GOST

https://gost.run/en/
Admin
GOST is a simple security tunnel written in Go that supports multiple protocols for proxy services,...
Tokens:237,447
Snippets:2,052
Trust Score:8.2
Update:1 week ago
Show doc for...
Tokens:
Raw
### Server example (CLI)

Source: https://gost.run/en/tutorials/tuntap

Starts a TUN server listening on port 8421 with the specified network.

```bash
gost -L=tun://:8421?net=192.168.123.1/24

```

--------------------------------

### CLI: Start service with quota

Source: https://gost.run/en/concepts/limiter

Command-line example to start a service with a quota named 'quota-0'.

```bash
gost -L ":8080?quotas=quota-0"

```

--------------------------------

### Client example (CLI Linux/Windows)

Source: https://gost.run/en/tutorials/tuntap

Starts a TUN client that forwards packets to the server at SERVER_IP:8421.

```bash
gost -L=tun://:0/SERVER_IP:8421?net=192.168.123.2/24

```

--------------------------------

### HTTP handler CLI example

Source: https://gost.run/en/reference/handlers/http

Starts a GOST HTTP proxy on port 8080 using the command line.

```yaml
gost -L http://:8080

```

--------------------------------

### Install PPTP server

Source: https://gost.run/en/blog/2015/redsocks

Install the PPTP server package on Ubuntu.

```bash
sudo apt-get install pptpd

```

--------------------------------

### probeResist type file example

Source: https://gost.run/en/tutorials/probe-resistance

CLI example using probeResist=file:/send/to/client/file.txt to return file content.

```bash
gost -L=http2://gost:gost@:443?probeResist=file:/send/to/client/file.txt
```

--------------------------------

### CLI: Start TUN service with gost -L tun://:8421?net=192.168.123.2/24

Source: https://gost.run/en/reference/handlers/tun

Command-line example to start a TUN service. The net option specifies the network address for the TUN device.

```bash
gost -L tun://:8421?net=192.168.123.2/24
```

--------------------------------

### TAP client example (CLI and YAML)

Source: https://gost.run/en/tutorials/tuntap

Client configuration for TAP tunnel. The CLI command and the equivalent YAML service definition are shown together as one setup.

```bash
gost -L=tap://:0/SERVER_IP:8421?net=192.168.123.2/24
```

```yaml
services:
- name: service-0
  addr: :8421
  handler:
    type: tap
  listener:
    type: tap
    metadata:
      net: 192.168.123.2/24
  forwarder:
      nodes:
    - name: target-0
          addr: SERVER_IP:8421
```

--------------------------------

### probeResist type web example

Source: https://gost.run/en/tutorials/probe-resistance

CLI example using probeResist=web:example.com/page.html to fetch and return a URL.

```bash
gost -L=http://gost:gost@:8080?probeResist=web:example.com/page.html
```

--------------------------------

### Install redsocks on Ubuntu

Source: https://gost.run/en/blog/2015/redsocks2

Install redsocks using apt-get. If the package is not available, compile from source from the provided GitHub link.

```bash
sudo apt-get install redsocks

```

--------------------------------

### TAP server example (CLI and YAML)

Source: https://gost.run/en/tutorials/tuntap

Server configuration for TAP tunnel. The CLI command and the equivalent YAML service definition are shown together as one setup.

```bash
gost -L=tap://:8421?net=192.168.123.1/24
```

```yaml
services:
- name: service-0
  addr: :8421
  handler:
    type: tap
  listener:
    type: tap
    metadata:
      name: tap0 
      net: 192.168.123.1/24
      mtu: 1420
```

--------------------------------

### CLI: Enable tungo sniffing and bypass

Source: https://gost.run/en/tutorials/tungo

Command-line example that starts a tungo listener with sniffing enabled and forwards traffic through a relay+wss chain, with a bypass for example.com.

```bash
gost -L "tungo://:0?name=tungo&net=192.168.123.1/24&mtu=1420&dns=1.1.1.1&interface=eth0&sniffing=true" -F "relay+wss://SERVER_IP:443?interface=eth0&bypass=example.com"

