Shadowsocks - ArchWiki

Jump to content

# Shadowsocks

From ArchWiki

This article or section needs expansion.

Reason: See zh-hans:Shadowsocks#为其它程序配置代理. (Discuss in Talk:Shadowsocks)

Related articles

- Trojan

Shadowsocks is a lightweight proxy. It is based on the SOCKS5 protocol, but additionally uses encryption, which improves security and helps to bypass firewalls.

## Installation

Install the shadowsocks-rust package.

### Alternative implementations

- shadowsocks-goAUR — written in Go.
- shadowsocks-gitAUR — written in Python. No longer in development.
- shadowsocks-libev-staticAUR — written in C. No longer in development.
- go-shadowsocks2AUR — written in Go. No longer in development.

## Configuration

Shadowsocks configuration is done with a JSON formatted file. See Configuration via Config File.

Tip

- To specify multiple server IPs, the following syntax can be used `"server":["1.1.1.1","2.2.2.2"],`.
- To find out the fastest method running on your machine, you can benchmark with the script iperf.sh.

## Usage

### Client

Warning The udns package is used as a stub resolver for DNS. In order to prevent DNS request leaking of client applications (like browsers), further applications must be employed. For example, privoxy or a full DNS resolver on the client. [1] [2]

#### From the command line

The client is started with the `ss-local` (shadowsocks-libev) or `sslocal` (shadowsocks, shadowsocks-rust) command, see sslocal(1) for details:

    sslocal -b 127.0.0.1:1080 --server-url ss://

Or via config file:

    sslocal -c config.json

    config.json

    {
     "remarks": "Server name",
     "server": "111.111.111.111",
     "server_port": 804,
     "local_port": 1080,
     "method": "chacha20-ietf-poly1305",
     "password": "server_password"
    }

#### Daemon management

The Shadowsocks client can be controlled with an instance of `shadowsocks@.service` (shadowsocks) or `shadowsocks-libev@.service` (shadowsocks-libev) through systemctl. To use the configuration file `/etc/shadowsocks/config.json`, start and enable `shadowsocks-libev-server@config.service` or `shadowsocks-server@config.service`.

You may also be interested in running an instance of `shadowsocks@` or `shadowsocks-libev@` after the network is up.

### Server

#### From the command line

The server is started with the `ss-server` (shadowsocks-libev) or `ssserver` (shadowsocks, shadowserver-rust) command, see the ssserver(1) manual.

#### Daemon management

The Shadowsocks server can be controlled with an instance of `shadowsocks-rust-server@.service` (shadowsocks-rust) or `shadowsocks-server@.service` (shadowsocks). To use the configuration file `/etc/shadowsocks/config.json`, start and enable `shadowsocks-rust-server@config.service` or `shadowsocks-server@config.service`.

To bind Shadowsocks to a privileged port (less than `1024`), the server should be started as user root:

    /etc/systemd/system/shadowsocks-server@.service.d/start-as-root.conf

    [Service]
    User=root

## Tips and tricks

### Performance optimization

- Use common ports such as `443`. The Great Firewall checks relatively few commonly used ports to reduce stress.
- Enable TCP Fast Open.
- Enable BBR.
- Optimize kernel parameters, see Optimizing Shadowsocks.

### Encryption

See AEAD-2022 Ciphers.

## See also

- Shadowsocks Home Page
- GitHub project (shadowsocks)
- GitHub project (shadowsocks-rust)
- GitHub project (shadowsocks-libev)
- Python package
- GitHub wiki (some suggestions for optimization)

Category:

- Proxy servers

Hidden category:

- Pages or sections flagged with Template:Expansion

Shadowsocks
Add topic