$ open-source · Go · Apache-2.0

SSH access, tunneledthrough plain HTTPS.

gossh wraps your SSH traffic inside a WebSocket connection so it slips through networks that only allow HTTP and HTTPS — no changes to your SSH server required.

View the repository Read the setup
41
GitHub stars
4
Forks
443
Only port it needs
# on the remote machine
$ gossh server --port 7777
✓ listening for WSS connections
# on your laptop
$ gossh client --connect https://xxxxx.trycloudflare.com --port 8888
✓ local tunnel ready on :8888
$ ssh ankush@localhost -p 8888

Built for networks that say no to raw SSH

Corporate firewalls, cloud security groups, and public Wi-Fi often block port 22 outright. gossh doesn't fight that rule — it rides on the traffic that's already allowed.

Lightweight

A small Go binary with minimal dependencies. Nothing to install on the SSH server itself.

Real-time

Full-duplex streaming over the WebSocket keeps the session responsive, not batched.

Firewall-friendly

Runs entirely over HTTPS on port 443, the one port almost every network leaves open.

Transparent

Once the tunnel is up, you connect with a standard SSH client like nothing changed.

How a connection actually travels

gossh doesn't replace SSH — it gives it a transport layer that looks like ordinary web traffic from the outside.

01
SSH client
Connects to localhost:8888, unaware anything unusual is happening.
02
gossh client
Opens the local port and forwards bytes into a WSS connection.
03
gossh server
Receives the WSS stream, exposed publicly via ngrok or a Cloudflare tunnel.
04
sshd
The bridge hands the stream to the real SSH daemon on localhost:22.

Getting connected

Four commands, run across two machines, get you from a blocked network to a working shell.

Install gossh

One line pulls the install script and puts the binary on your path.

curl -fsSL https://raw.githubusercontent.com/ankushT369/gossh/main/install.sh | bash

Start the server on the remote machine

Run this where sshd is already active. gossh assumes SSH is on port 22 unless you tell it otherwise.

gossh server --port 7777
Use --ssh to point at a non-default SSH port

Expose that port publicly

gossh speaks WebSockets over HTTP, so any HTTPS tunnel provider works. Copy the HTTPS URL it gives you.

ngrok http 7777
# or
cloudflared tunnel --url http://localhost:7777

Start the client on your machine

Point it at the public URL from the previous step. This opens a local port for SSH.

gossh client \
  --connect https://your-tunnel-url.trycloudflare.com \
  --port 8888

Connect with a normal SSH client

No special flags needed — the tunnel is invisible to SSH itself.

ssh ankush@localhost -p 8888

Ready to get past the firewall?

gossh is open source, Apache-2.0 licensed, and welcomes contributions.

Get gossh on GitHub