```

--------------------------------

### Start SOCKS5 proxy with CLI

Source: https://gost.run/en/reference/handlers/socks5

Starts a SOCKS5 proxy server listening on port 1080 using the command-line interface.

```bash
gost -L socks://:1080
```

--------------------------------

### Service-level bypass CLI example

Source: https://gost.run/en/blog/2022/bypass

Starts an HTTP proxy on port 8080 with a blacklist bypass for example.com. Requests to example.com are rejected, while other requests are processed normally.

```bash
gost -L http://:8080?bypass=example.com
```

--------------------------------

### Enable and start GOST systemd service

Source: https://gost.run/en/getting-started/configuration-overview

Commands to enable the GOST systemd service to start at boot and to start it immediately. Run these after creating the service unit file.

```bash
systemctl enable gost

```

```bash
systemctl start gost

```

--------------------------------

### Inline Mode: CLI command to start GOST with multiple forwarders

Source: https://gost.run/en/concepts/hop

Command-line example for inline mode, defining hops directly in the chain via the -F flags.

```bash
gost -L http://:8080 -F https://192.168.1.1:8080 -F socks5+ws://192.168.1.2:1080
```

--------------------------------

### File format example

Source: https://gost.run/en/concepts/auth

The file format is authentication information separated by lines, each line is a user-pass pair separated by spaces, lines starting with # are commented out.

```text
# username password

admin           #123456
test\user001    123456
test.user@002   12345678

```

--------------------------------

### probeResist type host example

Source: https://gost.run/en/tutorials/probe-resistance

CLI example using probeResist=host:www.example.com:8080 to forward requests to a host.

```bash
gost -L=https://gost:gost@:443?probeResist=host:www.example.com:8080
```

--------------------------------

### Chain-level bypass CLI example

Source: https://gost.run/en/blog/2022/bypass

Starts an HTTP proxy with a chain of two hops, each with a bypass. The first hop uses a whitelist bypass for example.com and .example.org, the second uses a blacklist for example.com. Requests that fail a hop's bypass cause the chain to terminate at that hop.

```bash
gost -L http://:8080 -F http://:8081?bypass=~example.com,.example.org -F http://:8082?bypass=example.com
```

--------------------------------

### Examples of -L scheme combinations

Source: https://gost.run/en/reference/configuration/cmd

Shows various -L command examples for different scheme combinations, including HTTP, TLS, and TCP port forwarding.

```bash
# http+tcp
gost -L http://:8080

# http+tcp -> socks5+tcp
gost -L http://:8080 -L socks5://:1080?foo=bar

# http+tls
gost -L http+tls://gost:gost@:8443

# auto+tls
gost -L tls://:8443

# tcp+tcp或forward+tcp
gost -L tcp://:8080/192.168.1.1:80

# Port forwarding mode supports the following forwarding target address list format:
gost -L tcp://:8080/192.168.1.1:80,192.168.1.2:80,192.168.1.3:8080

```

--------------------------------

### Start global API service with CLI

Source: https://gost.run/en/tutorials/api/overview

Starts the GOST Web API service globally using the -api command-line flag. The first command starts a proxy and API service; the second adds authentication and path prefix options.

```bash
gost -L http://:8080 -api :18080

```

```bash
gost -L http://:8080 -api "user:pass@:18080?pathPrefix=/api&accesslog=true"

```

--------------------------------

### Start normal API service with CLI

Source: https://gost.run/en/tutorials/api/overview

Starts the API service as a normal service using the api handler with TLS, including authentication and path prefix.

```bash
gost -L "api+tls://user:pass@:18080?pathPrefix=/api&accessLog=true"

