先上抓包 WebUI 图

嗯很好抓到了 V2EX 的一个 404 的 bug ，把 webui 配置一个域名，然后往工作群一发，前端和 app 自己玩去。

部署流程

1. 编译 go_middle 代码，上传到服务器启动 go_middle
2. 安装 Whistle 并启动
3. 配置 nginx

1. 直接上 go 代码

package main

import (
	"bufio"
	"bytes"
	"crypto/tls"
	"fmt"
	"io"
	"log"
	"net"
	"net/http"
	"strings"
)

var whistleAddr = "127.0.0.1:8899" // Whistle 监听的代理端口

func main() {
	http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
		targetHost := r.Header.Get("X-Target-Host")
		if targetHost == "" {
			http.Error(w, "Missing X-Target-Host header", http.StatusBadRequest)
			return
		}

		if strings.HasSuffix(targetHost, ":443") {
			handleTLSProxy(w, r, targetHost)
			return
		}

		if strings.ToLower(r.Header.Get("Upgrade")) == "websocket" {
			// ws:// 直接 HTTP 请求升级
			handleWebSocketProxy(w, r, targetHost)
			return
		}
		// 普通 HTTP 请求
		handleHTTP(w, r, targetHost)
	})

	log.Println("Proxy wrapper (for Whistle) listening on :8082")
	log.Fatal( http.ListenAndServe(":8082", nil))
}

func handleHTTP(w http.ResponseWriter, r *http.Request, targetHost string) {
	// 建立到 whistle 的连接
	fmt.Println("Handling HTTP request for target:", targetHost)
	conn, err := net.Dial("tcp", whistleAddr)
	if err != nil {
		http.Error(w, "Failed to connect to whistle: "+err.Error(), http.StatusBadGateway)
		return
	}
	defer conn.Close()

	// 构造代理协议的完整 URL
	fullURL := fmt.Sprintf("http://%s%s", targetHost, r.URL.RequestURI())

	// 创建新的请求
	req, err := http.NewRequest(r.Method, fullURL, r.Body)
	if err != nil {
		http.Error(w, "Failed to create proxy request: "+err.Error(), http.StatusInternalServerError)
		return
	}

	req.Header = r.Header.Clone()

	// 写入代理请求
	if err := req.Write(conn); err != nil {
		http.Error(w, "Failed to write proxy request to whistle: "+err.Error(), http.StatusBadGateway)
		return
	}

	// 从 whistle 读取响应
	resp, err := http.ReadResponse(bufio.NewReader(conn), req)
	if err != nil {
		http.Error(w, "Failed to read response from whistle: "+err.Error(), http.StatusBadGateway)
		return
	}
	defer resp.Body.Close()

	// 转发响应头和状态码
	for k, v := range resp.Header {
		for _, vv := range v {
			w.Header().Add(k, vv)
		}
	}
	w.WriteHeader(resp.StatusCode)

	// 转发响应体
	io.Copy(w, resp.Body)
}
func handleWebSocketProxy(w http.ResponseWriter, r *http.Request, targetHost string) {
	hj, ok := w.( http.Hijacker)
	if !ok {
		http.Error(w, "Hijack not supported", http.StatusInternalServerError)
		return
	}

	clientConn, _, err := hj.Hijack()
	if err != nil {
		http.Error(w, "Hijack failed: "+err.Error(), http.StatusInternalServerError)
		return
	}

	backendConn, err := net.Dial("tcp", whistleAddr)
	if err != nil {
		clientConn.Close()
		return
	}

	// 构造完整的 websocket 请求（代理格式）
	var buf bytes.Buffer
	fmt.Fprintf(&buf, "GET http://%s%s HTTP/1.1\r\n", targetHost, r.URL.RequestURI())
	fmt.Fprintf(&buf, "Host: %s\r\n", targetHost)
	fmt.Fprintf(&buf, "Connection: Upgrade\r\n")
	fmt.Fprintf(&buf, "Upgrade: websocket\r\n")

	for key, values := range r.Header {
		if strings.EqualFold(key, "Host") || strings.EqualFold(key, "Connection") || strings.EqualFold(key, "Upgrade") {
			continue
		}
		for _, v := range values {
			fmt.Fprintf(&buf, "%s: %s\r\n", key, v)
		}
	}
	buf.WriteString("\r\n")

