Shadowsocks - ArchWiki

Jump to content

# Shadowsocks

From ArchWiki

Related articles

- Trojan

Shadowsocks is a lightweight proxy. It is based on the SOCKS5 protocol, but additionally uses encryption, which improves security and helps to bypass firewalls.

## Installation

Several implementations are packaged for Arch Linux. You can install one of them:

- shadowsocks (development version: shadowsocks-gitAUR) — the initial implementation written in Python.
- shadowsocks-libev (development version: shadowsocks-libev-gitAUR) — written in C. It is now in maintenance mode (future development moved to shadowsocks-rust).
- go-shadowsocks2AUR — written in Go.
- shadowsocks-rustAUR (precompiled: shadowsocks-rust-binAUR, development version: shadowsocks-rust-gitAUR) — the newest and actively developed implementation written in Rust.

If you are not sure which implementation to use, try shadowsocks-libev.

## Configuration

Shadowsocks configuration is done with a JSON formatted file. See Configuration via Config File and shadowsocks-libev(8) § CONFIG FILE.

Tip:

- To specify multiple server IPs, the following syntax can be used `"server":["1.1.1.1","2.2.2.2"],`.
- To find out the fastest method running on your machine, you can benchmark with the script iperf.sh.

## Usage

### Client

Warning: The udns package is used as a stub resolver for DNS. In order to prevent DNS request leaking of client applications (like browsers), further applications must be employed. For example, privoxy or a full DNS resolver on the client. [1] [2]

#### From the command line

The client is started with the `ss-local` (shadowsocks-libev) or `sslocal` (shadowsocks) command. See ss-local(1) and sslocal(1).

#### Daemon management

The Shadowsocks client can be controlled with an instance of `shadowsocks@.service` (shadowsocks) or `shadowsocks-libev@.service` (shadowsocks-libev) through systemctl. To use the configuration file `/etc/shadowsocks/config.json`, start and enable `shadowsocks-libev-server@config.service` or `shadowsocks-server@config.service`.

You may also be interested in running an instance of `shadowsocks@` or `shadowsocks-libev@` after the network is up.

#### GUI client

Install the shadowsocks-qt5 package. For the development version, install the shadowsocks-qt5-gitAUR package.

Note: shadowsocks-qt5 is no longer being maintained.

### Server

#### From the command line

The server is started with the `ss-server` (shadowsocks-libev) or `ssserver` (shadowsocks) command. See ss-server(1) and ssserver(1).

#### Daemon management

The Shadowsocks server can be controlled with an instance of `shadowsocks-libev-server@.service` (shadowsocks-libev) or `shadowsocks-server@.service` (shadowsocks). To use the configuration file `/etc/shadowsocks/config.json`, start and enable `shadowsocks-libev-server@config.service` or `shadowsocks-server@config.service`.

To bind Shadowsocks to a privileged port (less than `1024`), the server should be started as user root:

    /etc/systemd/system/shadowsocks-server@.service.d/start-as-root.conf

    [Service]
    User=root

## Tips and tricks

### Performance optimization

- Use common ports such as `443`. The Great Firewall checks relatively few commonly used ports to reduce stress.
- Enable TCP Fast Open.
- Enable BBR.
- Install python-gevent to increase the speed of shadowsocks.
- Optimize kernel parameters, see Optimizing Shadowsocks.

### Encryption

See AEAD Ciphers.

Installing the python-m2crypto package will make encryption a little faster.

To use Salsa20 or ChaCha20 ciphers, install the libsodium package.

## See also

- Shadowsocks Home Page
- GitHub project (shadowsocks)
- GitHub project (shadowsocks-libev)
- Python package
- GitHub wiki (some suggestions for optimization)

Category:

- Proxy servers