```

--------------------------------

### Start normal metrics service via CLI

Source: https://gost.run/en/tutorials/metrics

Starts the metrics service as a normal service using the metrics:// scheme. Available since version 3.1.0.

```bash
gost -L "metrics://user:pass@:18080?path=/metrics"

```

--------------------------------

### Start SSHD server with username-password authentication (CLI)

Source: https://gost.run/en/tutorials/protocols/ssh

Use this CLI command to start an sshd server that requires username and password authentication. The credentials are specified in the URL.

```bash
gost -L sshd://user:pass@:2222
```

--------------------------------

### Get Service Response

Source: https://gost.run/en/concepts/sd

Example JSON response for the Get request, containing a list of services with their details.

```json
{
  "services":[
    {
      "id":"c23d4f42-c892-42b3-8b74-88ab6455d33a",
      "name":"c9ef8f8c-d687-4dca-be7a-1467b6565404",
      "node":"db670b91-61a5-4f7c-8014-3bbe994446ea",
      "network":"tcp",
      "address":"10.42.0.100:80"
    }
  ]
}

```

--------------------------------

### Examples of -C configuration file

Source: https://gost.run/en/reference/configuration/cmd

Shows how to specify an external configuration file, use inline mode, or read from stdin.

```bash
# Use the configuration file gost.yml
gost -C /etc/gost/gost.yml

# Inline mode.
gost -C '{"api":{"addr":":8080"}}'

# Read from stdin:
gost -C - < gost.yml

```

--------------------------------

### Set up basic authentication (CLI)

Source: https://gost.run/en/tutorials/file

Starts a file server with basic authentication using username 'user' and password 'pass'.

```bash
gost -L file://user:pass@:8080
```

--------------------------------

### Redis GET command example

Source: https://gost.run/en/concepts/hop

Shows the Redis GET command to retrieve node data. The data format is the same as the file data source.

```redis
> GET gost:hops:hop-0:nodes
"[{\"name\":\"http\",...},{\"name\":\"socks5\",...}]"

```

--------------------------------

### Start GOST transparent proxy

Source: https://gost.run/en/blog/2017/redirect

Starts a GOST transparent proxy that redirects TCP traffic to a remote server via HTTP/2. Use this as the base command for the setup.

```bash
gost -L redirect://:12345 -F http2://SERVER_IP:443?ping=30
```

--------------------------------

### Build redsocks from source

Source: https://gost.run/en/blog/2015/redsocks

Clone the redsocks repository, install libevent-dev, and build.

```bash
git clone https://github.com/darkk/redsocks.git
cd redsocks
sudo apt-get install libevent-dev
make

```

--------------------------------

### CLI: Start MASQUE proxy with H3-MASQUE dialer

Source: https://gost.run/en/reference/connectors/masque

Command-line example to start a proxy service on port 8080 forwarding to a MASQUE server on port 8443 using the masque connector and h3-masque dialer.

```bash
gost -L :8080 -F masque+h3-masque://:8443
```

--------------------------------

### Client example (CLI MacOS)

Source: https://gost.run/en/tutorials/tuntap

MacOS-specific client command that includes the peer option.

```bash
gost -L="tun://:0/SERVER_IP:8421?net=192.168.123.2/24&peer=192.168.123.1"

```

--------------------------------

### CLI: Start TUN with encrypted relay+wss chain

Source: https://gost.run/en/blog/2022/tun

Command-line example that starts a TUN service on port 8421 with a forwarding chain to a relay+wss tunnel at 1.2.3.4:443. The TUN network is 192.168.123.2/24 with keepAlive enabled and a route to 192.168.101.0/24.

```bash
gost -L "tun://:0/:8421?net=192.168.123.2/24&keepAlive=true&route=192.168.101.0/24" -F relay+wss://1.2.3.4:443

