Shadowsocks has quietly carried more people over the Great Firewall than any other tool. The 2022 edition hardens it against the active-probing attacks that caught older versions — and it's still the lightest, fastest option here. Deploy it one-click with Outline or by hand with sing-box, on a fresh offshore IP paid in crypto.
Shadowsocks was built for exactly one job — move your traffic through a firewall without looking like a VPN — and it does it with almost no overhead. It doesn't try to be a full VPN; it's a lean encrypted SOCKS proxy, which is why it's fast even on weak devices and cheap servers. The original protocol eventually fell to active probing, but Shadowsocks-2022 (the AEAD-2022 ciphers) closes those holes with proper authenticated encryption and replay protection. Pair it with the v2ray-plugin for TLS/WebSocket camouflage and it holds up well against modern DPI, while staying dramatically simpler than the alternatives.
~30 MB of RAM and negligible CPU. A VPS-S barely notices it — perfect for a cheap, always-on personal exit.
Jigsaw's Outline installs the server with one command and hands you a shareable access key. No config files if you don't want them.
The AEAD-2022 methods add authenticated encryption and replay protection — the exact gaps active probing used to exploit.
Every client speaks Shadowsocks: Outline, sing-box, Shadowrocket, v2rayN, NekoBox. Share one ss:// key and you're done.
What the protocol actually is, how it hides, and where it's strongest — described honestly. No proxy is magic; the right one for your network is.
| Server software | Shadowsocks-2022 (sing-box / Outline) |
|---|---|
| Transport & camouflage | AEAD-2022 ciphers, optional v2ray-plugin (TLS/WS) |
| DPI resistance | High — 2022 edition resists active probing & replay |
| Throughput | Excellent — the lightest option here |
| RAM footprint | ≈ 30 MB |
| Setup | Outline Manager one-click, or sing-box |
| Port(s) | any high TCP/UDP |
| Strongest in | China (evergreen), low-power clients |
A proxy is a tiny process — it needs a clean IP and steady bandwidth, not a big machine. Every plan is unmetered NVMe VPS with full root, rented with a token and paid in crypto.
A personal exit for one: VPS-S runs Shadowsocks with room to spare. The cheapest reliable way over the wall.
Share with a few people: VPS-M's cores and bandwidth handle a household of simultaneous streams comfortably.
Serving many or reselling: VPS-L with sing-box or an Outline fleet handles dozens of keys and heavy concurrent use.
Netherlands and Romania give the lowest latency to the Middle East and Turkey; Moldova is the cheapest entry; Switzerland and Iceland add legal weight if you're reselling. For China, latency is unavoidable from Europe — Netherlands is the standard choice.
| Location | CPU | RAM | Storage | Uplink | Price | |
|---|---|---|---|---|---|---|
| Moldova Budget Offshore | 2 vCPU | 4 GB DDR4 | 60 GB NVMe | 1 Gbps | $7.50/mo | Order |
| Russia Western-Proof | 2 vCPU | 4 GB DDR4 | 60 GB NVMe | 1 Gbps | $7.50/mo | Order |
| Panama No Data Retention | 2 vCPU | 4 GB DDR4 | 60 GB NVMe | 1 Gbps | $8.50/mo | Order |
| Romania Anti-Retention | 2 vCPU | 4 GB DDR4 | 60 GB NVMe | 1 Gbps | $8.50/mo | Order |
| Netherlands Best Peering | 2 vCPU | 4 GB DDR4 | 60 GB NVMe | 1 Gbps | $9.00/mo | Order |
| Iceland Free Speech Haven | 2 vCPU | 4 GB DDR4 | 60 GB NVMe | 1 Gbps | $10.00/mo | Order |
| Switzerland Premium Privacy | 2 vCPU | 4 GB DDR4 | 60 GB NVMe | 1 Gbps | $11.00/mo | Order |
From a blank VPS to a working endpoint. Commands are copy-paste ready for Ubuntu 24.04.
VPS-S is plenty. Choose a jurisdiction near you — Netherlands for peering, Moldova for the lowest price. Pay in crypto, get root on a clean IP.
Key-only SSH, a firewall that allows your chosen proxy port, automatic security updates. Ten minutes, done once.
