Gonc – Netcat with P2P Nat Traversal
Recorded: Sept. 13, 2026, 9:08 a.m.
| Original | Summarized |
GitHub - threatexpert/gonc: Netcat with automated NAT traversal, secure P2P, and advanced features for shell access, file transfer, and network proxying. · GitHub Skip to content Navigation MenuSign inAppearance settingsPlatformAI CODE CREATIONGitHub CopilotWrite better code with AIGitHub Copilot appDirect agents from issue to mergeMCP RegistryIntegrate external toolsDEVELOPER WORKFLOWSActionsAutomate any workflowCodespacesInstant dev environmentsIssuesPlan and track workCode ReviewManage code changesCode QualityEnforce quality at mergeAPPLICATION SECURITYGitHub Advanced SecurityFind and fix vulnerabilitiesCode securitySecure your code as you buildSecret protectionStop leaks before they startEXPLOREWhy GitHubDocumentationBlogChangelogMarketplaceView all featuresSolutionsBY COMPANY SIZEEnterprisesSmall and medium teamsStartupsNonprofitsBY USE CASEApp ModernizationDevSecOpsDevOpsCI/CDView all use casesBY INDUSTRYHealthcareFinancial servicesManufacturingGovernmentView all industriesView all solutionsResourcesEXPLORE BY TOPICAISoftware DevelopmentDevOpsSecurityView all topicsEXPLORE BY TYPECustomer storiesEvents & webinarsEbooks & reportsBusiness insightsGitHub SkillsSUPPORT & SERVICESDocumentationCustomer supportCommunity forumTrust centerPartnersView all resourcesOpen SourceCOMMUNITYGitHub SponsorsFund open source developersPROGRAMSSecurity LabMaintainer CommunityGitHub StarsArchive ProgramREPOSITORIESTopicsTrendingCollectionsEnterpriseENTERPRISE SOLUTIONSEnterprise platformAI-powered developer platformAVAILABLE ADD-ONSGitHub Advanced SecurityEnterprise-grade security featuresCopilot for BusinessEnterprise-grade AI featuresPremium SupportEnterprise-grade 24/7 supportPricingSearch/Sign inSign upAppearance settings You signed in with another tab or window. Reload to refresh your session. Dismiss alert threatexpert gonc Public
Notifications
Fork
Star Code Issues Pull requests Actions Projects Wiki Security and quality Insights
Additional navigation options
Code Issues Pull requests Actions Projects Wiki Security and quality Insights
mainBranchesTagsGo to fileCodeOpen more actions menuLatest commit History353 Commits353 CommitsFolders and filesNameNameLast commit messageLast commit date.github/workflows.github/workflows aclacl appsapps docsdocs easyp2peasyp2p goncembedgoncembed httpfilesharehttpfileshare miscmisc mobilegoncmobilegonc netxnetx securesecure .gitattributes.gitattributes .gitignore.gitignore LICENSELICENSE README.mdREADME.md README_zh.mdREADME_zh.md acl-example.txtacl-example.txt build-for-win7.batbuild-for-win7.bat build-local.shbuild-local.sh build-page.batbuild-page.bat build.batbuild.bat build_page.pybuild_page.py go.modgo.mod go.sumgo.sum hole-punching.gifhole-punching.gif main.gomain.go mkdocs.ymlmkdocs.yml p2pC.batp2pC.bat p2pS.batp2pS.bat View all filesRepository files navigationREADMEMIT licenseMore itemsIntroduction to gonc 🔁 Automated NAT Traversal: Zero configuration. Both sides only need to agree on a passphrase. By using the -p2p parameter, peers can automatically discover each other’s network addresses and establish a point-to-point connection through NAT traversal, leveraging public STUN and MQTT services for address exchange. 🔒 End-to-End Encrypted with Mutual Authentication: Supports TLS for TCP and DTLS for UDP encrypted transmission, with passphrase-based mutual identity authentication. 🧩 Flexible Service Configuration: With the -e parameter, you can flexibly set the application to serve each connection. For example, -e /bin/sh can provide a remote cmd shell. You can also use built-in virtual commands for convenient SOCKS5 service, HTTP file service, and traffic forwarding. Latest version download Related Projects gonc-gui — a desktop (Windows) and Android app built on gonc: convenient cross-device, cross-network P2P direct connection and secure file transfer. Just share a passphrase (or scan a QR code); no command line required. Usage Examples Use it like nc: Now, you can also establish point-to-point connections based on a shared passphrase, with automated NAT traversal. P2P Tunnel and HTTP File Server Both sides agree on the same passphrase. On the receiving side, there are two options: Automatically download the entire directory Browse and selectively download via browser Secure Encrypted P2P Communication Establish secure encrypted P2P communication between two different networks by agreeing on a passphrase (use