> For AI agents: the complete documentation index is available at https://www.tteam.icu/llms.txt, the full documentation bundle is available at https://www.tteam.icu/llms-full.txt.

# gost

## gost-server

[开源地址](https://github.com/go-gost/gost)

[文档地址](https://latest.gost.run/)

::: details 二进制文件安装

```bash
mkdir gost_tmp/ && \
cd gost_tmp/ && \
wget https://github.com/buyfakett/centos7_initialization/releases/download/v1.2.3/gost.tar.gz && \
tar zxvf gost.tar.gz && \
mv -f gost /usr/local/bin/gost && \
cd .. && \
rm -rf gost_tmp/
```

:::

## 一、socks5代理

搭建在线路好的机器上, 可以用于连接海外服务器

```sh file="./gost/gost-socks5.sh" title="gost-socks5.sh"
#!/bin/bash

docker rm -f gost-socks5
docker run -d \
--restart=always \
--net host \
--name gost-socks5 \
gogost/gost \
-L socks5://user:password@:1080
```

## 二、ssh 代理

:::tip
下面的都是B为国内云, C为海外云
:::

### 代理结构

> 内网(A)--ssh--公网(B)--ssh--公网(C)

### 服务端 gost 部署

[socks5代理](#一、socks5代理)

### B、C服务器生成隧道用户

```bash
useradd -m tunnel-user && echo 'password' | passwd tunnel-user --stdin && chsh -s /bin/false tunnel-user
```

### A服务器公私钥生成

```shell
ssh-keygen -t rsa -b 4096 -N "" -f /root/.ssh/id_rsa
```

### B、C服务器导入公钥

```shell
mkdir -p /home/tunnel-user/.ssh/ && chown -R tunnel-user:tunnel-user /home/tunnel-user/.ssh/ && chmod 700 /home/tunnel-user/.ssh/
cat << EOF >> /home/tunnel-user/.ssh/authorized_keys
此处A服务器/root/.ssh/id_rsa.pub文件内容
EOF
chmod 0600 /home/tunnel-user/.ssh/authorized_keys
```

### 打通隧道

```shell
ssh -NfL *:1090:127.0.0.1:1090 -J tunnel-user@B tunnel-user@C
# 如需要有两层中转
ssh -NfL *:1080:127.0.0.1:1080 -J tunnel-user@B,tunnel-user@D tunnel-user@C

# 如果通了，就可以杀掉进程换成autossh
autossh -M 0 -NfL *:1080:127.0.0.1:1080 -J tunnel-user@B,tunnel-user@D tunnel-user@C
```

### 在A ssh 添加存活检测

```shell
# 添加完后重启 sshd 服务
echo "ClientAliveInterval 60" >> /etc/ssh/sshd_config && systemctl restart sshd
```

### 本地 socks5 地址

```shell
# socks5 带密码
socks5://user:password@A:1080
# socks5 不带密码
socks5://A:1090
```

## 三、gost 代理

### 代理结构

> 内网(A)--relay+tls--公网(B)--relay+tls--公网(C)

### 落地机(C)(翻墙机)

把过来的加密流量转发到socks5中

```sh file="./gost/gost-server.sh" title="gost-server.sh"
#!/bin/bash

docker rm -f gost-server

docker run -d \
--restart=always \
--net host \
--name gost-server \
gogost/gost \
-L relay+tls://:2500/:1080 \
-L relay+tls://:2600/:1090 \
-L socks5://user:password@:1090 \
-L socks5://:1080
```

### 中转机(B)\[可选]

```sh file="./gost/gost-proxy.sh" title="gost-proxy.sh"
#!/bin/bash

docker rm -f gost-proxy

docker run -d \
--restart=always \
--net host \
--name gost-proxy \
gogost/gost \
-L relay+tls://:12500/xx.xx.xx.xx:2500
```

:::tip
也可以直接在这里把加密socks5当成连接的地址

```sh file="./gost/gost-client2.sh" title="gost-client2.sh"
#!/bin/bash

docker rm -f gost-client

docker run -d \
--restart=always \
--net host \
--name gost-client \
gogost/gost \
-L tcp://:10800 \
-F relay+tls://xx.xx.xx.xx:2600
```

:::

### 起飞机(A)

把socks5的流量加密转发到\[中转机]落地机

```sh file="./gost/gost-client.sh" title="gost-client.sh"
#!/bin/bash

docker rm -f gost-client

docker run -d \
--restart=always \
--net host \
--name gost-client \
gogost/gost \
-L tcp://:1090 \
-F relay+tls://xx.xx.xx.xx:12500 \
-F relay+tls://xx.xx.xx.xx:2500
```