙，咋搞呢，大佬支支招。

其中OP路由拨号上网，获得V4公网IP一个和若干V6公网IP，路由下的PC想通过树莓派和日本VPS连接科学上网

Can we hide destination IP behind cloudflare in gost?

Hello Friends ,

I have a domestic and foreign VPS and I use gost tunnel . The issue is that today the IP of foreign VPS was blocked in the domestic VPS and no traffic could reach it .

I was using gost's forward+tls on the domestic server : -L=tcp://:2053 -F forward+tls://100.100.100.100:9000

My question is , is there any way to hide the foreign VPS IP behind CDN and use a domain there for example ?

Is there any specific tunnel or method that can hide foreign VPS IP or make the tunnel hard to detect ?

Thanks .

Which gost tunnel protocol is harder to be detected by GFW?

Hello There ,

I have a domestic VPS and a foreign VPS . The foreign VPS is running v2ray ( vless + ws + tls or vmess + ws + tls ) . My question is , which gost tunnel scenario between domestic VPS and foreign VPS is the hardest for GFW to detect ? Also I read somewhere that if my foreign v2ray server is using ws or tls , then gost tunnel doesn't work and I should use tcp + http instead .

can you please help me understand :

1 - which gost tunnel works with my foreign VPS v2ray config ( vless + ws + tls or vmess + ws + tls ) ?
2 - which gost tunnel is hardest to detect for GFW ?

Thank you .

از عزیزان ایرانی هم اگر کسی میدونه کدوم تانل gost توسط فیلترینگ دیر تر شناسایی میشه یا کلا شناسایی نمیشه لطفا اطلاع بده . تشکر