Shadowsocks

Related articles

• Trojan

Shadowsocks is a lightweight proxy. It is based on the SOCKS5 protocol, but additionally uses encryption, which improves security and helps to bypass firewalls.

Installation

Install the shadowsocks-rust package.

Alternative implementations

• shadowsocks-go^AUR — written in Go.
• shadowsocks-git^AUR — written in Python. No longer in development.
• shadowsocks-libev-static^AUR — written in C. No longer in development.
• go-shadowsocks2^AUR — written in Go. No longer in development.

Configuration

Shadowsocks configuration is done with a JSON formatted file. See Configuration via Config File.

Tip

• To specify multiple server IPs, the following syntax can be used "server":["1.1.1.1","2.2.2.2"],.
• To find out the fastest method running on your machine, you can benchmark with the script iperf.sh.

Usage

Client

Warning The udns package is used as a stub resolver for DNS. In order to prevent DNS request leaking of client applications (like browsers), further applications must be employed. For example, privoxy or a full DNS resolver on the client. [1] [2]

From the command line

The client is started with the ss-local (shadowsocks-libev) or sslocal (shadowsocks, shadowsocks-rust) command, see sslocal(1) for details:

sslocal -b 127.0.0.1:1080 --server-url ss://

Or via config file:

sslocal -c config.json

config.json

{
 "remarks": "Server name",
 "server": "111.111.111.111",
 "server_port": 804,
 "local_port": 1080,
 "method": "chacha20-ietf-poly1305",
 "password": "server_password"
}

Daemon management

The Shadowsocks client can be controlled with an instance of shadowsocks@.service (shadowsocks) or shadowsocks-libev@.service (shadowsocks-libev) through systemctl. To use the configuration file /etc/shadowsocks/config.json, start and enable shadowsocks-libev-server@config.service or shadowsocks-server@config.service.

You may also be interested in running an instance of shadowsocks@ or shadowsocks-libev@ after the network is up.

Server

From the command line

The server is started with the ss-server (shadowsocks-libev) or ssserver (shadowsocks, shadowserver-rust) command, see the ssserver(1) manual.

Daemon management

The Shadowsocks server can be controlled with an instance of shadowsocks-rust-server@.service (shadowsocks-rust) or shadowsocks-server@.service (shadowsocks). To use the configuration file /etc/shadowsocks/config.json, start and enable shadowsocks-rust-server@config.service or shadowsocks-server@config.service.

To bind Shadowsocks to a privileged port (less than 1024), the server should be started as user root:

/etc/systemd/system/shadowsocks-server@.service.d/start-as-root.conf

[Service]
User=root

Tips and tricks

Performance optimization

• Use common ports such as 443. The Great Firewall checks relatively few commonly used ports to reduce stress.
• Enable TCP Fast Open.
• Enable BBR.
• Install python-gevent to increase the speed of shadowsocks.
• Optimize kernel parameters, see Optimizing Shadowsocks.

Encryption

See AEAD Ciphers.

Installing the python-m2crypto^AUR package will make encryption a little faster.

To use Salsa20 or ChaCha20 ciphers, install the libsodium package.

See also

• Shadowsocks Home Page
• GitHub project (shadowsocks)
• GitHub project (shadowsocks-rust)
• GitHub project (shadowsocks-libev)
• Python package
• GitHub wiki (some suggestions for optimization)