Deploy Shadowsocks on a VPS

Architecture Overview

Before we begin, here is what we are building. Every component serves a specific purpose in making your traffic invisible to censors and ISPs:

    
graph TD
    A["Your Device"] -->|"HTTPS :443"| B["Nginx"]
    B -->|"WebSocket"| C["Shadowsocks :8389"]
    C -->|"Normal Traffic"| D["Internet"]
    style A fill:#1e293b,stroke:#3b82f6,color:#e2e8f0
    style B fill:#1e293b,stroke:#f59e0b,color:#e2e8f0
    style C fill:#1e293b,stroke:#10b981,color:#e2e8f0
    style D fill:#1e293b,stroke:#8b5cf6,color:#e2e8f0

  

• Nginx listens on port 443 with a genuine SSL certificate, handling TLS termination. To any observer, your server looks like a normal HTTPS website.
• Shadowsocks runs inside a Docker container on port 8389 (localhost only). Nginx forwards WebSocket traffic from the /shadowsocks path to this container.
• v2ray-plugin wraps the Shadowsocks protocol inside WebSocket frames, so the entire chain is: your device → TLS → WebSocket → Shadowsocks → internet.

The result: your ISP sees standard HTTPS traffic to what appears to be an ordinary website. There is nothing to detect or block.

Step 1: Get a Domain Name

You need a domain name for your proxy server. This is essential — it allows you to get a real SSL certificate, which makes your traffic look like normal HTTPS browsing. Without a domain, firewalls can easily identify and block your server by IP.

A domain costs as little as $2-9 per year. Choose any registrar you like:

Step 2: Choose a VPS Provider

You need a virtual private server (VPS) – a small cloud computer that will run your Shadowsocks proxy 24/7. The cheapest tier from any major provider is more than sufficient.

Step 3: Point Your Domain to the Server

You need a domain name pointed at your VPS so that you can get a genuine SSL certificate. This is what makes your traffic look like normal HTTPS browsing.

1. Log in to your domain registrar (Namecheap, Cloudflare, GoDaddy, etc.)
2. Go to the DNS settings for your domain
3. Create an A record:
   • Name/Host: @ (or a subdomain like proxy)
   • Value/Points to: your VPS IP address (e.g., 203.0.113.42)
   • TTL: Automatic or 300 seconds

Step 4: Connect to Your Server via SSH

Open a terminal on your computer and connect to your VPS:

ssh root@YOUR_SERVER_IP

Replace YOUR_SERVER_IP with the IP address from Step 1. If you set a password instead of an SSH key, you will be prompted to enter it.

Once connected, you should see a command prompt like root@your-server:~#. You are now ready to set up the server.

Step 5: Install Docker

Docker lets us run Shadowsocks in an isolated container. Install it with a single command:

curl -fsSL https://get.docker.com | sh

This downloads and runs Docker’s official installation script. It works on Ubuntu, Debian, CentOS, and Fedora. The process takes about a minute.

Verify that Docker is installed and running:

docker --version

You should see output like Docker version 27.x.x, build ....

Step 6: Deploy the Shadowsocks Container

Now deploy the Shadowsocks server with v2ray-plugin support:

docker run -d \
  --name shadowsocks \
  --restart always \
  -p 127.0.0.1:8389:8389 \
  -e PASSWORD=YOUR_STRONG_PASSWORD \
  -e METHOD=aes-256-gcm \
  jfca68/shadowsocks-server:latest

Let us break down what this command does:

• -d – Run the container in the background (detached mode)
• --name shadowsocks – Give the container a memorable name
• --restart always – Automatically restart if the container or server reboots
• -p 127.0.0.1:8389:8389 – Expose port 8389 only on localhost (not to the public internet)
• -e PASSWORD=... – Set the encryption password
• -e METHOD=aes-256-gcm – Use AES-256-GCM encryption (the strongest available)

Verify the container is running:

docker ps

You should see a container named shadowsocks with status Up.

Step 7: Install and Configure Nginx

Nginx will act as a reverse proxy, accepting HTTPS connections on port 443 and forwarding WebSocket traffic to the Shadowsocks container.

Install Nginx:

apt update && apt install -y nginx

Create the Nginx configuration file for your domain:

nano /etc/nginx/sites-available/YOUR_DOMAIN

Paste the following configuration (replace YOUR_DOMAIN with your actual domain):

server {
    listen 80;
    server_name YOUR_DOMAIN;

    location /shadowsocks {
        proxy_pass http://127.0.0.1:8389;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }

    location / {
        return 200 'Welcome to my website';
        add_header Content-Type text/plain;
    }
}

Enable the site and restart Nginx:

ln -s /etc/nginx/sites-available/YOUR_DOMAIN /etc/nginx/sites-enabled/
nginx -t
systemctl restart nginx

Step 8: Get an SSL Certificate

A genuine SSL certificate from Let’s Encrypt is critical. It ensures your traffic uses real TLS encryption and that your server looks like a legitimate HTTPS website.

Install Certbot and obtain a certificate:

apt install -y certbot python3-certbot-nginx
certbot --nginx -d YOUR_DOMAIN

Certbot will:

1. Verify that you control the domain
2. Obtain a free SSL certificate from Let’s Encrypt
3. Automatically configure Nginx to use HTTPS
4. Set up automatic certificate renewal (certificates expire every 90 days, but Certbot renews them automatically)

When prompted, enter your email address (for renewal notifications) and agree to the terms of service. When asked about redirecting HTTP to HTTPS, select Yes (option 2).

Step 9: Test Your Setup

Verify the server

Visit https://YOUR_DOMAIN in a web browser. You should see:

• A valid SSL certificate (padlock icon in the address bar)
• The “Welcome to my website” text (or whatever you configured)

Configure your client

Now set up the Shadowsocks client on your device. You will need these details:

Verify the connection

Once connected through your Shadowsocks client:

1. Visit whatismyipaddress.com – you should see your VPS’s IP address, not your real one
2. Visit dnsleaktest.com and run the extended test – no DNS queries should point to your real ISP
3. Run a speed test at speedtest.net – you should see minimal speed reduction

What’s Next?

Your Shadowsocks proxy is now running. Here are some next steps:

• Connect all your devices – Set up the client on Windows, macOS, Linux, Android, and iOS
• Learn more about Shadowsocks – Understand how the technology works and why it is resistant to censorship
• Set up automatic updates – Keep your Docker image up to date:

docker pull jfca68/shadowsocks-server:latest
docker stop shadowsocks && docker rm shadowsocks
# Re-run the docker run command from Step 5