Fastest path: Outline's one-line installer, then Outline Manager gives you an access key. Power path: sing-box with a 2022-blake3 cipher.
# fastest path: Outline. One command installs the server,
# Outline Manager gives you an access key to share.
sudo bash -c "$(wget -qO- https://raw.githubusercontent.com/Jigsaw-Code/outline-server/master/src/server_manager/install_scripts/install_server.sh)"For hostile DPI, wrap Shadowsocks in the v2ray-plugin (TLS + WebSocket) so it looks like plain HTTPS. On lighter networks, plain Shadowsocks-2022 is enough.
# power path: sing-box with Shadowsocks-2022 cipher
# /etc/sing-box/config.json → method 2022-blake3-aes-128-gcm,
# a base64 psk, and (optional) v2ray-plugin for TLS camouflageImport the ss:// key or Outline key into your app — Outline client, sing-box, Shadowrocket. Confirm it's online and you're through.
# import the ss:// key into Outline client, sing-box, or Shadowrocket
systemctl status sing-box # or: check Outline Manager shows the key onlineThe classic Shadowsocks (stream ciphers, then the first AEAD ciphers) served millions but eventually became probe-able: a censor could send crafted packets and watch how the server reacted to distinguish it from a real service. Shadowsocks-2022 fixes this at the protocol level with modern authenticated encryption, per-session salts and replay protection, so malformed or replayed probes get no useful signal. If you're setting up today, always choose a 2022-blake3 method — the older ciphers are kept only for legacy clients and shouldn't be used on a censored network.
Outline (by Jigsaw, a Google unit) is the friendliest path: a one-command server install and a desktop 'Manager' that issues shareable keys with a click — ideal for non-technical friends and family. sing-box is the power tool: one binary that speaks Shadowsocks-2022 plus a dozen other protocols, configured by a JSON file, perfect if you want camouflage plugins, multiple protocols on one box, or fine control. Both run happily on a VPS-S; pick Outline for simplicity, sing-box for flexibility.
On the most aggressive networks (parts of China during sensitive periods), even Shadowsocks-2022's own traffic shape can draw attention. The fix is the v2ray-plugin: it wraps your Shadowsocks stream in real TLS over WebSocket, so on the wire it's indistinguishable from HTTPS to a website. This adds a little overhead and a domain/CDN step, but turns Shadowsocks into a fully camouflaged tunnel. If you find yourself needing this often, it's also worth comparing VLESS+REALITY, which achieves similar stealth without a plugin.
Shadowsocks shines because it's simple, so operating it is easy: enable BBR congestion control for better throughput on long-distance links, keep the server updated, and put it on a non-obvious port. If an IP gets blocked, redeploy on a fresh one — because you paid with a token there's nothing linking the old server to the new. Many people keep a Shadowsocks box as their reliable daily driver and a second protocol in reserve for when the censor tightens up.
From $7.50/mo for a VPS-S — more than enough, since Shadowsocks uses almost no resources. Unlimited bandwidth included, so streaming and large downloads don't hit a cap.
Shadowsocks-2022 (the AEAD-2022 ciphers) is — it closes the active-probing gaps that caught older versions. On the harshest networks, add the v2ray-plugin for TLS camouflage. Always avoid the legacy stream ciphers.
Outline for a one-click server and click-to-share keys — great for family. sing-box if you want camouflage plugins, several protocols on one box, or precise control. Both run fine on the cheapest VPS.
Yes — issue a key per person (Outline makes this a click). A VPS-S covers a couple of people; move to VPS-M for a household of simultaneous heavy users.
Very well — it's low-overhead and fast, and with unlimited bandwidth there's no throttle. Enable BBR for smoother long-distance throughput. For deliberately throttled mobile networks, also consider Hysteria2.
Redeploy on a fresh IP, ideally another jurisdiction, from your dashboard — minutes, no ID, no new payment method. Keeping a spare in a second location means near-zero downtime.
Related reading: Self-Hosted VPN on a No-KYC VPS: WireGuard vs OpenVPN · The First Hour of VPS Hardening: A Checklist · Self-hosted VPN use case
Shadowsocks-2022 on a fresh offshore IP, one-click with Outline, paid in crypto. From $7.50/mo, online tonight.