Agent skill · security · aradotso
gooserelayvpn-socks5-tunnel
Expert knowledge for building, configuring, and operating GooseRelayVPN — a SOCKS5 VPN that tunnels raw TCP through Google Apps Script to a VPS exit server using AES-256-GCM encryption and domain fronting.
Why this skill is useful
Adds executable scripts for generating secret keys and configuring both client and server, which are not commonly found in public documentation.
What it needs
Requires go installed locally. Requires google account access. About 8k tokens when loaded. Last updated 2026-07-09. 70 stars on the source repository.
What this skill does
GooseRelayVPN SOCKS5 Tunnel Skill Skill by ara.so — Daily 2026 Skills collection. What It Does GooseRelayVPN is a SOCKS5 proxy that tunnels raw TCP through a Google Apps Script web app to a self-hosted VPS exit server. The traffic path: Key properties: Domain fronting: TLS SNI shows www.google.com; actual host is script.google.com End-to-end AES-256-GCM: Google never holds the key Raw TCP tunneling: SSH, IMAP, custom protocols — anything SOCKS5 carries Multi-deployment load balancing: Round-robin + health-aware blacklist across multiple Apps Script deployments --- Architecture Overview Component Location Purpose ----------- ---------- --------- goose-client Local machine SOCKS5 listener, AES encrypt, HTTPS relay Google Apps Script Google cloud (free) Dumb HTTP forwarder, domain-fronting layer goose-server Your VPS AES decrypt, TCP dial to real targets --- Installation Option A: Pre-built Binaries Platform suffixes: windows-amd64, darwin-amd64, darwin-arm64, linux-amd64, android-arm64 Option B: Build from Source (Go 1.22+) --- Quick Start Step 1: Generate Secret Key Or generate manually: Step 2: Configure Client clientconfig.json: Step 3: Configure Server serverconfig.json: Step 4: Deploy Google Apps Script 1. Go to script.google.com → New project 2. Replace default code with appsscript/Code.gs contents 3. Edit the VPS URL line: 4. Deploy → New deployment → Type: Web app Execute as: Me Who has access: Anyone 5. Copy the Deployment ID → paste into scriptkeys in client config ⚠️ Every code edit requires a new deployment (not just saving). Old deployment IDs stop working if you only save without redeploying. Step 5: Open VPS Firewall Also check cloud provider firewall (AWS Security Groups, DigitalOcean Firewall, etc.) for inbound TCP 8443. Step 6: Run Server on VPS Step 7: Run Client Locally Expected output: --- CLI Reference Both binaries take only -config flag pointing to their respective JSON config file. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aradotso/gooserelayvpn-socks5-tunnel