shadowsocks-rust

The shadowsocks-rust project is a fast tunnel proxy designed to bypass firewalls. It is composed of several distinct crates depending on your needs:

• shadowsocks: The core shadowsocks protocol implementation.
• shadowsocks-service: Services used for serving shadowsocks.
• shadowsocks-rust: Binaries that run common shadowsocks services (the primary entry point for end-users).

To run the local client as a Windows Service, you must first compile the sswinservice binary with the winservice feature enabled.

1. Build: cargo build --release --bin "sswinservice" --features "winservice"

2. Install (via PowerShell): Use New-Service to register the service. The -BinaryPathName must include the subcommands and configuration path.

# Build
cargo build --release --bin "sswinservice" --features "winservice"

# Install via PowerShell
New-Service -Name "shadowsocks-local-service" `
            -DisplayName "Shadowsocks Local Service" `
            -BinaryPathName "<Path\to>\sswinservice.exe local -c <Path\to>\local_config.json"

Pull the appropriate images from the GitHub Container Registry and run them as containers. Note that Docker containers do not have access to IPv6 by default unless configured in the Docker daemon.

# Pull images
docker pull ghcr.io/shadowsocks/sslocal-rust:latest
docker pull ghcr.io/shadowsocks/ssserver-rust:latest

# Run sslocal (Client)
docker run --name sslocal-rust \
  --restart always \
  -p 1080:1080/tcp \
  -v /path/to/config.json:/etc/shadowsocks-rust/config.json \
  -dit ghcr.io/shadowsocks/sslocal-rust:latest

# Run ssserver (Server)
docker run --name ssserver-rust \
  --restart always \
  -p 8388:8388/tcp \
  -p 8388:8388/udp \
  -v /path/to/config.json:/etc/shadowsocks-rust/config.json \
  -dit ghcr.io/shadowsocks/ssserver-rust:latest

To completely remove the Shadowsocks SELinux policy, you must first delete the file context mappings, reset the file labels, and finally remove the policy module.

# 1. Remove file contexts first
semanage fcontext -d "/usr/bin/ssservice"
semanage fcontext -d "/etc/shadowsocks(/.*)?"
semanage fcontext -d "/usr/lib/systemd/system/ss-server@.*\.service"

# 2. Reset file labels
restorecon -F /usr/bin/ssservice
restorecon -RF /etc/shadowsocks

# 3. Remove the policy module
semodule -r shadowsocks

After installing the policy, you must map the correct SELinux types to the Shadowsocks binaries, configuration files, and systemd unit files, then apply those contexts to the filesystem.

# 1. Add file context mappings
semanage fcontext -a -t shadowsocks_exec_t "/usr/bin/ssservice"
semanage fcontext -a -t shadowsocks_conf_t "/etc/shadowsocks(/.*)?"
semanage fcontext -a -t shadowsocks_unit_file_t "/usr/lib/systemd/system/ss-server@.*\.service"

# 2. Apply contexts to files
restorecon -v /etc/systemd/system/ss-server@.service
restorecon -R /usr/bin/ssservice /etc/shadowsocks

# 3. Start the service
systemctl start ss-server@main

Install the snap package and manage the sslocal-daemon service using the following commands.

Default configuration path: /var/snap/shadowsocks-rust/common/etc/shadowsocks-rust/config.json

# Install from snapstore
snap install shadowsocks-rust

# List services
snap services shadowsocks-rust

# Enable and start shadowsocks-rust.sslocal-daemon snap service
snap start --enable shadowsocks-rust.sslocal-daemon

# Show generated systemd service status
systemctl status snap.shadowsocks-rust.sslocal-daemon.service

# Override generated systemd service (configure startup options)
systemctl edit snap.shadowsocks-rust.sslocal-daemon.service

# Restart generated systemd service to apply changes
systemctl restart snap.shadowsocks-rust.sslocal-daemon.service

Transparent proxying (Redir mode) is supported on Linux (via iptables REDIRECT and TPROXY) and BSDs (via pf).

To enable Redir mode:

• Use --protocol redir.
• Use --tcp-redir "redirect" for Linux TCP redirection.
• Use --udp-redir "tproxy" for Linux UDP redirection.

Important: Do not redirect traffic to a socks or http listener using iptables REDIRECT/TPROXY, as these methods send raw flows without proxy handshakes. Use --protocol socks or --protocol http only for applications that natively support those protocols.

sslocal -b "127.0.0.1:60080" --protocol redir -s "[::1]:8388" -m "aes-256-gcm" -k "hello-kitty" --tcp-redir "redirect" --udp-redir "tproxy"

Start the Shadowsocks local client by providing a JSON configuration file using the -c flag.

# Read local client configuration from file
sslocal -c /path/to/shadowsocks.json