GOST (GO Simple Tunnel)

GOST allows you to create a proxy chain by using multiple -F (forward) flags. The request is forwarded through the chain in the order the flags are provided. Each node in the chain can be a different protocol (HTTP, SOCKS5, Shadowsocks, etc.).

# Chain: Local :8080 -> QUIC node -> SOCKS5+WSS node -> HTTP2 node -> final destination
gost -L=:8080 -F=quic://192.168.1.1:6121 -F=socks5+wss://192.168.1.2:1080 -F=http2://192.168.1.3:443 ... -F=a.b.c.d:NNNN

GOST allows you to forward requests to another proxy using the -F flag. You can chain multiple proxies together to create a proxy chain.

• Single Forwarding: Forward all traffic from local port 8080 to a specific proxy at 192.168.1.1:8081.
• Authenticated Forwarding: Provide credentials for the forwarding proxy.
• Proxy Chains: Specify multiple -F flags. GOST will process the request through the chain in the order the flags are provided, eventually reaching the final destination.

### Single forwarding proxy
```bash
gost -L=:8080 -F=192.168.1.1:8081

Authenticated forwarding proxy

gost -L=:8080 -F=http://admin:123456@192.168.1.1:8081

Multi-level proxy chain

gost -L=:8080 -F=quic://192.168.1.1:6121 -F=socks5+wss://192.168.1.2:1080 -F=http2://192.168.1.3:443 ... -F=a.b.c.d:NNNN

You can install GOST using several methods depending on your environment:

• Binary Files: Download pre-compiled binaries from the GitHub releases page.
• Source Compilation: Clone the repository and build using Go.
• Docker: Run the official image.
• Homebrew: Available for macOS/Linux via brew.
• Snap: Available for Ubuntu via snap.

### Source Compilation
```bash
git clone https://github.com/ginuerzh/gost.git
cd gost/cmd/gost
go build

Docker

docker run --rm ginuerzh/gost -V

Homebrew

brew install gost

Snap

sudo snap install core
sudo snap install gost

Forward traffic from a local port to a remote destination, optionally through a proxy chain.

• TCP: Use -L=tcp://:local_port/remote_host:remote_port.
• UDP: Use -L=udp://:local_port/remote_host:remote_port. You can set a timeout using the ttl parameter (default is 60s).

Note for UDP: If using a proxy chain, the last node must be a GOST SOCKS5 proxy to support UDP-over-TCP.

# Local TCP forwarding
gost -L=tcp://:2222/192.168.1.1:22

# Local UDP forwarding with 60s timeout
gost -L=udp://:5353/192.168.1.1:53?ttl=60

To run GOST as a simple proxy server without any forwarding chains, use the -L flag to specify the listening address and protocol.

• Standard HTTP/SOCKS5: Listen on port 8080.
• With Authentication: Set credentials in the format user:password@host:port.
• Multi-port Listening: You can specify multiple -L flags to listen on different protocols and ports simultaneously.

### Standard HTTP/SOCKS5 proxy
```bash
gost -L=:8080

Proxy with authentication

gost -L=admin:123456@localhost:8080

Multi-port listening

gost -L=http2://:443 -L=socks5://:1080 -L=ss://aes-128-cfb:123456@:8338

GOST supports Shadowsocks and obfs4 for obfuscated tunneling.

Shadowsocks

Supports both standard TCP and UDP relay. For UDP relay, use the ssu protocol prefix.

obfs4

When the obfs4 server starts, it prints a connection string to the console. Use this exact string for the client -F parameter.

### Shadowsocks TCP
```bash
# Server
gost -L=ss://chacha20:123456@:8338
# Client
gost -L=:8080 -F=ss://chacha20:123456@server_ip:8338

Shadowsocks UDP Relay

# Server
gost -L=ssu://chacha20:123456@:8338

obfs4

# Server
gost -L=obfs4://:443

# Client (using the string printed by server)
gost -L=:8888 -F='obfs4://server_ip:443?cert=4UbQjIfjJEQHPOs8vs5sagrSXx1gfrDCGdVh2hpIPSKH0nklv1e4f29r7jb91VIrq4q5Jw&iat-mode=0'

GOST has built-in TLS certificates. To use your own:

1. Place cert.pem (public key) and key.pem (private key) in the current working directory.
2. Or, specify the paths via parameters.

Clients can use the secure parameter for verification or the ca parameter for Certificate Pinning.

# Server with custom certs
gost -L="http2://:443?cert=/path/to/my/cert/file&key=/path/to/my/key/file"

# Client with server verification
gost -L=:8080 -F="http2://server_domain_name:443?secure=true"

# Client with Certificate Pinning
gost -L=:8080 -F="http2://:443?ca=ca.pem"

Expose a port on a remote machine and forward its traffic to a destination through a proxy chain. Use the rtcp (remote TCP) and rudp (remote UDP) prefixes.

Note for UDP: If using a proxy chain, the last node must be a GOST SOCKS5 proxy to support UDP-over-TCP.

# Remote TCP forwarding
gost -L=rtcp://:2222/192.168.1.1:22 [-F=...]

# Remote UDP forwarding
gost -L=rudp://:5353/192.168.1.1:53?ttl=60 [-F=...]

GOST supports SSH in two modes:

1. Forward Tunnel: Used for local/remote TCP port forwarding. Use the forward+ssh:// prefix.
2. Transport Tunnel: A dedicated transport mode using the ssh:// prefix. The client supports a ping parameter for heartbeat detection (in seconds).

# SSH Forward Tunnel (Server)
gost -L=forward+ssh://:2222

# SSH Forward Tunnel (Client)
gost -L=rtcp://:1222/:22 -F=forward+ssh://server_ip:2222

# SSH Transport Tunnel (Server)
gost -L=ssh://:2222

# SSH Transport Tunnel (Client with heartbeat)
gost -L=:8080 -F=ssh://server_ip:2222?ping=60

To start a simple proxy server listening on a specific port without a forward proxy, use the -L flag. You can also add authentication using the username:password@host:port format or by pointing to a secrets file.

# Standard HTTP/SOCKS5 proxy on port 8080
gost -L=:8080

# Proxy with authentication
gost -L=admin:123456@localhost:8080

# Proxy using multiple authentication credentials from a file
gost -L=localhost:8080?secrets=secrets.txt