easy-proxy

A collection of shell scripts for managing proxy traffic forwarding on Linux servers. Supports three backends: realm (Rust relay), gost (Go multi-protocol proxy), and iptables (kernel DNAT).

Inspired by Multi-EasyGost.

---

Requirements

• Linux with systemd (Debian/Ubuntu or CentOS/RHEL)
• Root access
• wget, curl, jq, python3 (installed automatically on first run)
• For iptables backend: iptables, ip commands available in the kernel

---

Quick Start

git clone https://github.com/maacck/easy-proxy
cd easy-proxy
chmod +x *.sh
sudo ./easy-proxy.sh

The main script presents a backend picker. Select a backend, then install and add rules from the sub-menu.

---

Scripts

Script	Backend	Mechanism
easy-proxy.sh	Unified entry point	Wraps all three backends
realm.sh	realm	TOML config + systemd
gost.sh	gost	JSON config + systemd
iptables.sh	iptables	PREROUTING DNAT + MASQUERADE

---

Choosing a Backend

	realm	gost	iptables
Protocol support	TCP, UDP	TCP, UDP, TLS, WS, WSS, SS, SOCKS5	TCP, UDP
Encryption	No	Yes (TLS/WSS)	No
Performance	High	Medium	Highest (kernel)
Load balancing	No	Yes	No
Dependencies	realm binary	gost binary	kernel only
Persistence	systemd	systemd	iptables-save + systemd

Use realm when you need fast, simple TCP/UDP relay.
Use gost when you need encrypted tunnels (TLS/WebSocket) or protocol conversion.
Use iptables when you want zero-overhead kernel-level forwarding.

---

easy-proxy.sh

Usage:
  ./easy-proxy.sh                         # interactive menu
  ./easy-proxy.sh status                  # show all service states + active rules
  ./easy-proxy.sh realm    [subcommand]
  ./easy-proxy.sh gost     [subcommand]
  ./easy-proxy.sh iptables [subcommand]

status output

Shows:

• systemd service state for realm, gost, iptables-proxy
• Listening ports (via ss)
• Active PREROUTING NAT rules

---

realm.sh

Manages the realm binary.

Config paths

Path	Purpose
/usr/local/bin/realm	binary
/etc/realm/config.toml	generated TOML config
/etc/realm/rawconf	rule storage (one rule per line)
/etc/systemd/system/realm.service	systemd unit

Interactive menu

sudo ./realm.sh

CLI subcommands

sudo ./realm.sh install     # download and install realm binary
sudo ./realm.sh update      # update to latest release
sudo ./realm.sh uninstall   # remove binary, config, service

sudo ./realm.sh add         # add a forwarding rule (interactive)
sudo ./realm.sh list        # list current rules
sudo ./realm.sh delete      # delete a rule by number

sudo ./realm.sh start
sudo ./realm.sh stop
sudo ./realm.sh restart
sudo ./realm.sh status
sudo ./realm.sh log         # last 50 journal lines

Rule format (rawconf)

<listen_addr>:<listen_port>#<remote_addr>:<remote_port>#<opts>

Field	Example	Notes
listen_addr	0.0.0.0	blank defaults to 0.0.0.0
listen_port	8080
remote_addr	1.2.3.4
remote_port	9090
opts	udp=true	optional, enables UDP forwarding

Example rawconf entries:

0.0.0.0:8080#1.2.3.4#9090#
0.0.0.0:443#your-server.com#443#udp=true

Generated TOML example

[network]
use_udp = true
zero_copy = false
tcp_timeout = 300
udp_timeout = 30

[[endpoints]]
listen = "0.0.0.0:8080"
remote = "1.2.3.4:9090"

[[endpoints]]
listen = "0.0.0.0:443"
remote = "your-server.com:443"
extra = { use_udp = true }

---

gost.sh

Manages go-gost v3.

Config paths

Path	Purpose
/usr/local/bin/gost	binary
/etc/gost/config.json	generated JSON config
/etc/gost/rawconf	rule storage
/etc/gost/certs/	TLS certificate directory
/etc/systemd/system/gost.service	systemd unit

Interactive menu

sudo ./gost.sh

CLI subcommands

sudo ./gost.sh install
sudo ./gost.sh update
sudo ./gost.sh uninstall

sudo ./gost.sh add
sudo ./gost.sh list
sudo ./gost.sh delete
sudo ./gost.sh config      # print current config.json

sudo ./gost.sh start
sudo ./gost.sh stop
sudo ./gost.sh restart
sudo ./gost.sh status
sudo ./gost.sh log

Supported protocols

Protocol	Description
tcp	Plain TCP forwarding
udp	Plain UDP forwarding
tcp+udp	Both TCP and UDP
tls	TCP forwarded over TLS tunnel
ws	TCP forwarded over WebSocket
wss	TCP forwarded over WebSocket + TLS

Rule format (rawconf)

<protocol>/<listen_port>#<remote_addr>#<remote_port>#<opts>

Field	Example	Notes
protocol	tcp+udp	see table above
listen_port	8080
remote_addr	1.2.3.4
remote_port	9090
opts	lb=round	lb=round, lb=random, lb=fifo

