# Edit the configuration file
sudo vim /etc/shadowsocks-libev/config.json

# Edit the default configuration for debian
sudo vim /etc/default/shadowsocks-libev

# Start the service
sudo /etc/init.d/shadowsocks-libev start    # for sysvinit, or
sudo systemctl start shadowsocks-libev      # for systemd

su -c 'dnf copr enable librehat/shadowsocks'

shadowsocks_libev_enable="YES"

    netsh int tcp set global fastopenfallback=disabled

docker pull shadowsocks/shadowsocks-libev
docker run -e PASSWORD=<password> -p<server-port>:8388 -p<server-port>:8388/udp -d shadowsocks/shadowsocks-libev

ss-[local|redir|server|tunnel|manager]

   -s <server_host>           host name or ip address of your remote server

   -p <server_port>           port number of your remote server

   -l <local_port>            port number of your local server

   -k <password>              password of your remote server

   -m <encrypt_method>        Encrypt method: rc4-md5,
                              aes-128-gcm, aes-192-gcm, aes-256-gcm,
                              aes-128-cfb, aes-192-cfb, aes-256-cfb,
                              aes-128-ctr, aes-192-ctr, aes-256-ctr,
                              camellia-128-cfb, camellia-192-cfb,
                              camellia-256-cfb, bf-cfb,
                              chacha20-poly1305, chacha20-ietf-poly1305
                              salsa20, chacha20 and chacha20-ietf.

   [-f <pid_file>]            the file path to store pid

   [-t <timeout>]             socket timeout in seconds

   [-c <config_file>]         the path to config file

   [-i <interface>]           network interface to bind,
                              not available in redir mode

   [-b <local_address>]       local address to bind

   [-u]                       enable udprelay mode,
                              TPROXY is required in redir mode

   [-U]                       enable UDP relay and disable TCP relay,
                              not available in local mode

   [-L <addr>:<port>]         specify destination server address and port
                              for local port forwarding,
                              only available in tunnel mode

   [-6]                       Resovle hostname to IPv6 address first.

   [-d <addr>]                setup name servers for internal DNS resolver,
                              only available in server mode

   [--reuse-port]             Enable port reuse.

   [--fast-open]              enable TCP fast open,
                              only available in local and server mode,
                              with Linux kernel > 3.7.0

   [--acl <acl_file>]         config file of ACL (Access Control List)
                              only available in local and server mode

   [--manager-address <addr>] UNIX domain socket address
                              only available in server and manager mode

   [--mtu <MTU>]              MTU of your network interface.

   [--mptcp]                  Enable Multipath TCP on MPTCP Kernel.

   [--no-delay]               Enable TCP_NODELAY.

   [--executable <path>]      path to the executable of ss-server
                              only available in manager mode

   [--plugin <name>]          Enable SIP003 plugin. (Experimental)
   [--plugin-opts <options>]  Set SIP003 plugin options. (Experimental)

   [-v]                       verbose mode

# Create new chain
iptables -t nat -N SHADOWSOCKS
iptables -t mangle -N SHADOWSOCKS

# Ignore your shadowsocks server's addresses
# It's very IMPORTANT, just be careful.
iptables -t nat -A SHADOWSOCKS -d 123.123.123.123 -j RETURN

# Ignore LANs and any other addresses you'd like to bypass the proxy
# See Wikipedia and RFC5735 for full list of reserved networks.
# See ashi009/bestroutetb for a highly optimized CHN route list.
iptables -t nat -A SHADOWSOCKS -d 0.0.0.0/8 -j RETURN
iptables -t nat -A SHADOWSOCKS -d 10.0.0.0/8 -j RETURN
iptables -t nat -A SHADOWSOCKS -d 127.0.0.0/8 -j RETURN
iptables -t nat -A SHADOWSOCKS -d 169.254.0.0/16 -j RETURN
iptables -t nat -A SHADOWSOCKS -d 172.16.0.0/12 -j RETURN
iptables -t nat -A SHADOWSOCKS -d 192.168.0.0/16 -j RETURN
iptables -t nat -A SHADOWSOCKS -d 224.0.0.0/4 -j RETURN
iptables -t nat -A SHADOWSOCKS -d 240.0.0.0/4 -j RETURN

# Anything else should be redirected to shadowsocks's local port
iptables -t nat -A SHADOWSOCKS -p tcp -j REDIRECT --to-ports 12345

# Add any UDP rules
ip route add local default dev lo table 100
ip rule add fwmark 1 lookup 100
iptables -t mangle -A SHADOWSOCKS -p udp --dport 53 -j TPROXY --on-port 12345 --tproxy-mark 0x01/0x01

# Apply the rules
iptables -t nat -A PREROUTING -p tcp -j SHADOWSOCKS
iptables -t mangle -A PREROUTING -j SHADOWSOCKS

# Start the shadowsocks-redir
ss-redir -u -c /etc/config/shadowsocks.json -f /var/run/shadowsocks.pid

# Up to 32 connections are enough for normal usage
iptables -A INPUT -p tcp --syn --dport ${SHADOWSOCKS_PORT} -m connlimit --connlimit-above 32 -j REJECT --reject-with tcp-reset

Copyright: 2013-2015, Clow Windy <[email protected]>
           2013-2018, Max Lv <[email protected]>
           2014, Linus Yang <[email protected]>

This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.