Shadowsocks with RethinkDNS

[MLzen]

Is it possible to connect with shadowsocks while using RethinkDNS as firewall in any way? I have not found a solution or tutorial on my own for this scenario. Please help ;-(

[ignoramous]

If Shadowsocks clients you use support SOCK5, then you could forward traffic to it via a SOCKS5 proxy (TCP-only, for now) by configuring it from RethinkDNS settings page.

0. Open the RethinkDNS app
1. Settings -> Setup SOCKS5 (TCP) Proxy
2. Choose App (this should be the Shadowsocks client app running on usually the same Android device). IP remains 127.0.0.1 (if the client app is running on the same Android). Set appropriate port number (the client app is listening on), username (usually optional), and password (usually optional). Block UDP traffic to prevent leaks since SOCKS5 as implemented on RethinkDNS only supports TCP (see: Forwarding SOCKS5 over UDP #100).
3. Click Set.
4. Check if your IP has changed via https://html.duckduckgo.com/html/?q=what%27s%20my%20ip

As for native support for Shadowsocks: I am leaning towards adding support for WireGuard first (#52) and may be eventually add Shadowsocks support too. In fact, integrating Shadowsocks is likely easier of the two...

[MLzen]

Big thank you for the tutorial :)

Sadly I cannot use the Firewall because Shadowsocks needs its own VPN-instance ;-( this is one of the features I cannot find in any app: Connecting to Shadowsocks, having a firewall for whitelisting and the possibility to allow local network. Would this be possible, if RethinkDNS gets native support for Shadowsocks?

[ignoramous]

having a firewall for whitelisting and the possibility to allow local network. Would this be possible, if RethinkDNS gets native support for Shadowsocks?

Yes, that'd be possible.

(allow local network is also pending but is under impl right now: #368 #26)

[MLzen]

Is there a rough timeline where this features can be expected? I am just asking because Shadowsocks + LAN + Firewall is not possible in any constellation out there til now ;-(

[ignoramous]

Shadowsocks + LAN? March 2022, but no guarantees. (:

We are midway replacing our network engine in preparation for WireGuard, and so far, that has turned out to be very tricky given how the codebase is setup.

[ignoramous]

please track progress here: #37

I know I said March 2022... but things got out of hand for a bit with the serverside stuff we have running. That took away at least 3 months of my time that otherwise I would have spent working on the app.

But now: We're back on track to integrate WireGuard. Shadowsocks... is possible too. Let's see. But the timeline for it is way further out.

[PoneyClairDeLune]

Big thank you for the tutorial :)

Sadly I cannot use the Firewall because Shadowsocks needs its own VPN-instance ;-( this is one of the features I cannot find in any app: Connecting to Shadowsocks, having a firewall for whitelisting and the possibility to allow local network. Would this be possible, if RethinkDNS gets native support for Shadowsocks?

Use other clients that support local SOCKS5 exposure, like v2rayNG or SagerNet.

[MasterKia]

@PoneyClairDeLune Shadowsocks will work with your suggestion, but Wireguard is UDP by default and doesn't accept TCP.

SagerNet/Matsuri offers SOCKS5 local proxy for Wireguard but Rethink only supports TCP for SOCKS5 therefore => Rethink + SagerNet (Wireguard) is a no no for now.

[ignoramous]

Rethink only supports TCP for SOCKS5

Rethink, since v053j, supports SOCKS over UDP.

[MLzen]

For everyone who is interested in this thread: My solution is now using InviZible Pro.

• connect to TOR for some apps
• conntect to Shadowsocks-Server for some apps (to stop captcha-nagging)
• even possible to connect to LAN for specific apps

This solution will have it's downsides but it works good for me. Only restarting the system seems to offer a weak point....

[MasterKia]

Rethink, since v053j, supports SOCKS over UDP.

I have v053j but the settings still says "Setup SOCKS5 (TCP) Proxy"

[MasterKia]

Anyhow, Wireguard integration into Rethink is a very welcome change considering the recent censorship of internet in Iran and given one of Rethink's goals is "circumventing censorship".

[PoneyClairDeLune]

Anyhow, Wireguard integration into Rethink is a very welcome change considering the recent censorship of internet in Iran and given one of Rethink's goals is "circumventing censorship".

A little background. Shadowsocks, especially with AEAD ciphers, have been officially dead in Iran.

[ignoramous]

I have v053j but the settings still says "Setup SOCKS5 (TCP) Proxy"

A label we forgot to change... :D

A little background. Shadowsocks, especially with AEAD ciphers, have been officially dead in Iran.

So: Shadowsocks doesn't work at all? There's report that V2Ray works, so that's a good sign: https://news.ycombinator.com/item?id=33025954

[MasterKia]

https://news.ycombinator.com/item?id=33025954

We have reports that V2Ray VMess and ShadowSocks are working inside Iran even at times when most other tools and protocols don't.

Reports are terribly wrong.
Probably they're connected to an Intranet server's Shadowsocks, which DPI doesn't run on.

I've manually diagnosed Shadowsocks packets, not going through at all.

Changed encryption, changed protocol, tried several different ports, to no avail.

[PoneyClairDeLune]

https://news.ycombinator.com/item?id=33025954

We have reports that V2Ray VMess and ShadowSocks are working inside Iran even at times when most other tools and protocols don't.

Reports are terribly wrong. Probably they're connected to an Intranet server's Shadowsocks, which DPI doesn't run on.

I've manually diagnosed Shadowsocks packets, not going through at all.

Changed encryption, changed protocol, tried several different ports, to no avail.

Same conclusion as my own reports: Shadowsocks has been fingerprinted and dead. But no specifics as on how it was fingerprinted, maybe it targets non-identifiable high-entropy traffic.

In the mean time, V2Ray with HTTPS traffic as transports should still stand. They are tested and has stood for quite some time, at least on cable Internet.

Edit: How are OpenVPN and WireGuard? From my reports, they have been all dead too.

[MasterKia]

Wireguard is still working hence my suggestion for Rethink integration.

OpenVPN was working last I checked, but some say it's more detectable than Wireguard.

[PoneyClairDeLune]

Wireguard is still working hence my suggestion for Rethink integration.

OpenVPN was working last I checked, but some say it's more detectable than Wireguard.

Both OpenVPN and WireGuard are not hard to fingerprint, OpenVPN being the easiest.
Just asking, can swgp-go, the fingerprint-resistant fork of WireGuard connect in Iran?