SS-NAT(1)

💅 SS-NAT(1) — the glow-up ✨

okay so real talk, this is a page from the Shadowsocks-libev Manual, and bestie, it's about to make so much sense 🫶

---

🌸 NAME 🌸

ss-nat — the little helper script that sets up your NAT rules for transparent proxy. she's the backstage crew making the whole show work, no cap 💖

---

🎀 SYNOPSIS 🎀

ss-nat [-ouUfh] [-s <server_ip>] [-S <server_ip>] [-l <local_port>] [-L
<local_port>] [-i <ip_list_file>] [-a <lan_ips>] [-b <wan_ips>] [-w
<wan_ips>] [-e <extra_options>]

---

🦋 DESCRIPTION 🦋

So. Shadowsocks-libev is a lightweight and secure socks5 proxy — icon behavior only 👑. It's a port of the original shadowsocks created by clowwindy, and yes we stan the origin story. Shadowsocks-libev is written in pure C and takes advantage of libev to achieve both high performance and low resource consumption. literally the "works hard, barely eats" main character energy 🔥

ss-nat(1) sets up NAT rules for ss-redir(1) to provide traffic redirection. that's the whole job, and she does it slayfully 💅

⚠️ heads up bestie: she requires netfilter's NAT module and iptables(8). no iptables, no vibes.

for more info, check out shadowsocks-libev(8) and the EXAMPLE section down below ⬇️

---

✨ OPTIONS ✨

• -s <server_ip> — the IP address of your shadowsocks remote server 🌐
• -l <local_port> — the port number of your shadowsocks local server 🔌
• -S <server_ip> — the IP address of your shadowsocks remote UDP server 🛰️
• -L <local_port> — the port number of your shadowsocks local UDP server 📡
• -i <ip_list_file> — a file whose content is the bypassed ip list (basically the VIP guest list that skips the proxy 🙈)
• -a <lan_ips> — LAN IP of access control; heads up, she needs a prefix to define the access control mode 🏠
• -b <wan_ips> — WAN IP that will be bypassed 🚫
• -w <wan_ips> — WAN IP that will be forwarded ➡️
• -e <extra_options> — extra options for iptables 🧪
• -o — apply the rules to the OUTPUT chain 📤
• -u — enable udprelay mode; TPROXY is required ⚠️ (fr fr, don't skip that part)
• -U — enable udprelay mode, using different IP and ports for TCP and UDP 🔀
• -f — flush the rules 🧹
• -h — show this help message and exit 👋

---

🌈 EXAMPLE 🌈

ss-nat requires iptables(8). here's the moment you've been waiting for, bestie:

# Enable NAT rules for shadowsocks,
# with both TCP and UDP redirection enabled,
# and applied for both PREROUTING and OUTPUT chains
root@Wrt:~# ss-nat -s 192.168.1.100 -l 1080 -u -o

# Disable and flush all NAT rules for shadowsocks
root@Wrt:~# ss-nat -f

first one? she's serving 🔥 second one? the clean-up era 🧼✨

---

💜 SEE ALSO 💜

ss-local(1), ss-server(1), ss-tunnel(1), ss-manager(1), shadowsocks-libev(8), iptables(8), /etc/shadowsocks-libev/config.json

go read the whole fam, iykyk 📚💅

---

okay that's the whole page!! 🎀 this was Shadowsocks-libev 3.3.6, dated 10/11/2026 — so go set up those NAT rules and be the main character of your own network, periodt 💖🦋✨