What causes "bind: peer connect failure" in ginuerzh/gost?

Check the proxy server logs for the actual SOCKS5 reply code (e.g. connection refused, host unreachable)

bind: peer connect failure

Error message

bind: peer connect failure

What it means

The SOCKS5 BIND handshake completed its first reply, but the second reply (sent when the peer connects) reports a non-Succeeded reply code (rep.Rep != gosocks5.Succeeded), meaning the remote peer's inbound connection to the server's bound port failed on the proxy side. This library turns any failed BIND reply code into this fixed error.

Source

Thrown at socks.go:2001

}

// Handshake waits for a peer to connect to the bind port.
func (c *socks5BindConn) Handshake() (err error) {
	c.handshakeMux.Lock()
	defer c.handshakeMux.Unlock()

	if c.handshaked {
		return nil
	}

	c.handshaked = true

	rep, err := gosocks5.ReadReply(c.Conn)
	if err != nil {
		return fmt.Errorf("bind: read reply %v", err)
	}
	if rep.Rep != gosocks5.Succeeded {
		return fmt.Errorf("bind: peer connect failure")
	}
	c.raddr, err = net.ResolveTCPAddr("tcp", rep.Addr.String())
	return
}

func (c *socks5BindConn) Read(b []byte) (n int, err error) {
	if err = c.Handshake(); err != nil {
		return
	}
	return c.Conn.Read(b)
}

func (c *socks5BindConn) Write(b []byte) (n int, err error) {
	if err = c.Handshake(); err != nil {
		return
	}
	return c.Conn.Write(b)
}

View on GitHub (pinned to a33fdbf4c9)

Solutions

Check the proxy server logs for the actual SOCKS5 reply code (e.g. connection refused, host unreachable)
Ensure the peer can reach the proxy's bound address/port (firewall/NAT rules)
Confirm the proxy server supports the BIND command at all — many modern proxies only support CONNECT
Prefer CONNECT-based dialing unless you specifically need reverse (BIND) connections

Defensive patterns

Strategy: fallback

Validate before calling

// ensure the proxy supports BIND before relying on it
// e.g. probe server capabilities or check server docs; no client-side API check exists
if !proxySupportsBind(proxyAddr) { useConnectDialer() }

Try / catch

c, err := bindDialer.Bind(ctx, addr)
if err != nil {
    if err.Error() == "bind: peer connect failure" {
        c, err = connectDialer.Connect(ctx, addr) // fallback to CONNECT
    }
    if err != nil { return err }
}

Prevention

Confirm the SOCKS5 server implements the BIND command
Ensure firewalls/NAT allow the peer to reach the proxy's bound port
Have a CONNECT-based fallback path
Check server reply codes in logs for root cause

When it happens

Trigger: Using a SOCKS5 BIND connection when the server's second reply carries a failure code — e.g. connection refused/blocked between the peer and the proxy's bound port, or the bind request was rejected at the second stage.

Common situations: Peer is behind a firewall and cannot reach the proxy's bind port; the proxy does not truly support BIND; NAT prevents the inbound connection; client is not reachable from the proxy network.

Related errors

AI-assisted analysis of ginuerzh/gost@a33fdbf4c9 (2026-09-02). Data as JSON: /api/errors/8e5021bfd446da82. Report an issue: GitHub.