```

--------------------------------

### Server example (YAML)

Source: https://gost.run/en/tutorials/tuntap

YAML configuration for a TUN server service with metadata for name, net, mtu, and dns.

```yaml
services:
- name: service-0
  addr: :8421
  handler:
    type: tun
  listener:
    type: tun
    metadata:
      name: tun0
      net: 192.168.123.1/24
      mtu: 1420
      dns: 192.168.1.1,192.168.100.1

```

--------------------------------

### Start gRPC relay tunnel server (CLI and YAML)

Source: https://gost.run/en/tutorials/http-tunnel

Starts a gRPC relay tunnel server on port 8443 with user/pass authentication. The CLI command and the equivalent YAML configuration are shown together as the server setup.

```bash
gost -L relay+grpc://user:pass@:8443

```

```yaml
services:
- name: service-0
  addr: ":8443"
  handler:
    type: relay 
    auth:
      username: user
      password: pass
  listener:
    type: grpc

```

--------------------------------

### Examples of -O output format

Source: https://gost.run/en/reference/configuration/cmd

Shows how to output configuration in yaml or json format, and how to convert between formats.

```bash
# Output yaml format configuration:
gost -L http://:8080 -O yaml

# Output json format configuration:
gost -L http://:8080 -O json

# Convert json format configuration to yaml format:
gost -C gost.json -O yaml

# Convert yaml format configuration to json format:
gost -C gost.yaml -O json

```

--------------------------------

### Run services in separate processes with -- separator

Source: https://gost.run/en/concepts/service

The -- separator in command line mode starts each service in its own process. This example starts three processes for three services, with the forwarding chain only used by the service on port 1080.

```bash
gost -L http://:8080 -- -L http://:8000 -- -L socks://:1080 -F http://:8000

```

--------------------------------

### Start gRPC relay tunnel server with grpcInsecure (CLI and YAML)

Source: https://gost.run/en/tutorials/http-tunnel

Starts a gRPC relay tunnel server with TLS disabled via the grpcInsecure=true parameter. The CLI command and the equivalent YAML configuration are shown together as the server setup.

```bash
gost -L relay+grpc://user:pass@:8443?grpcInsecure=true

```

```yaml
services:
- name: service-0
  addr: ":8443"
  handler:
    type: relay 
    auth:
      username: user
      password: pass
  listener:
    type: grpc
    metadata:
      grpcInsecure: true

```

--------------------------------

### Build GOST from source

Source: https://gost.run/en

Clone the GOST repository, navigate to the cmd/gost directory, and build the binary using Go.

```bash
git clone https://github.com/go-gost/gost.git
cd gost/cmd/gost
go build

```

--------------------------------

### Custom Cacheable Methods

Source: https://gost.run/en/tutorials/http-cache

By default only GET and HEAD are cached. This example adds POST to the list of cacheable methods using 'cache.methods'.

```yaml
metadata:
  cache.methods:
  - GET
  - HEAD
  - POST

```

--------------------------------

### Example serial data log output

Source: https://gost.run/en/blog/2023/serial

Example output from the serial data recorder. Lines starting with '>' indicate data sent from the source port (COM1 → COM3), and '<' indicates data received by the source port (COM1 ← COM3).

```text
>2023-09-18 10:16:25.117
00000000  60 02 a0 01 70 02 b0 01  c0 01 c0 01 40 02 30 01  |`...p.......@.0.|
...
<2023-09-18 10:16:25.120
00000000  d0 00 d0 00 10 01 10 02  50 01 e0 00 00 01 d0 01  |........P.......|
...

