What causes "SOCKS5 mbind on %s failure" in ginuerzh/gost?

Check the proxy server supports mux-bind and is configured with the same bind address; fix the transporter's bindAddr.

SOCKS5 mbind on %s failure

Error message

SOCKS5 mbind on %s failure

What it means

During mux-bind session setup, initSession sends a SOCKS5 BIND request on the multiplexed session; the server's reply code was not gosocks5.Succeeded, so Handshake aborts with this error. It means the proxy rejected the multiplexed bind for the requested address.

Source

Thrown at socks.go:520

		return nil, err
	}

	if Debug {
		log.Log("[socks5] mbind\n", req)
	}

	reply, err := gosocks5.ReadReply(conn)
	if err != nil {
		return nil, err
	}

	if Debug {
		log.Log("[socks5] mbind\n", reply)
	}

	if reply.Rep != gosocks5.Succeeded {
		log.Logf("[socks5] mbind on %s failure", addr)
		return nil, fmt.Errorf("SOCKS5 mbind on %s failure", addr)
	}
	baddr, err := net.ResolveTCPAddr("tcp", reply.Addr.String())
	if err != nil {
		return nil, err
	}
	log.Logf("[socks5] mbind on %s OK", baddr)

	// Upgrade connection to multiplex stream.
	session, err := smux.Server(conn, smux.DefaultConfig())
	if err != nil {
		return nil, err
	}
	return &muxSession{conn: conn, session: session}, nil
}

func (tr *socks5MuxBindTransporter) Multiplex() bool {
	return true
}

View on GitHub (pinned to a33fdbf4c9)

Solutions

Check the proxy server supports mux-bind and is configured with the same bind address; fix the transporter's bindAddr.
Inspect proxy ACLs and allow the bind address/port.
Retry or reduce concurrent sessions; inspect server logs for the reply code.
Fall back to plain SOCKS5 connector/transporter if the server lacks mux-bind support.

Example fix

// before
SOCKS5MuxBindTransporter("192.168.1.1:6000") // address rejected by proxy
// after
SOCKS5MuxBindTransporter("") // let server choose an allowed bind address, or use an ACL-approved addr

Defensive patterns

Strategy: retry

Validate before calling

// Verify proxy reachability before Handshake
conn, err := net.DialTimeout("tcp", proxyAddr, 5*time.Second)
if err != nil { return err }
conn.Close()

Try / catch

session, err := transporter.Handshake(ctx, conn)
if err != nil {
	if strings.Contains(err.Error(), "mbind on") {
		// server refused mux bind: backoff then retry, or fall back to plain connector
		time.Sleep(backoff)
		return transporter.Handshake(ctx, dialAgain())
	}
	return err
}

Prevention

Match the transporter's bindAddr with the proxy's configured bind host.
Confirm server-side mux-bind support before enabling it on the client.
Limit concurrent mux sessions to avoid server-side bind exhaustion.

When it happens

Trigger: SOCKS5MuxBindTransporter establishing a new mux session (initSession, called from Handshake): the SOCKS5 reply to the mbind request carries a failure code (proxy denies bind, address not permitted, server overloaded).

Common situations: Proxy does not support the mux-bind extension; server-side bind host/port misconfigured (bindAddr unreachable or forbidden); proxy ACL rejects the configured bind address; too many concurrent binds.

Related errors

AI-assisted analysis of ginuerzh/gost@a33fdbf4c9 (2026-09-02). Data as JSON: /api/errors/d603d224bfe19d60. Report an issue: GitHub.