Mikhail Karmishin

Bypass firewalls using Shadowsocks + Cloak

2022-06-06T00:00:00+00:00

In this guide we'll use Shadowsocks + Cloak to create undetectable tunnels through restrictive networks.

I wrote a script called shadowsocks.sh that handles all the hard stuff for you.

What is Shadowsocks?

shadowsocks-rust is a fast proxy server written in Rust. While it can be used in standalone mode, in this article we'll be using it together with Cloak. Cloak can be used to obfuscate your traffic by making it look like some innocent internet protocol (HTTPS).

Before you start

You'll need:

a VPS server (some popular provider options are DigitalOcean, Vultr, and Linode)
basic Linux command line skills

Installation

SSH into your server and run the installer (as root):

# download
wget https://raw.githubusercontent.com/karmishin/shadowsocks.sh/master/shadowsocks.sh

# mark as executable
chmod +x shadowsocks.sh

# execute the actual script (use 'sudo' if you're not root)
./shadowsocks.sh -c

If the script runs successfully, the following message will be displayed:

############################
# Installation successful! #
############################

SHADOWSOCKS configuration:

Password: QZRiJHnxQ7d6gfj7DWn0TI6xnqj8bmvM
Encryption method: aes-256-gcm

CLOAK configuration:

Address: 198.51.123.45
Port: 443
EncryptionMethod: plain
Browser: chrome
Transport: direct
Proxy method: shadowsocks
Server name: yandex.ru
UID: 680onRmkblyCMJSujMVUkw==
Public key: p52laG1orgNYya/XIGAS7pR2nsQqP2yAG8pPmUhu720=
Stream timeout: 300

We can use these parameters to configure our clients.

Client configuration

Android

Download shadowsocks-android from Google Play or F-Droid.

Download cloak-android from the project's GitHub releases page and install the .apk file.

In the Shadowsocks app on your phone, press "Add profile" - "Manual settings". In the server settings section set the following parameters:

Server: enter the public IP address of your server (198.51.123.45 in the example above)
Port: 443 (the port on which Cloak listens on)
Password: enter the password from the script's output
Encrypt method: AES-256-GCM

Scroll down and press "Plugin", select Cloak. In plugin settings you have to set:

Transport: direct
Proxy method: shadowsocks
Encryption method: plain
UID and Public key: copy them from the Cloak section of script's output
Server name: enter any domain that is accessible from your restricted network (in my case it's ya.ru)
Browser signature: chrome
Stream timeout: 300

Save all settings and go back to the app's main screen. Select the newly added profile in the list so that it becomes active, and click on the airplane icon at the bottom of the screen.

By default, shadowsocks-android runs as a VPN and will proxy all traffic on your device. You can change it in the profile settings if you want ("Feature settings" - "Route").

iOS

Install Shadowrocket from the App Store.

Launch it and click the "Add server" button at the top right of the screen.

There you'll need to specify the following settings:

Type: Shadowsocks
Address: public IP of your server
Port: 443 (although this probably doesn't matter as we'll config Cloak later)
Password: your password from the Shadowsocks section of the script's output
Method: aes-256-gcm

Leave everything else as is.

Before you leave this screen, click on the "Plugin" button. Here we need to select our plugin (Cloak, obviously) and then configure it.

Plugin: cloak
Address: public IP of your server
Port: 443
Encryption method: plain
Browser: chrome
Transport: direct
Proxy method: shadowsocks
Server name: yandex.ru
UID and Public key: copy them from the Cloak section of script's output
Stream timeout: 300

Hit "Back" to exit the plugin configuration screen, and then tap on "Save" to save your config. Your server should now appear in the main screen of the app. Tap on it and switch the toggle that says "Not connected".

Troubleshooting

If for some reason you can't access your Shadowsocks instance, try the following:

Check if you can establish a TCP connection to your server on port 443. Open the terminal on your client machine and run (replace 198.51.123.45 with the IP address of your server):

telnet 198.51.123.45 443

Check the firewall settings on your VPS. Most providers install ufw that blocks everything by default. This should do the trick (run as root or with sudo):

ufw allow 443

Check the status of the shadowsocks/cloak services on your server:

systemctl status shadowsocks
systemctl status cloak-server

Check the server logs:

journalctl -u shadowsocks -e
journalctl -u cloak-server -e

Arch post-install notes

2021-12-05T00:00:00+00:00

Some of my notes on Arch Linux.

Installing KDE

The conventional way to install it is to use either the kde-applications package group or the kde-applications-meta meta-package. My problem with this approach is that they include a lot of apps most people won't need (PIM, Kontact, games, etc.). So I usually install the plasma package group first:

pacman -S plasma

Then I install only a small subset of KDE applications:

pacman -S ark filelight kate kcalc kdialog konsole \
          print-manager dolphin gwenview spectacle \
          okular

I also recommend installing these optional dependencies:

pacman -S unrar p7zip kde-cli-tools ffmpegthumbs \
          kdegraphics-thumbnailers --asdeps

Subpixel rendering and the LCD filter

Subpixel rendering is enabled by default since FreeType 2.10.3.

If letters appear to have a rainbow tint around them (especially in GTK applications), it makes sense to enable the LCD filter. Edit the file /etc/fonts/local.conf (or create it if it doesn't exist):

<match target="font">
  <edit name="lcdfilter" mode="assign">
    <const>lcddefault</const>
  </edit>
</match>

Read more on the ArchWiki: Subpixel rendering.

Installing Wine

This section is only relevant if you want to run Windows programs or games.

First, enable the multilib repository, as described in this article.

Install Wine:

pacman -S wine-staging

Then install all of its optional dependencies:

pacman -S giflib lib32-giflib libpng lib32-libpng libldap \
  lib32-libldap gnutls lib32-gnutls mpg123 lib32-mpg123 openal \
  lib32-openal v4l-utils lib32-v4l-utils libpulse lib32-libpulse \
  alsa-plugins lib32-alsa-plugins alsa-lib lib32-alsa-lib libjpeg-turbo \
  lib32-libjpeg-turbo libxcomposite lib32-libxcomposite libxinerama \
  lib32-libxinerama ncurses lib32-ncurses opencl-icd-loader \
  lib32-opencl-icd-loader libxslt lib32-libxslt libva lib32-libva \
  gtk3 lib32-gtk3 gst-plugins-base-libs lib32-gst-plugins-base-libs \
  vulkan-icd-loader lib32-vulkan-icd-loader

If you're using DXVK, VKD3D, or anything else Vulkan-related, make sure you have the latest GPU drivers and Vulkan drivers installed. See this page for more information on which packages you need for your GPU vendor.

Wallpapers

Arch actually has some nice wallpapers in its official repositories!

pacman -S archlinux-wallpaper