What causes "socks5_target_connect_failed: %w" in shadow1ng/fscan?

Verify the target host/port is reachable and the service is listening (curl/telnet to targetAddr directly)

socks5_target_connect_failed: %w

Error message

socks5_target_connect_failed: %w

What it means

The proxy failed to open the TCP connection to the requested target host:port; the DialTimeout returned an error. The proxy sends SOCKS5 reply 0x05 (connection refused) to the client and wraps the underlying net error into socks5_target_connect_failed.

Source

Thrown at plugins/local/socks5proxy.go:261

		targetPort = int(addr[16])<<8 + int(addr[17])
	default:
		// 发送不支持的地址类型响应
		response := []byte{0x05, 0x08, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}
		_, _ = clientConn.Write(response)
		return nil, 0, fmt.Errorf(i18n.GetText("socks5_unsupported_address_type")+": %d", addrType)
	}
	if targetPort == 0 {
		return nil, 0, fmt.Errorf("%s", i18n.GetText("socks5_invalid_request"))
	}

	// 连接目标服务器
	targetAddr := net.JoinHostPort(targetHost, strconv.Itoa(int(targetPort)))
	targetConn, err := net.DialTimeout("tcp", targetAddr, 10*time.Second)
	if err != nil {
		// 发送连接失败响应
		response := []byte{0x05, 0x05, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}
		_, _ = clientConn.Write(response)
		return nil, 0, fmt.Errorf("%s: %w", i18n.GetText("socks5_target_connect_failed"), err)
	}

	// 获取本地监听端口（从targetConn获取）
	localAddr, ok := targetConn.LocalAddr().(*net.TCPAddr)
	if !ok {
		return nil, 0, fmt.Errorf("%s", i18n.GetText("local_address_unavailable"))
	}
	localPort := localAddr.Port

	// 发送成功响应
	response := make([]byte, 10)
	response[0] = 0x05 // SOCKS版本
	response[1] = 0x00 // 成功
	response[2] = 0x00 // 保留
	response[3] = 0x01 // IPv4地址类型
	// 绑定地址和端口（使用127.0.0.1:localPort）
	copy(response[4:8], []byte{127, 0, 0, 1})
	response[8] = byte(localPort >> 8)

View on GitHub (pinned to 95cc12e753)

Solutions

Verify the target host/port is reachable and the service is listening (curl/telnet to targetAddr directly)
Check DNS resolution of the target hostname from the proxy host
Increase or accept the 10s DialTimeout for slow networks; inspect the wrapped %w error for refused vs timeout vs no-route
If all targets fail, check the proxy host's outbound firewall and egress routing

Example fix

// inspect the wrapped cause in the caller
if _, _, err := handleSocks5Request(...); err != nil {
    var netErr net.Error
    if errors.As(err, &netErr) && netErr.Timeout() {
        log.Println("target dial timed out; consider raising timeout")
    }
}

Defensive patterns

Strategy: retry

Validate before calling

// pre-check reachability when possible
conn, err := net.DialTimeout("tcp", "target.example:443", 3*time.Second)
if err != nil { log.Printf("target unreachable: %v", err) } else { conn.Close() }

Try / catch

// caller
if _, _, err := handleSocks5Request(...); err != nil {
    var netErr net.Error
    if errors.As(err, &netErr) && netErr.Timeout() {
        // retry with backoff
    } else {
        var dnsErr *net.DNSError
        if errors.As(err, &dnsErr) { log.Printf("DNS failure for %s", dnsErr.Name) }
    }
}

Prevention

Check target reachability before proxying
Raise the dial timeout for slow networks
Monitor egress firewall/DNS health on the proxy host
Surface the wrapped net error for diagnostics

When it happens

Trigger: net.DialTimeout("tcp", targetAddr, 10s) fails: target unreachable, refused, DNS failure, or the 10-second timeout expires.

Common situations: User proxies to a host that is down or firewalled; DNS cannot resolve the target hostname; slow network exceeds the 10s dial timeout; wrong target port entered in client config.

Understand the failure class

Background: ECONNREFUSED and "connection refused" / "could not connect to server" errors: what they mean and how to fix them — this error's family across 44 libraries.

Related errors

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/47e8620482e73376. Report an issue: GitHub.