# How to Use the Brook Proxy Tool: Complete TLS + WebSocket Setup Guide

> Master Brook proxy setup with this guide. Learn to configure TLS and WebSockets for secure proxying on your VPS and local machine. Get your secure tunnel running today.

- Repository: [如何翻墙/fanqiang](https://github.com/bannedbook/fanqiang)
- Tags: how-to-guide
- Published: 2026-09-06

---

**Run `brook wsserver` on your VPS to auto-obtain a Let's Encrypt certificate and create a WebSocket tunnel, then connect with `brook wsclient` locally to expose a SOCKS5 proxy at `127.0.0.1:2080`.**

The **Brook proxy tool** is a lightweight, cross-platform proxy solution designed for bypassing network restrictions through **TLS-encrypted WebSocket tunnels**. According to the `bannedbook/fanqiang` repository, Brook's architecture separates cleanly into a server component that terminates TLS and a client component that exposes a local SOCKS5 interface. This guide walks through deploying Brook using the **TLS + WebSocket** mode documented in the official tutorials.

## Brook Architecture Overview

Brook operates in a client-server model optimized for circumvention scenarios:

- **Server (`brook wsserver`)**: Handles TLS termination, automatically provisions free certificates from Let's Encrypt, and bridges traffic via WebSocket
- **Client (`brook wsclient`)**: Connects to the remote `wss://` endpoint and forwards to a local SOCKS5 listener

The implementation requires no external web server for basic operation—Brook manages certificate lifecycle and HTTPS listeners internally.

## Server Setup: Deploying Brook wsserver

The server configuration uses a single static binary with automatic TLS provisioning.

### Installation and Launch

From `v2ss/Brook之TLS+WebSocket翻墙教程.md` (lines 51-55), the standard server deployment follows this pattern:

```bash

# Download the Brook binary (v20200201 release shown)

wget https://github.com/txthinking/brook/releases/download/v20200201/brook
chmod +x brook

# Start the wsserver with your domain and password

setsid ./brook wsserver --domain www.mydomain.com -p yourPassword

```

**Key parameters:**
- `--domain`: Your fully-qualified domain name (must resolve to this server's IP)
- `-p`: Authentication password for client connections
- `setsid`: Ensures the process continues after logout

The server automatically:
1. Listens on **port 80** (HTTP-01 challenge) and **port 443** (TLS)
2. Requests and provisions a Let's Encrypt certificate
3. Stores certificates in a `.letsencrypt` directory
4. Creates the `wss://` WebSocket endpoint at `/ws`

### TLS Certificate Management

If your domain or DNS configuration changes, you must regenerate certificates. Per line 58 of the tutorial:

```bash

# Remove cached certificates and restart

rm -rf .letsencrypt
setsid ./brook wsserver --domain www.mydomain.com -p yourPassword

```

**Critical requirement**: Both server and client must maintain **synchronized system clocks**. TLS validation will fail if time drift exceeds acceptable thresholds (line 79).

## Client Setup: Connecting with Brook wsclient

The Windows client documented in `v2ss/Brook之TLS+WebSocket翻墙教程.md` (lines 73-76) creates a local SOCKS5 proxy that applications can route through.

### Windows Client Configuration

```cmd
:: Download the Windows binary (386 architecture example)
curl -L -o brook_windows_386.exe https://github.com/txthinking/brook/releases/download/v20200201/brook_windows_386.exe

:: Start the client SOCKS5 listener
brook_windows_386.exe wsclient -l 127.0.0.1:2080 -i 127.0.0.1 -s wss://www.mydomain.com:443 -p yourPassword

```

**Parameter breakdown:**
- `-l 127.0.0.1:2080`: Local SOCKS5 listen address (default port 2080)
- `-i 127.0.0.1`: Local interface binding
- `-s wss://www.mydomain.com:443`: Remote server endpoint (must match server domain)
- `-p yourPassword`: Authentication password (must match server)

Once running, configure any SOCKS5-capable application to use **127.0.0.1:2080** as its proxy.

## Advanced Deployment Options

The `bannedbook/fanqiang` repository extends the base Brook setup with two additional architectural patterns:

### TLS + WebSocket + Web Server

Hides the Brook endpoint behind a standard web server (nginx/Apache/Caddy) to blend proxy traffic with normal HTTPS requests. Reference: `v2ss/Brook之TLS+WebSocket+Web翻墙教程.md`

### TLS + WebSocket + CDN

Routes traffic through a CDN edge network for additional resilience and IP masking. Reference: `v2ss/Brook之TLS+WebSocket+CDN翻墙教程.md`

Both patterns use the same core `wsserver`/`wsclient` commands but add reverse proxy layers.

## File Reference Map

| Path | Purpose |
|------|---------|
| `v2ss/Brook之TLS+WebSocket翻墙教程.md` | Primary tutorial with server/client commands and TLS tips |
| `v2ss/Brook之TLS+WebSocket+Web翻墙教程.md` | Web server obfuscation layer |
| `v2ss/Brook之TLS+WebSocket+CDN翻墙教程.md` | CDN integration for resilience |
| [`v2ss/images/config.ini`](https://github.com/bannedbook/fanqiang/blob/main/v2ss/images/config.ini) | Example configuration referencing Brook executable |

## Summary

- **Brook proxy tool** deployment requires matching server (`wsserver`) and client (`wsclient`) commands with TLS + WebSocket mode
- **Server** auto-provisions Let's Encrypt certificates; delete `.letsencrypt` to regenerate after DNS changes
- **Client** exposes **127.0.0.1:2080** SOCKS5 proxy for application routing
- **Time synchronization** is mandatory on both endpoints for TLS validation
- Advanced concealment available via web server or CDN layering per repository tutorials

## Frequently Asked Questions

### What port does Brook use for the WebSocket tunnel?

Brook `wsserver` uses **port 80** for initial Let's Encrypt HTTP-01 validation and **port 443** for the encrypted `wss://` WebSocket tunnel. The client connects to port 443 by default.

### Does Brook require a separate web server like nginx?

No. The basic Brook TLS + WebSocket mode runs standalone. However, `bannedbook/fanqiang` provides optional tutorials for adding nginx or other web servers if you need traffic obfuscation.

### Why is my Brook client failing to connect with TLS errors?

The most common cause is **clock skew**. Both server and client system clocks must stay synchronized. Run `ntpdate` or enable NTP services on both machines before retrying.

### Can I use Brook with mobile applications?

Yes. Applications that support SOCKS5 proxy configuration can route through the local Brook client listener. Some mobile platforms may require third-party proxy management apps to enable system-wide SOCKS5 routing.