Shadowsocks

Related articles

• Trojan

Shadowsocks is a lightweight proxy. It is based on the SOCKS5 protocol, but additionally uses encryption, which improves security and helps to bypass firewalls.

Installation

Several implementations are packaged for Arch Linux. You can install one of them:

• shadowsocks (development version: shadowsocks-git^AUR) — the initial implementation written in Python.
• shadowsocks-libev (development version: shadowsocks-libev-git^AUR) — written in C. It is now in maintenance mode (future development moved to shadowsocks-rust).
• go-shadowsocks2^AUR — written in Go.
• shadowsocks-rust^AUR (precompiled: shadowsocks-rust-bin^AUR, development version: shadowsocks-rust-git^AUR) — the newest and actively developed implementation written in Rust.

If you are not sure which implementation to use, try shadowsocks-libev.

Configuration

Shadowsocks configuration is done with a JSON formatted file. See Configuration via Config File and shadowsocks-libev(8) § CONFIG FILE.

Tip:

• To specify multiple server IPs, the following syntax can be used "server":["1.1.1.1","2.2.2.2"],.
• To find out the fastest method running on your machine, you can benchmark with the script iperf.sh.

Usage

Client

Warning: The udns package is used as a stub resolver for DNS. In order to prevent DNS request leaking of client applications (like browsers), further applications must be employed. For example, privoxy or a full DNS resolver on the client. [1] [2]

From the command line

The client is started with the ss-local (shadowsocks-libev) or sslocal (shadowsocks) command. See ss-local(1) and sslocal(1).

Daemon management

The Shadowsocks client can be controlled with an instance of [email protected] (shadowsocks) or [email protected] (shadowsocks-libev) through systemctl. To use the configuration file /etc/shadowsocks/config.json, start and enable shadowsocks-libev-server@config.service or shadowsocks-server@config.service.

You may also be interested in running an instance of shadowsocks@ or shadowsocks-libev@ after the network is up.

GUI client

Install the shadowsocks-qt5 package. For the development version, install the shadowsocks-qt5-git^AUR package.

Note: shadowsocks-qt5 is no longer being maintained.

Server

From the command line

The server is started with the ss-server (shadowsocks-libev) or ssserver (shadowsocks) command. See ss-server(1) and ssserver(1).

Daemon management

The Shadowsocks server can be controlled with an instance of [email protected] (shadowsocks-libev) or [email protected] (shadowsocks). To use the configuration file /etc/shadowsocks/config.json, start and enable shadowsocks-libev-server@config.service or shadowsocks-server@config.service.

To bind Shadowsocks to a privileged port (less than 1024), the server should be started as user root:

/etc/systemd/system/[email protected]/start-as-root.conf

[Service]
User=root

Tips and tricks

Performance optimization

• Use common ports such as 443. The Great Firewall checks relatively few commonly used ports to reduce stress.
• Enable TCP Fast Open.
• Enable BBR.
• Install python-gevent to increase the speed of shadowsocks.
• Optimize kernel parameters, see Optimizing Shadowsocks.

Encryption

See AEAD Ciphers.

Installing the python-m2crypto package will make encryption a little faster.

To use Salsa20 or ChaCha20 ciphers, install the libsodium package.

See also

• Shadowsocks Home Page
• GitHub project (shadowsocks)
• GitHub project (shadowsocks-libev)
• Python package
• GitHub wiki (some suggestions for optimization)