Example rawconf entries:

tcp+udp/8080#1.2.3.4#9090#
tls/443#secure-server.com#443#
wss/8443#secure-server.com#8443#lb=round

Generated JSON examples

Single rule (plain TCP+UDP):

{
  "Debug": false,
  "Retries": 3,
  "ServeNodes": ["tcp://:8080", "udp://:8080"],
  "ChainNodes": ["tcp://1.2.3.4:9090"]
}

Single rule (TLS tunnel):

{
  "Debug": false,
  "Retries": 3,
  "ServeNodes": ["tcp://:443"],
  "ChainNodes": ["relay+tls://secure-server.com:443"]
}

Multiple rules use a Routes array:

{
  "Debug": false,
  "Retries": 3,
  "Routes": [
    {"ServeNodes": ["tcp://:8080"], "ChainNodes": ["tcp://server-a:9090"]},
    {"ServeNodes": ["tcp://:8081"], "ChainNodes": ["relay+tls://server-b:443"]}
  ]
}

TLS certificates

From the menu or:

# ACME (auto, requires port 80 open and a domain)
sudo ./gost.sh    # -> option 9

# Manual copy
sudo ./gost.sh    # -> option 10

Certificates are stored at:

• /etc/gost/certs/cert.pem
• /etc/gost/certs/key.pem

---

iptables.sh

Manages kernel-level port forwarding via iptables DNAT.

Config paths

Path	Purpose
/etc/iptables-proxy/rules.conf	rule storage
/etc/iptables-proxy/saved.rules	iptables-save snapshot
/etc/systemd/system/iptables-proxy.service	boot restore unit

Interactive menu

sudo ./iptables.sh

CLI subcommands

sudo ./iptables.sh install   # install persistence systemd service
sudo ./iptables.sh add       # add a DNAT rule (interactive)
sudo ./iptables.sh list      # list stored rules
sudo ./iptables.sh delete    # delete a rule by number
sudo ./iptables.sh flush     # flush all NAT/FORWARD rules
sudo ./iptables.sh reload    # re-apply all rules from rules.conf
sudo ./iptables.sh show      # print live iptables NAT + FORWARD tables

Rule format (rawconf)

<proto>#<listen_ip>#<listen_port>#<remote_addr>#<remote_port>#<iface>

Field	Example	Notes
proto	tcp+udp	tcp, udp, or tcp+udp
listen_ip	0.0.0.0	blank defaults to 0.0.0.0
listen_port	8080
remote_addr	1.2.3.4
remote_port	9090
iface	eth0	auto-detected if blank

What each rule creates

For each protocol (tcp/udp), the script applies:

# Redirect incoming traffic on listen_port to remote
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 8080 \
    -j DNAT --to-destination 1.2.3.4:9090

# Allow the forwarded traffic through
iptables -A FORWARD -p tcp -d 1.2.3.4 --dport 9090 -j ACCEPT
iptables -A FORWARD -p tcp -s 1.2.3.4 --sport 9090 \
    -m state --state ESTABLISHED,RELATED -j ACCEPT

# Masquerade so remote sees your server as the source
iptables -t nat -A POSTROUTING -p tcp -d 1.2.3.4 --dport 9090 -j MASQUERADE

Persistence

Rules survive reboots via two mechanisms:

1. iptables-save written to /etc/iptables-proxy/saved.rules after every change
2. iptables-proxy.service (oneshot systemd unit) restores the saved rules on boot

Install persistence once:

sudo ./iptables.sh install

---

Common Scenarios

Simple TCP relay (realm)

Client --> [your server :8080] --> [remote :9090]

sudo ./realm.sh install
sudo ./realm.sh add
# listen: 0.0.0.0, port: 8080
# remote: remote.host, port: 9090
# UDP: N

Encrypted tunnel (gost TLS)

Client --> [your server :443 TCP] --(TLS)--> [remote :443]

sudo ./gost.sh install
sudo ./gost.sh add
# protocol: tls (option 4)
# listen port: 443
# remote: remote.host, remote port: 443

High-performance kernel relay (iptables)

Client --> [your server :80] --> [backend :8080]

sudo ./iptables.sh install
sudo ./iptables.sh add
# proto: tcp
# listen: 0.0.0.0:80
# remote: 10.0.0.5:8080
# iface: eth0 (auto-detected)

---

File Layout

easy-proxy/
├── easy-proxy.sh     # unified entry point
├── realm.sh          # realm backend manager
├── gost.sh           # gost backend manager
└── iptables.sh       # iptables DNAT manager

Runtime files (created on first use):
/etc/realm/
├── config.toml       # generated realm config
└── rawconf           # realm rule storage

/etc/gost/
├── config.json       # generated gost config
├── rawconf           # gost rule storage
└── certs/            # TLS certificates

/etc/iptables-proxy/
├── rules.conf        # iptables rule storage
└── saved.rules       # iptables-save snapshot

---

Acknowledgements

• zhboner/realm
• go-gost/gost
• KANIKIG/Multi-EasyGost