Shadowsocks

From ArchWiki

Shadowsocks[dead link 2022-09-23 ⓘ] is a lightweight proxy. It is based on the SOCKS5 protocol, but additionally uses encryption, which improves security and helps to bypass firewalls.

Installation

Several implementations are packaged for Arch Linux. You can install one of them:

If you are not sure which implementation to use, try shadowsocks-libev.

Configuration

Shadowsocks configuration is done with a JSON formatted file. See Configuration via Config File and shadowsocks-libev(8) § CONFIG FILE.

Tip:
  • To specify multiple server IPs, the following syntax can be used "server":["1.1.1.1","2.2.2.2"],.
  • To find out the fastest method running on your machine, you can benchmark with the script iperf.sh.

Usage

Client

Warning: The udns package is used as a stub resolver for DNS. In order to prevent DNS request leaking of client applications (like browsers), further applications must be employed. For example, privoxy or a full DNS resolver on the client. [1] [2]

From the command line

The client is started with the ss-local (shadowsocks-libev) or sslocal (shadowsocks) command. See ss-local(1) and sslocal(1).

Daemon management

The Shadowsocks client can be controlled with an instance of shadowsocks@.service (shadowsocks) or shadowsocks-libev@.service (shadowsocks-libev) through systemctl. To use the configuration file /etc/shadowsocks/config.json, start and enable shadowsocks-libev-server@config.service or shadowsocks-server@config.service.

You may also be interested in running an instance of shadowsocks@ or shadowsocks-libev@ after the network is up.

GUI client

Install the shadowsocks-qt5 package. For the development version, install the shadowsocks-qt5-gitAUR package.

Note: shadowsocks-qt5 is no longer being maintained.

Server

From the command line

The server is started with the ss-server (shadowsocks-libev) or ssserver (shadowsocks) command. See ss-server(1) and ssserver(1).

Daemon management

The Shadowsocks server can be controlled with an instance of shadowsocks-libev-server@.service (shadowsocks-libev) or shadowsocks-server@.service (shadowsocks). To use the configuration file /etc/shadowsocks/config.json, start and enable shadowsocks-libev-server@config.service or shadowsocks-server@config.service.

To bind Shadowsocks to a privileged port (less than 1024), the server should be started as user root:

/etc/systemd/system/shadowsocks-server@.service.d/start-as-root.conf
[Service]
User=root

Tips and tricks

Performance optimization

Encryption

See AEAD Ciphers[dead link 2022-09-23 ⓘ].

Installing the python-m2crypto package will make encryption a little faster.

To use Salsa20 or ChaCha20 ciphers, install the libsodium package.

See also