shadowsocks-c CLI reference

Command-line reference and configuration guide, generated by Doxygen from the source documentation.

• ss-local: SOCKS5 client
• ss-server: proxy server
• ss-tunnel: local port forwarding
• ss-redir: transparent proxy
• ss-manager: multi-user management
• ss-nat: NAT setup helper
• Configuration, examples, and management protocol

Download the generated man pages from the published site. The archive includes the six CLI manuals and both overview lookup names.

CLI conventions

Use descriptive long flags or their existing short aliases. Connections use different names for the remote server and the local listener:

• Clients: --server HOST --server-port PORT selects the remote Shadowsocks server.
• Listeners: --listen-address ADDRESS --listen-port PORT controls where a client or server accepts connections. The manager uses --manager-address for its control socket and configuration or its API for individual server ports.
• Tunnels: --destination HOST:PORT selects the forwarding destination.
• Configuration: --config FILE, --cipher NAME, and --password SECRET map to -c, -m, and -k. AEAD-2022 keys can also be supplied with --key BASE64.

Explicit transport and address-family flags override the JSON configuration. The last transport flag (--tcp-only, --udp, or --udp-only) wins, as does the last address preference (--ipv4-first or --ipv6-first). Address preferences do not disable either IP family. Other options retain their existing semantics, including repeatable server addresses and ss-local --server-url imports. Zero-valued resource settings such as MTU and TCP buffer sizes retain their existing behavior: they fall back to the configured value, or the system default when none is configured.

--help and --version write to standard output and exit successfully. Unknown options, missing values, invalid numeric CLI values, and unexpected positional arguments write usage errors to standard error and exit with status 2.

The formerly ignored -l flag in ss-server and ss-manager is now an error. Use ss-server --listen-port instead; manager-controlled ports come from its configuration or API. The removed one-time-authentication flag -A remains an error. Use an AEAD cipher.