Skip to content
Get packs

Guide · Open source

How to use gost: run a proxy, chain proxies and forward ports

Updated · written with AI from the project's own documentation and checked against our catalogue data

gost (GO Simple Tunnel) is a command-line program written in Go that acts as a proxy and tunnel. This guide shows you how to install it, start a basic HTTP or SOCKS5 proxy, chain several proxies together, and forward TCP or UDP ports. Note first that the upstream README says this repository is in maintenance mode and has been superseded by go-gost/gost, so it is best suited to learning, testing and existing setups.

GOSTginuerzh/gost · ★ 18.3k · MIT

Quick start

  1. 1Install gost. Get a binary, use Homebrew with brew install gost, or build from source with Go.
  2. 2Start a listener. Run gost -L=:8080 to act as a local HTTP and SOCKS5 proxy on port 8080.
  3. 3Add a forwarding proxy. Add -F with the address of another proxy to send traffic through it.
  4. 4Chain proxies. Repeat -F flags in the order you want traffic to pass through them.
  5. 5Set up port forwarding. Use a tcp:// or udp:// -L address with the target after the slash, adding ttl for UDP timeouts.
  6. 6Enable TLS. Use https:// on the server and http+tls:// on the client, or pass your own cert and key files.

Install gost

The README lists several ways to get gost: download a binary from the project's releases page, build from source, run it with Docker, install it with Homebrew, or install it from the Ubuntu snap store.

If you build from source, you need Go. Clone the repository, change into the cmd/gost directory and run go build.

  • Homebrew: brew install gost
  • Build from source: requires Go
brew install gost

Start a basic HTTP or SOCKS5 proxy

Without a forwarding proxy, gost listens on a local port and acts as a standard HTTP and SOCKS5 proxy. The -L flag sets the listen address. You can also add a username and password to the listener.

You can listen on several ports at once by repeating -L, and the README shows an example that mixes http2, socks5 and ss listeners.

  • Basic proxy on port 8080: gost -L=:8080
  • With authentication: gost -L=admin:123456@localhost:8080
  • Multiple listeners: repeat -L for each port
gost -L=:8080

Chain proxies with -F

The -F flag sets a forwarding proxy. When you give several -F flags, gost sends requests through them in the order you list them, and the last address is the final destination.

Each forwarding proxy can be an HTTP, HTTPS, HTTP2, SOCKS4, SOCKS5 or Shadowsocks proxy, as the README describes. The README also notes that QUIC and KCP may only be the first node in a chain.

  • -F sets one forwarding proxy; repeat it to build a chain
  • Requests follow the order of the -F flags
  • QUIC and KCP can only be the first node in a chain
gost -L=:8080 -F=quic://192.168.1.1:6121 -F=socks5+wss://192.168.1.2:1080 -F=http2://192.168.1.3:443 -F=a.b.c.d:NNNN

Forward TCP and UDP ports

For local TCP forwarding, gost listens on a local port and sends traffic on to a target address, optionally through a proxy chain. Remote forwarding (rtcp and rudp) works the same way but listens on the remote side.

UDP forwarding uses a ttl parameter for the idle timeout of each forwarding channel. The README says the default is 60 seconds. If you use a proxy chain for UDP, the last -F hop must be a gost SOCKS5 proxy, because gost then uses UDP over TCP.

  • Local TCP: tcp://:2222/192.168.1.1:22
  • Local UDP: udp://:5353/192.168.1.1:53?ttl=60
  • Remote TCP: rtcp://:2222/192.168.1.1:22
  • Remote UDP: rudp://:5353/192.168.1.1:53?ttl=60
gost -L=tcp://:2222/192.168.1.1:22

Protect traffic with TLS and encryption

For HTTP, you can encrypt the whole connection by running an HTTPS proxy on the server and using http+tls on the client. SOCKS5 traffic is encrypted only when both ends are gost, because gost then negotiates the tls or tls-auth method. Otherwise it uses standard SOCKS5.

gost includes a built-in TLS certificate. To use your own, place cert.pem and key.pem in the working directory, or pass the file paths as parameters. For client-side checks, the secure parameter enables server certificate and domain verification.

  • HTTPS proxy server: gost -L=https://:443
  • Client over TLS: gost -L=:8080 -F=http+tls://server_ip:443
  • Certificate files: cert.pem and key.pem in the working directory, or cert= and key= parameters
  • secure=true turns on certificate and domain checks on the client
gost -L=:8080 -F="http2://server_domain_name:443?secure=true"

Try other tunnel protocols

The README covers several tunnel types, each with its own server and client command. For SSH, forward+ssh uses SSH's own port forwarding, and ssh uses SSH as a tunnel for other protocols. The ping parameter sets a keepalive interval in seconds and is off by default. Shadowsocks, QUIC and KCP are also supported, with the libraries the README names.

KCP reads a kcp.json file from the working directory if one exists, or you can pass a path with the c parameter.

  • SSH port forwarding: gost -L=forward+ssh://:2222 on the server
  • SSH as a tunnel: gost -L=ssh://:2222 on the server
  • QUIC server: gost -L=quic://:6121
  • KCP server: gost -L=kcp://:8388
gost -L=rtcp://:1222/:22 -F=forward+ssh://server_ip:2222

What people use it for

  • Run a local SOCKS5 or HTTP proxy from a single binary
  • Test multi-hop proxy chains for network routing
  • Forward a local port to a remote SSH or web service
  • Try several tunnel protocols such as QUIC, KCP or Shadowsocks from one tool

Frequently asked questions

Is gost free to use?

The repository is published under the MIT licence, as listed on its page. The MIT licence allows use, but read the licence text for the full terms.

How do I install gost?

The README lists binary downloads, building from source with Go, Docker, Homebrew (brew install gost) and the Ubuntu snap store. Homebrew is the shortest route on macOS.

What do I need to run gost?

You only need Go if you build from source. Otherwise, use a prebuilt binary, Docker or a package manager.

Is gost still maintained?

No. The README says this repository is in maintenance mode, receives no new features, and has been superseded by go-gost/gost, which is the right place for new projects.

Is gost a good alternative to Shadowsocks or v2ray-core?

gost supports Shadowsocks itself, so it can act as a Shadowsocks server or client. It is a different tool from v2ray-core and frp, and the README does not compare them, so test each for your needs.

Why is my UDP forwarding not working through a proxy chain?

The README says that when UDP is forwarded through a chain, the last -F hop must be a gost SOCKS5 proxy, since gost then uses UDP over TCP. Check that your final hop matches this requirement.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

Use gost if you want a single command-line binary to run HTTP or SOCKS5 proxies, chain them, or forward ports while you learn or test. Pick go-gost/gost for any new project, and choose a different tool if you need a point-and-click app or a security audit, which the README does not describe.

Install options & downloads