```

--------------------------------

### Run redsocks

Source: https://gost.run/en/blog/2015/redsocks2

Command to start redsocks with the configuration file.

```bash
redsocks -c redsocks.conf

```

--------------------------------

### Start gRPC relay tunnel client (CLI and YAML)

Source: https://gost.run/en/tutorials/http-tunnel

Starts an HTTP proxy client that forwards traffic through a gRPC relay tunnel to the server on port 8443. The CLI command and the equivalent YAML configuration are shown together as the client setup.

```bash
gost -L http://:8000 -F relay+grpc://user:pass@:8443

```

```yaml
services:
- name: service-0
  addr: ":8000"
  handler:
    type: http
    chain: chain-0
  listener:
    type: tcp
chains:
- name: chain-0
  hops:
  - name: hop-0
    nodes:
    - name: node-0
      addr: :8443
      connector:
        type: relay
        auth:
          username: user
          password: pass
      dialer:
        type: grpc

```

--------------------------------

### Configure API authentication with CLI

Source: https://gost.run/en/tutorials/api/overview

Starts the API service with authentication credentials via the command line.

```bash
gost -api user:pass@:18080

```

--------------------------------

### YAML: Listen in namespace ns1

Source: https://gost.run/en/tutorials/netns

YAML configuration for the same setup as the CLI example, using the `netns` metadata option to listen in namespace `ns1`.

```yaml
services:
- name: service-0
  addr: 10.0.0.1:8000
  handler:
    type: tcp
  listener:
    type: tcp
  forwarder:
    nodes:
    - name: target-0
      addr: :8080
  metadata:
    netns: ns1

```

--------------------------------

### Client example (YAML)

Source: https://gost.run/en/tutorials/tuntap

YAML configuration for a TUN client service with keepalive and forwarder settings.

```yaml
services:
- name: service-0
  addr: :8421
  handler:
    type: tun
    metadata:
      keepAlive: true
      ttl: 10s
  listener:
    type: tun
    metadata:
      net: 192.168.123.2/24
  forwarder:
      nodes:
    - name: target-0
          addr: SERVER_IP:8421

```

--------------------------------

### Start GOST with the mirror configuration

Source: https://gost.run/en/blog/2026/github-mirror

Runs GOST with the specified configuration file. The command is `./gost -C gost.yaml`.

```bash
./gost -C gost.yaml
```

--------------------------------

### Start gRPC relay tunnel client with grpcInsecure (CLI and YAML)

Source: https://gost.run/en/tutorials/http-tunnel

Starts an HTTP proxy client that forwards traffic through a gRPC relay tunnel with TLS disabled via grpcInsecure=true. The CLI command and the equivalent YAML configuration are shown together as the client setup.

```bash
gost -L http://:8000 -F relay+grpc://user:pass@:8443?grpcInsecure=true

```

```yaml
services:
- name: service-0
  addr: ":8000"
  handler:
    type: http
    chain: chain-0
  listener:
    type: tcp
chains:
- name: chain-0
  hops:
  - name: hop-0
    nodes:
    - name: node-0
      addr: :8443
      connector:
        type: relay
        auth:
          username: user
          password: pass
      dialer:
        type: grpc
        metadata:
          grpcInsecure: true

```

--------------------------------

### Bridge Method: Set up proxy on domestic VPS (aliyun.com)

Source: https://gost.run/en/blog/2015/forward

Starts a gost proxy server on port 8080 on the domestic VPS. This is the second pier of the bridge.

```bash
gost -L=:8080
```

--------------------------------

### Bandwidth Limiter File Format

Source: https://gost.run/en/concepts/limiter

Example file content for a bandwidth limiter. Lines starting with `#` are comments. Each line follows the format: ip/cidr input output(optional).

```text
# ip/cidr  input  output(optional)

$ 100MB  200MB
$$ 10MB
192.168.1.1  1MB 10MB
192.168.0.0/16  512KB  1MB

```

--------------------------------

### Chain Method: Set up domestic VPS as forwarder

Source: https://gost.run/en/blog/2015/forward

Runs gost on the domestic VPS, listening on port 443 with HTTP+TLS and forwarding traffic to the foreign VPS via SOCKS5. This builds the chain.

```bash
gost -L=http+tls://:443 -F=socks://linode.com:1080
```