gonc -psk . to generate a high-entropy passphrase to replace passphrase). This passphrase is used for mutual discovery and certificate derivation, ensuring communication security with TLS 1.3. Check your NAT type Reverse Shell (Pseudo-Terminal Support for UNIX-like Systems) Listener (does not use -keep-open, accepts only one connection; no authentication with -psk): Connect to obtain a shell (supports TAB, Ctrl+C, etc.): Use P2P for reverse shell (passphrase is used for authentication, ensuring secure communication with TLS 1.3): Transmission Speed Test Send data and measure transmission speed (built-in /dev/zero and /dev/urandom): On the receiving side: P2P Tunnel and SOCKS5 / HTTP Proxy Wait for the tunnel to be established: On the other side, start a local SOCKS5 / HTTP proxy service on port 3080 to access the remote network: This domain will be resolved into an IP in the form of 127.b.c.d. As a result, the Remote Desktop client will connect to the local SOCKS5 proxy on port 3080, and then gonc will reverse-parse the 127.b.c.d address to extract the information 10.0.0.1-3389 from the domain name. link Configuration Format # Below is the configuration method for the URL format. The parameter value of -link must be enclosed in quotes; otherwise, parsing problems may occur. # The left side f://127.0.0.1:1080?to=1.2.3.4:80 # The right side f://0.0.0.0:80?to=127.0.0.1:80 # The left side x+tls means the proxy protocol with TLS encryption and allows for certificate configuration. The right side specifies the outbound IP address via `outbound_bind` (suitable for multi-IP environments). Flexible Service Configuration Use -exec to flexibly configure the application to provide services for each connection. For example, instead of specifying /bin/bash for shell commands, it can also be used for port forwarding. However, the following example starts a new gonc process for each connection: To avoid spawning multiple child processes, use the built-in nc module: Socks5 Proxy Service Configure client mode: Built-in Socks5 server: Use -e :s5s to provide standard Socks5 service. Support -auth to set a username and password for Socks5. Use -keep-open to continuously accept client connections to the Socks5 server. Thanks to Golang's goroutines, it achieves good multi-client concurrency performance: Secure Socks5 over TLS: Since standard Socks5 is unencrypted, use -e :s5s with -tls and -psk to customize secure Socks5 over TLS communication. Use -P to monitor connection transmission information, and -acl to implement access control for incoming connections and proxy destinations. For the acl.txt file format, see acl-example.txt. Establishing a Tunnel for Other Applications Assist WireGuard in NAT Traversal to Form a VPN P2P NAT Traversal Capabilities Concurrently uses multiple public STUN servers to detect local TCP/UDP NAT mappings and intelligently determine NAT type How to Deploy a Relay Server for Cases Where P2P Is Not Feasible A SOCKS5 server with UDP ASSOCIATE support running on a public IP is sufficient as a relay. You can also run gonc's built-in SOCKS5 proxy on your own VPS to act as a relay server. When P2P fails, you only need one side of gonc to retry the P2P process using the -x option to route through the SOCKS5 relay: For example, if both peers are behind symmetric NATs and P2P fails, having just one side use a SOCKS5 UDP relay effectively changes its NAT behavior to “easy,” making it much easier to establish a connection. The data remains end-to-end encrypted. "tcp://broker.hivemq.com:1883", How effective is gonc at NAT traversal? Easy: A single internal port maps to the same external port across multiple STUN servers Hard: A single internal port maps to a consistent but different external port across STUN servers — harder than type 1 Symmetric: A single internal port maps to different external ports depending on the destination — the most difficult type To handle these NAT types, gonc employs several traversal strategies: Uses multiple STUN servers to detect NAT behavior and identify multi-exit IP scenarios Prefers IPv6 connections when both sides support it (e.g., TCP6-to-TCP6 direct dial) Both peers listen on TCP while simultaneously dialing each other to increase TCP hole punching success The peer with the easier NAT delays its initial UDP packet to avoid triggering port changes on the harder side The peer with the harder NAT sends UDP packets with a low TTL to reduce interference from the remote firewall As a last resort, uses a "birthday