ss-tunnel

shadowsocks tools for local port forwarding, C implementation

SYNOPSIS

ss-tunnel [options]

DESCRIPTION

shadowsocks-c is a lightweight and secure socks5 proxy. It is a port of the original shadowsocks created by clowwindy. shadowsocks-c is written in pure C and takes advantage of libuv to achieve both high performance and low resource consumption.

shadowsocks-c consists of five components. ss-tunnel(1) is a tool for local port forwarding. See OPTIONS section for special option needed by ss-tunnel(1). For more information, check out shadowsocks-libev(8).

OPTIONS

Options include all supported platform variants; restrictions are noted below.

-f <pid_file>

Start shadowsocks as a daemon with specific pid file.

-s <server_host>

For clients, set a server endpoint as HOST:PORT or [IPv6]:PORT; host-only values use the legacy -p or configured fallback. Bare IPv6 is never split at its last colon. For server and manager, set the listening address.

-p <server_port>

For clients, set the legacy fallback port for server values without an embedded port. For ss-server, set the listening port.

-l <local_port>

Set the local port number.

-k <password>

Set the password. The server and the client should use the same password.

-t <timeout>

Set the socket timeout in seconds. The default value is 60.

-m <encrypt_method>

Set the cipher. The default is chacha20-ietf-poly1305.

AEAD cipher names from the source (availability depends on the build):

constexpr AeadSpec kSpecs[] = {
    { "aes-128-gcm", AeadKind::aes_128_gcm, 16, 12, 16 },
    { "aes-192-gcm", AeadKind::aes_192_gcm, 24, 12, 16 },
    { "aes-256-gcm", AeadKind::aes_256_gcm, 32, 12, 16 },
    { "chacha20-ietf-poly1305", AeadKind::chacha20_poly1305, 32, 12, 16 },
#ifdef crypto_aead_xchacha20poly1305_ietf_ABYTES
    { "xchacha20-ietf-poly1305", AeadKind::xchacha20_poly1305, 32, 24, 16 },
#endif
};

The unauthenticated stream ciphers (aes-256-cfb, chacha20-ietf, rc4-md5 and the like) are no longer supported.The 2022-blake3-* ciphers implement Shadowsocks 2022 (SIP022). They require a base64-encoded pre-shared key supplied with --key or --password (-k): 16 bytes for 2022-blake3-aes-128-gcm and 32 bytes for the other 2022 ciphers. Generate a 32-byte key with openssl rand -base64 32. Passwords are not stretched into keys for these ciphers.

-i <interface>

Send outbound traffic through the specified network interface where supported by the platform.

-c <config_file>

Use a configuration file.

Refer to shadowsocks-c(8) CONFIG FILE section for more details.

-b <local_address>

Set the local address to bind for the client listener.

-L <addr:port>

Destination server address and port for local port forwarding.

-a <user_name>

Run as a specific user.

-n <number>

Specify the maximum number of open files. Requires a platform with setrlimit support.

-h

Print help message.

-u

Enable UDP relay.

-U

Enable UDP relay and disable TCP relay.

-v

Enable verbose mode.

-V

Android only: enable VPN socket protection.

-6

Resolve hostname to IPv6 address first.

-A

Deprecated one-time authentication option. Exits with an error; use AEAD ciphers instead.

--config <config_file>

Read JSON configuration. See the CLI conventions for precedence and default-value behavior. Short alias: -c.

--cipher <encrypt_method>

Select the encryption cipher. See -m for supported cipher names and key requirements. Short alias: -m.

--timeout <timeout>

Same behavior as -t; see that option for details. Short alias: -t.

--user <user_name>

Same behavior as -a; see that option for details. Short alias: -a.

--pid-file <pid_file>

Same behavior as -f; see that option for details. Short alias: -f.

--nofile <number>

Same behavior as -n; see that option for details. Short alias: -n.

--udp

Enable both TCP and UDP relay, overriding the configured mode. Short alias: -u.

--udp-only

Enable UDP relay only, overriding the configured mode. Short alias: -U.

--ipv6-first

Prefer IPv6 DNS results; overrides configuration. This does not restrict connections to IPv6. Short alias: -6.

--verbose

Same behavior as -v; see that option for details. Short alias: -v.

--server <HOST:PORT>

Set a remote server endpoint; may be repeated with different ports. Use HOST:PORT for a hostname or IPv4, and [IPv6]:PORT for IPv6 (including scope when needed). Bare IPv6 is always a host, never split into a port. Host-only values require the legacy --server-port fallback or a configured port. An endpoint port takes priority over the fallback regardless of option order. SIP003 plugins require the same port for all endpoints. Short alias: -s.

--server-port <server_port>

Legacy fallback port for server values without an embedded port. Prefer --server HOST:PORT. Short alias: -p.

--listen-address <local_address>

Set the listening address. Server and manager addresses may be repeated. Short alias: -b.

--listen-port <local_port>

Set the listening port. Short alias: -l.

--interface <interface>

Same behavior as -i; see that option for details. Short alias: -i.

--destination <addr:port>

Set the forwarding destination as HOST:PORT; use [IPv6]:PORT for an IPv6 literal. Short alias: -L.

--version

Print the program name and version to standard output and exit successfully.

--tcp-only

Enable TCP relay only, overriding the configuration file's mode. The last of --tcp-only, --udp, and --udp-only wins.

--ipv4-first

Prefer IPv4 DNS results, overriding ipv6_first in the configuration file. This is an address preference, not a restriction to IPv4. The last of --ipv4-first and --ipv6-first wins.

--vpn

Same behavior as -V; see that option for details. Short alias: -V.

--fast-open

Enable TCP Fast Open where supported by the operating system.

--mtu <MTU>

Specify the MTU of your network interface.

--no-delay

Enable TCP_NODELAY.

--max-connections <number>

Serve at most this many TCP connections at once (default: 1024). Their memory is reserved at startup; a connection beyond the limit is refused until another one closes.

--max-udp-sessions <number>

Keep at most this many UDP associations (default: 256 for clients, 512 for ss-server). When the table is full, the least recently used one is dropped.

--mptcp

Enable Multipath TCP.

Only available with MPTCP enabled Linux kernel.

--plugin <plugin_name>

Enable SIP003 plugin. (Experimental)

--plugin-opts <plugin_options>

Set SIP003 plugin options. (Experimental)

--reuse-port

Enable port reuse where supported by the operating system.

--tcp-incoming-sndbuf <size>

Set TCP send buffer size for incoming connections.

--tcp-incoming-rcvbuf <size>

Set TCP receive buffer size for incoming connections.

--tcp-outgoing-sndbuf <size>

Set TCP send buffer size for outgoing connections.

--tcp-outgoing-rcvbuf <size>

Set TCP receive buffer size for outgoing connections.

--password <password>

Set the password. The server and the client should use the same password.

--key <key_in_base64>

Set the key directly. The key should be encoded with URL-safe Base64.

--help

Print help message.

EXAMPLE

ss-tunnel(1) can be used to forward DNS queries to a remote DNS server through the shadowsocks tunnel. Here is an example:

# Forward local UDP port 5353 to 8.8.8.8:53 through the ss-server
ss-tunnel --server example.com:12345 --listen-port 5353 --password foobar --cipher aes-256-gcm --destination 8.8.8.8:53 --udp
 
# Then configure your system to use 127.0.0.1:5353 as the DNS server
dig @127.0.0.1 -p 5353 www.google.com

SEE ALSO

ss-local(1), ss-server(1), ss-redir(1), ss-manager(1), shadowsocks-libev(8), iptables(8), /etc/shadowsocks-libev/config.json