--- name: "ss-redir" section: "1" platform: "linux" package: "shadowsocks-libev" version: "3.3.5+ds-16" release: "Debian 13 (Trixie)" platforms: ["linux"] url: "https://new.carta.tech/ss-redir" --- # ss-redir(1) shadowsocks client as transparent proxy, libev port ## NAME ss-redir - shadowsocks client as transparent proxy, libev port ## SYNOPSIS **ss-redir** \[-uUv6\] \[-h\|--help\] \[-s *\*\] \[-p *\*\] \[-l *\*\] \[-k *\*\] \[-m *\*\] \[-f *\*\] \[-t *\*\] \[-c *\*\] \[-b *\*\] \[-a *\*\] \[-n *\*\] \[--mtu *\*\] \[--no-delay\] \[--plugin *\*\] \[--plugin-opts *\*\] \[--password *\*\] \[--key *\*\] ## DESCRIPTION **Shadowsocks-libev** is a lightweight and secure socks5 proxy. It is a port of the original shadowsocks created by clowwindy. **Shadowsocks-libev** is written in pure C and takes advantage of libev to achieve both high performance and low resource consumption. **Shadowsocks-libev** consists of five components. [**ss-redir**(1)](/ss-redir/1.md) works as a transparent proxy on local machines to proxy TCP traffic and requires netfilter’s NAT module. For more information, check out [**shadowsocks-libev**(8)](/shadowsocks-libev/8.md) and the following *EXAMPLE* section. ## OPTIONS - \-s *\* Set the server’s hostname or IP. - \-p *\* Set the server’s port number. - \-l *\* Set the local port number. - \-k *\*, --password *\* Set the password. The server and the client should use the same password. - \--key *\* Set the key directly. The key should be encoded with URL-safe Base64. - \-m *\* Set the cipher. **Shadowsocks-libev** accepts 19 different ciphers: aes-128-gcm, aes-192-gcm, aes-256-gcm, rc4-md5, aes-128-cfb, aes-192-cfb, aes-256-cfb, aes-128-ctr, aes-192-ctr, aes-256-ctr, bf-cfb, camellia-128-cfb, camellia-192-cfb, camellia-256-cfb, chacha20-ietf-poly1305, xchacha20-ietf-poly1305, salsa20, chacha20 and chacha20-ietf. The default cipher is *chacha20-ietf-poly1305*. If built with PolarSSL or custom OpenSSL libraries, some of these ciphers may not work. - \-a *\* Run as a specific user. - \-f *\* Start shadowsocks as a daemon with specific pid file. - \-t *\* Set the socket timeout in seconds. The default value is 60. - \-c *\* Use a configuration file. Refer to [**shadowsocks-libev**(8)](/shadowsocks-libev/8.md) *CONFIG FILE* section for more details. - \-n *\* Specify max number of open files. Only available on Linux. - \-b *\* Specify the local address to use while this client is making outbound connections to the server. - \-u Enable UDP relay. TPROXY is required in redir mode. You may need root permission. - \-U Enable UDP relay and disable TCP relay. - \-T Use tproxy instead of redirect. (for tcp) - \-6 Resovle hostname to IPv6 address first. - \--mtu *\* Specify the MTU of your network interface. - \--mptcp Enable Multipath TCP. Only available with MPTCP enabled Linux kernel. - \--reuse-port Enable port reuse. Only available with Linux kernel \> 3.9.0. - \--no-delay Enable TCP\_NODELAY. - \--plugin *\* Enable SIP003 plugin. (Experimental) - \--plugin-opts *\* Set SIP003 plugin options. (Experimental) - \-v Enable verbose mode. \-h\|--help Print help message. ## EXAMPLE ss-redir requires netfilter’s NAT function. Here is an example: ``` # Create new chain iptables -t nat -N SHADOWSOCKS iptables -t mangle -N SHADOWSOCKS # Ignore your shadowsocks server's addresses # It's very IMPORTANT, just be careful. iptables -t nat -A SHADOWSOCKS -d 123.123.123.123 -j RETURN # Ignore LANs and any other addresses you'd like to bypass the proxy # See Wikipedia and RFC5735 for full list of reserved networks. # See ashi009/bestroutetb for a highly optimized CHN route list. iptables -t nat -A SHADOWSOCKS -d 0.0.0.0/8 -j RETURN iptables -t nat -A SHADOWSOCKS -d 10.0.0.0/8 -j RETURN iptables -t nat -A SHADOWSOCKS -d 127.0.0.0/8 -j RETURN iptables -t nat -A SHADOWSOCKS -d 169.254.0.0/16 -j RETURN iptables -t nat -A SHADOWSOCKS -d 172.16.0.0/12 -j RETURN iptables -t nat -A SHADOWSOCKS -d 192.168.0.0/16 -j RETURN iptables -t nat -A SHADOWSOCKS -d 224.0.0.0/4 -j RETURN iptables -t nat -A SHADOWSOCKS -d 240.0.0.0/4 -j RETURN # Anything else should be redirected to shadowsocks's local port iptables -t nat -A SHADOWSOCKS -p tcp -j REDIRECT --to-ports 12345 # Add any UDP rules ip route add local default dev lo table 100 ip rule add fwmark 1 lookup 100 iptables -t mangle -A SHADOWSOCKS -p udp --dport 53 -j TPROXY --on-port 12345 --tproxy-mark 0x01/0x01 # Apply the rules iptables -t nat -A PREROUTING -p tcp -j SHADOWSOCKS iptables -t mangle -A PREROUTING -j SHADOWSOCKS # Start the shadowsocks-redir ss-redir -u -c /etc/config/shadowsocks.json -f /var/run/shadowsocks.pid ``` ## SEE ALSO [**ss-local**(1)](/ss-local/1.md), [**ss-server**(1)](/ss-server/1.md), [**ss-tunnel**(1)](/ss-tunnel/1.md), [**ss-manager**(1)](/ss-manager/1.md), [**shadowsocks-libev**(8)](/shadowsocks-libev/8.md), [**iptables**(8)](/iptables/8.md), /etc/shadowsocks-libev/config.json