	// 直接转发请求内容
	_, err = backendConn.Write(buf.Bytes())
	if err != nil {
		clientConn.Close()
		backendConn.Close()
		return
	}
	// 👇 直接把返回内容透传回客户端（不要使用 http.ReadResponse 解析，否则后续帧会丢）
	go io.Copy(backendConn, clientConn)
	io.Copy(clientConn, backendConn)
}
func handleTLSProxy(w http.ResponseWriter, r *http.Request, targetHost string) {
	hj, ok := w.( http.Hijacker)
	if !ok {
		http.Error(w, "Hijacking not supported", http.StatusInternalServerError)
		return
	}

	clientConn, _, err := hj.Hijack()
	if err != nil {
		http.Error(w, "Hijack failed: "+err.Error(), http.StatusInternalServerError)
		return
	}

	// 中间件连接 whistle ，发送 CONNECT 建立隧道
	backendConn, err := net.Dial("tcp", whistleAddr)
	if err != nil {
		clientConn.Close()
		return
	}

	// 发起 CONNECT 请求
	connectReq := fmt.Sprintf("CONNECT %s HTTP/1.1\r\nHost: %s\r\n\r\n", targetHost, targetHost)
	_, err = backendConn.Write([]byte(connectReq))
	if err != nil {
		http.Error(w, "backendConn CONNECT failed: "+err.Error(), http.StatusInternalServerError)
		clientConn.Close()
		backendConn.Close()
		return
	}

	// 读取 CONNECT 响应
	resp, err := http.ReadResponse(bufio.NewReader(backendConn), r)
	if err != nil || resp.StatusCode != 200 {
		clientConn.Write([]byte("HTTP/1.1 502 Bad Gateway\r\n\r\n"))
		clientConn.Close()
		backendConn.Close()
		return
	}
	// 🔐 2. TLS 握手
	tlsConn := tls.Client(backendConn, &tls.Config{
		ServerName: strings.Split(targetHost, ":")[0], // SNI 用于证书校验
	})
	if err := tlsConn.Handshake(); err != nil {
		clientConn.Close()
		backendConn.Close()
		return
	}

	// 构造完整的 websocket 请求（代理格式）
	var buf bytes.Buffer
	fmt.Fprintf(&buf, "%s %s HTTP/1.1\r\n", r.Method, r.URL.RequestURI())
	fmt.Fprintf(&buf, "Host: %s\r\n", targetHost)
	for key, values := range r.Header {
		if strings.EqualFold(key, "Host") {
			continue
		}
		for _, v := range values {
			fmt.Fprintf(&buf, "%s: %s\r\n", key, v)
		}
	}
	buf.WriteString("\r\n")
	// 直接转发请求内容
	_, err = tlsConn.Write(buf.Bytes())
	if err != nil {
		clientConn.Close()
		tlsConn.Close()
		return
	}
	// 🔄 3. 开始转发数据（ WebSocket over TLS ）
	go io.Copy(tlsConn, clientConn)
	io.Copy(clientConn, tlsConn)
}

交叉编译命令：GOOS=linux GOARCH=amd64 go build -o go_middle main.go 编译命令需要根据自己服务器进行调整我这里是 centos7 注意：go_middle 和 Whistle 要配置在一台机器上，如果需要配置到不同的服务器请修改代码中的whistleAddr

2.安装 Whistle （忽略直接 google ）

启动命令： w2 start 自己有域名可以这样配置: w2 start -H 0.0.0.0 -l w2.xxx.com

3.配置 nginx

# go_middle 的地址
upstream go_middle{server 192.168.31.148:8082}
server{
    server_name wchat.dsmai.com
    localtion / {
       proxy_pass http://go_middle
       # 内网真实服务器的地址
       proxy_set_header X-Target-Host 192.168.31.1:80
    }
}