SS-TUNNEL(1)

💅 SS-TUNNEL(1) — the shadowsocks-libev manual, bestie edition ✨

okay so real talk, this is the Shadowsocks-libev Manual page for ss-tunnel, and I'm gonna walk you through it like we're texting at 2am 🫶

---

🌸 NAME 🌸

ss-tunnel — shadowsocks tools for local port forwarding, libev port

✨ SYNOPSIS ✨

ss-tunnel [-uUv6] [-h|--help] [-s <server_host>] [-p <server_port>] [-l
<local_port>] [-k <password>] [-m <encrypt_method>] [-f <pid_file>] [-t
<timeout>] [-c <config_file>] [-i <interface>] [-b <local_address>] [-a
<user_name>] [-n <nofile>] [-L addr:port] [--mtu <MTU>] [--mptcp]
[--reuse-port] [--no-delay] [--plugin <plugin_name>] [--plugin-opts
<plugin_options>] [--key <key_in_base64>]

🦋 DESCRIPTION 🦋

So. Shadowsocks-libev is a lightweight and secure socks5 proxy, and it literally ate. It's a port of the original shadowsocks created by clowwindy, it's written in pure C, and it takes advantage of libev to achieve both high performance and low resource consumption. main character energy fr fr 👑

Shadowsocks-libev consists of five components, and ss-tunnel(1) is the tool for local port forwarding. That's its whole thing. If you need the special option that ss-tunnel(1) needs, it's down in the OPTIONS section — go look, I'll wait 💅

For more info, check out shadowsocks-libev(8).

---

🎀 OPTIONS 🎀

• -s <server_host> — set the server's hostname or IP. where we're headed 🛫
• -p <server_port> — set the server's port number.
• -l <local_port> — set the local port number. the one on your side.
• -k <password>, --password <password> — set the password. the server and the client should use the same password. no cap, they gotta match 🤝
• --key <key_in_base64> — set the key directly. it should be encoded with URL-safe Base64. yes, URL-safe, not regular safe 🔥
• -m <encrypt_method> — set the cipher.

Shadowsocks-libev accepts 19 different ciphers:

aes-128-gcm, aes-192-gcm, aes-256-gcm, rc4-md5, aes-128-cfb, aes-192-cfb, aes-256-cfb, aes-128-ctr, aes-192-ctr, aes-256-ctr, bf-cfb, camellia-128-cfb, camellia-192-cfb, camellia-256-cfb, chacha20-ietf-poly1305, xchacha20-ietf-poly1305, salsa20, chacha20 and chacha20-ietf.

The default cipher is chacha20-ietf-poly1305. iconic default, honestly.

If built with PolarSSL or custom OpenSSL libraries, some of these ciphers may not work. so like… don't come for me if one ghosts you 😭

• -a <user_name> — run as a specific user.
• -f <pid_file> — start shadowsocks as a daemon with specific pid file.
• -t <timeout> — set the socket timeout in seconds. the default value is 60. ⏳
• -c <config_file> — use a configuration file. refer to shadowsocks-libev(8) CONFIG FILE section for more details.
• -n <number> — specify max number of open files. Only available on Linux. 🐧
• -i <interface> — send traffic through specific network interface.

For example, there are three interfaces in your device, which is lo (127.0.0.1), eth0 (192.168.0.1) and eth1 (192.168.0.2). Meanwhile, you configure ss-tunnel to listen on 0.0.0.0:8388 and bind to eth1. That results the traffic go out through eth1, but not lo nor eth0. This option is useful to control traffic in multi-interface environment. multi-interface girlies rise 🌈

• -b <local_address> — specify the local address to use while this client is making outbound connections to the server.
• -u — enable UDP relay.
• -U — enable UDP relay and disable TCP relay. bold move, slay.
• -6 — resolve hostname to IPv6 address first. six supremacy 💜
• -L <addr:port> — specify destination server address and port for local port forwarding.

Only used and available in tunnel mode. iykyk 🚇

• --mtu <MTU> — specify the MTU of your network interface.
• --mptcp — enable Multipath TCP.

Only available with MPTCP enabled Linux kernel. 🐧✨

• --reuse-port — enable port reuse.

Only available with Linux kernel > 3.9.0.

• --no-delay — enable TCP_NODELAY.
• --tcp-incoming-sndbuf <size> — set TCP send buffer size for incoming connections.
• --tcp-incoming-rcvbuf <size> — set TCP receive buffer size for incoming connections.
• --tcp-outgoing-sndbuf <size> — set TCP send buffer size for outgoing connections.
• --tcp-outgoing-rcvbuf <size> — set TCP receive buffer size for outgoing connections.
• --plugin <plugin_name> — enable SIP003 plugin. (Experimental) 🙈
• --plugin-opts <plugin_options> — set SIP003 plugin options. (Experimental)
• -v — enable verbose mode. chatty king 🗣️
• -h|--help — print help message.

---

🍓 EXAMPLE 🍓

ss-tunnel(1) can be used to forward DNS queries to a remote DNS server through the shadowsocks tunnel. here's the vibe:

# Forward local UDP port 5353 to 8.8.8.8:53 through the ss-server
ss-tunnel -s example.com -p 12345 -l 5353 -k foobar -m aes-256-cfb -L 8.8.8.8:53 -u

# Then configure your system to use 127.0.0.1:5353 as the DNS server
dig @127.0.0.1 -p 5353 www.google.com

like, that's it. that's the whole flex 💅✨

---

💖 SEE ALSO 💖

ss-local(1), ss-server(1), ss-redir(1), ss-manager(1), shadowsocks-libev(8), iptables(8), /etc/shadowsocks-libev/config.json

---

okay and finally, the receipts so you know this is legit: this is Shadowsocks-libev 3.3.6, dated 10/11/2026, filed under SS-TUNNEL(1). go forth and tunnel, bestie 🧚💜