{"record":{"id":"2ff9e83d7d5f26ee","repo":"ginuerzh/gost","slug":"socks5-bind-on-s-failure","errorCode":null,"errorMessage":"SOCKS5 bind on %s failure","messagePattern":"SOCKS5 bind on (.+?) failure","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"socks.go","lineNumber":360,"sourceCode":"\t\treturn nil, err\n\t}\n\n\tif Debug {\n\t\tlog.Log(\"[socks5] bind\\n\", req)\n\t}\n\n\treply, err := gosocks5.ReadReply(conn)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tif Debug {\n\t\tlog.Log(\"[socks5] bind\\n\", reply)\n\t}\n\n\tif reply.Rep != gosocks5.Succeeded {\n\t\tlog.Logf(\"[socks5] bind on %s failure\", address)\n\t\treturn nil, fmt.Errorf(\"SOCKS5 bind on %s failure\", address)\n\t}\n\tbaddr, err := net.ResolveTCPAddr(\"tcp\", reply.Addr.String())\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tlog.Logf(\"[socks5] bind on %s OK\", baddr)\n\n\treturn &socks5BindConn{Conn: conn, laddr: baddr}, nil\n}\n\ntype socks5MuxBindConnector struct{}\n\n// Socks5MuxBindConnector creates a Connector for SOCKS5 multiplex bind client.\nfunc Socks5MuxBindConnector() Connector {\n\treturn &socks5MuxBindConnector{}\n}\n\nfunc (c *socks5MuxBindConnector) Connect(conn net.Conn, address string, options ...ConnectOption) (net.Conn, error) {","sourceCodeStart":342,"sourceCodeEnd":378,"githubUrl":"https://github.com/ginuerzh/gost/blob/a33fdbf4c98034f4bfeeaea9868909822b9c526d/socks.go#L342-L378","documentation":"The SOCKS5 BIND request (gosocks5.CmdBind) sent to the proxy was rejected: the server replied with a reply code other than gosocks5.Succeeded. The library surfaces the server's refusal as this error instead of returning a connection, because the remote endpoint refused or could not perform the TCP bind (reverse connection) for the requested address.","triggerScenarios":"Calling Socks5BindConnector().ConnectContext (via Connect) with a tcp-family network and a bind address; the proxy responds to the BIND request with a non-Succeeded reply (e.g. connection/binding not allowed by proxy rules, port unavailable, or the target host failed to connect back).","commonSituations":"Trying to use SOCKS5 BIND for NAT traversal or reverse connections where the proxy disallows BIND; proxy ACLs rejecting the bind address; requesting a specific bind port already in use; proxies that simply do not support the BIND command.","solutions":["Inspect the proxy's debug log and its access rules; allow the BIND command and the requested address in the proxy ACL.","Verify the address string passed to ConnectContext is a valid host:port reachable/allowed by the proxy.","Use a CONNECT-based connector (Socks5Connector) instead if you do not actually need a reverse bind.","Ensure the client that must connect back to the bound port can reach the proxy's external IP (NAT/firewall)."],"exampleFix":"// before\nconn, err := bindConnector.ConnectContext(ctx, proxyConn, \"tcp\", \"0.0.0.0:0\")\n// after\nif _, port, _ := net.SplitHostPort(addr); port == \"0\" { /* let proxy choose; check ACLs */ }\nconn, err := socks5Connector.ConnectContext(ctx, proxyConn, \"tcp\", target) // if reverse bind not needed","handlingStrategy":"try-catch","validationCode":"host, port, err := net.SplitHostPort(address)\nif err != nil || host == \"\" || port == \"\" {\n\treturn fmt.Errorf(\"invalid bind address %q\", address)\n}","typeGuard":"func isTCPFamily(network string) bool {\n\tswitch network {\n\tcase \"tcp\", \"tcp4\", \"tcp6\":\n\t\treturn true\n\t}\n\treturn false\n}","tryCatchPattern":"conn, err := bindConnector.ConnectContext(ctx, proxyConn, \"tcp\", addr)\nif err != nil {\n\tif strings.Contains(err.Error(), \"bind on\") {\n\t\t// proxy refused BIND: log reply details, fall back to CONNECT\n\t\treturn fallbackConnect(ctx, addr)\n\t}\n\treturn err\n}","preventionTips":["Only use BIND when you truly need a reverse connection; prefer CONNECT.","Confirm the proxy supports and permits the BIND command before deploying.","Pre-verify the bind address format with net.ResolveTCPAddr.","Ensure the peer that connects back can reach the proxy's external IP."],"tags":["socks5","bind","proxy-refused","network"],"backgroundTag":"socks-command-refused","analyzedSha":"a33fdbf4c98034f4bfeeaea9868909822b9c526d","analyzedAt":"2026-09-02T22:15:54.506Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-10T02:17:09.455Z"}