paradox" strategy: the harder side uses 600 random source ports, and the other side tries 600 random destination ports, increasing the chance of a successful UDP port collision AboutNetcat with automated NAT traversal, secure P2P, and advanced features for shell access, file transfer, and network proxying.www.gonc.ccTopicsfile-transfergogolanghole-punchingipv6natnat-traversalnetcatp2psocks5toolstunnelResourcesReadmeMIT licenseActivityStars693 starsWatchers6 watchingForks60 forksReport repositoryReleasesPackagesUsed byContributorsLanguages Footer © 2026 GitHub, Inc. Footer navigation Terms Privacy Security Status Community Docs Contact Manage cookies Do not share my personal information You can’t perform that action at this time. |
gonc is a Golang-based Netcat utility designed to facilitate secure, peer-to-peer communication by incorporating automated NAT traversal, end-to-end encryption, and advanced networking features such as shell access, file transfer, and network proxying. The core of gonc's design centers on establishing direct connections between peers across various Network Address Translation environments. The tool achieves automated NAT traversal by leveraging public STUN and MQTT services to discover network addresses and establish point-to-point connections without requiring manual configuration. This process relies on mutually agreed-upon passphrases for mutual identity authentication. The operation explores connection attempts in a priority order: IPv6 TCP, followed by IPv4 TCP, and then IPv4 UDP. The system employs strategies to manage NAT types, which are categorized as Easy, Hard, and Symmetric. The success rate of NAT traversal is highly dependent on the NAT configuration; symmetric NAT scenarios on both ends present the most significant difficulty. To manage this, gonc utilizes multiple STUN servers for comprehensive NAT detection and employs specific synchronization techniques, such as having the peer with the easier NAT delay initial UDP packets, or using "birthday paradox" strategies involving random source and destination ports to maximize the chance of successful UDP port collision. gonc supports flexible service configuration through the use of the exec parameter, allowing the tool to provide diverse services for each connection, such as remote command shells by executing /bin/sh, or facilitating various virtual commands for SOCKS5 services and HTTP file services. For file sharing, the tool allows a sender to set up an HTTP file server to expose directories or files, and receivers can choose between automatically downloading an entire directory recursively or browsing and selectively downloading files via a local HTTP endpoint. Secure P2P communication is guaranteed through end-to-end encryption, supporting TLS for TCP and DTLS for UDP transmissions, all secured by passphrase-based mutual authentication. Synchronization of timing during the P2P establishment is managed via MQTT message subscriptions using -mqtt-wait and -mqtt-hello, which help synchronize the start of the P2P process between the two parties. gonc also provides advanced tunnel and proxy capabilities. It can establish P2P tunnels and assist in forming VPN connections by integrating with WireGuard through a specific sequence of commands involving MQTT signaling, allowing for secure tunnel establishment. For situations where true P2P is infeasible, the tool offers a relay mechanism using a SOCKS5 server that supports UDP association, which can be deployed on a public IP or a Virtual Private Server. If P2P fails, a peer can use this SOCKS5 relay to route the connection. This relay strategy effectively alters the NAT behavior, often improving the success rate of connection establishment, while maintaining end-to-end encryption. The tool demonstrates sophisticated control over proxying through the link parameter. It supports complex link configurations that allow for transparent proxy functionality and forwarding traffic across networks, defining how local and remote endpoints interact, including forwarding protocols, local port specifications, and remote destination addresses. Furthermore, gonc can implement secure SOCKS5 over TLS by combining the service execution with TLS and PSK mechanisms, allowing for fine-grained access control over proxy destinations using an access control list format. The use of go routines allows for high concurrency in running these services, ensuring good performance when handling multiple client connections to the SOCKS5 server. |