--------------------------------

### List Services via Web API

Source: https://gost.run/en/tutorials/api/config

Lists all services configured in the system.

```bash
curl https://gost.run/play/webapi/config/services 

```

--------------------------------

### Run server tunnel with entrypoint.id

Source: https://gost.run/en/tutorials/reverse-proxy-tunnel

Used on the server to start a tunnel listener with a specific entrypoint ID, which the client must match to be treated as a public entry point. The ID is shown as an example; replace it with your own.

```bash
gost -L "tunnel://:8443?entrypoint.id=9fd6c586-86f9-49c1-a03a-d4876851695a
```

--------------------------------

### Bridge Method: Set up proxy on foreign VPS (linode.com)

Source: https://gost.run/en/blog/2015/forward

Starts a gost proxy server on port 1080 on the foreign VPS. This is the first pier of the bridge.

```bash
gost -L=:1080
```

--------------------------------

### TUN usage syntax

Source: https://gost.run/en/tutorials/tuntap

Shows the general command-line syntax for starting a TUN service with GOST, including all available parameters.

```bash
gost -L="tun://[method:password@][local_ip]:port[/remote_ip:port]?net=192.168.123.2/24&name=tun0&mtu=1420&route=10.100.0.0/16&gw=192.168.123.1"

```

--------------------------------

### Get Service via HTTP

Source: https://gost.run/en/concepts/sd

Gets service information by sending a GET request with the service name as a query parameter.

```bash
curl -XGET http://127.0.0.1:8000/sd?name=c9ef8f8c-d687-4dca-be7a-1467b6565404

```

--------------------------------

### KCP configuration file JSON example

Source: https://gost.run/en/tutorials/protocols/kcp

Example KCP configuration file in JSON format. Defaults are consistent with xtaci/kcptun. Parameters can be overridden via kcp.config or individual options like kcp.crypt and kcp.mode.

```json
{
    "key": "it's a secrect",
    "crypt": "aes",
    "mode": "fast",
    "mtu" : 1350,
    "sndwnd": 1024,
    "rcvwnd": 1024,
    "datashard": 10,
    "parityshard": 3,
    "dscp": 0,
    "nocomp": false,
    "acknodelay": false,
    "nodelay": 0,
    "interval": 40,
    "resend": 0,
    "nc": 0,
    "smuxver": 1,
    "sockbuf": 4194304,
    "keepalive": 10,
    "snmplog": "",
    "snmpperiod": 60,
    "tcp": false
}
```

--------------------------------

### Start HTTP and SOCKS5 proxies on ports 8080 and 1080

Source: https://gost.run/en/getting-started/quick-start

Starts two services: an HTTP proxy on port 8080 and a SOCKS5 proxy on port 1080. The CLI command and its equivalent YAML configuration are shown together.

```bash
gost -L http://:8080 -L socks5://:1080 

```

```yaml
services:
- name: service-0
  addr: ":8080"
  handler:
    type: http
  listener:
    type: tcp
- name: service-1
  addr: ":1080"
  handler:
    type: socks5
  listener:
    type: tcp

```

--------------------------------

### Redis HGETALL example

Source: https://gost.run/en/concepts/auth

Example of the redis hash data structure for the authenticator.

```text
> HGETALL gost:authers:auther-0
1) "admin"
2) "#123456"
3) "test\user001"
4) "123456"

```

--------------------------------

### Start Docker Compose services

Source: https://gost.run/en/blog/2026/llm-router

Starts the services defined in the Docker Compose file.

```shell
docker compose up -d

```

--------------------------------

### HTTP plugin example: response

Source: https://gost.run/en/concepts/admission

Example response from the HTTP plugin indicating success.

```json
{"ok": true}

```

--------------------------------

### Enable TLS (CLI)

Source: https://gost.run/en/tutorials/file

Starts a file server with TLS encryption on port 8443.

```bash
gost -L file+tls://:8443
```
Tokens:
Raw