Shadowsocks in China: Does It Still Work?

Does Shadowsocks still work in China?

Shadowsocks still works in China for some people in 2026, but not for everyone, and we found no 2026 measurement that settles it. We haven’t tried Shadowsocks in China. This page reports what researchers and users say, with dates.

• Research. The Great Firewall has detected Shadowsocks since 2019. From November 2021 it blocked fully encrypted traffic, Shadowsocks included, on part of the traffic to popular data centers. Countermeasures added to Shadowsocks tools in 2022 were reported still working in February 2023, the latest measurement we found.
• 2026 reports. Users disagree. In September 2026, one Reddit user said Outline, which runs on Shadowsocks, was “fully blocked in china”, and another replied that it “works just fine”. Reports on Mullvad’s Shadowsocks setting are mixed too.
• Timing. Reports of heavier blocking cluster around politically sensitive dates. Researchers noted reports of blocking during political congresses in 2017 and 2018 and around the 70th anniversary of the People’s Republic in 2019. Users reported more waves in early October 2022 and late September 2024.

To compare Shadowsocks with other protocols, see our guide to the best VPN protocol for China.

What Shadowsocks is

Shadowsocks is a free, open-source encrypted proxy that its project describes as “a secure split proxy loosely based on SOCKS5”, a standard proxy protocol. A client on your device encrypts traffic and sends it to a Shadowsocks server outside the firewall, which forwards it to the sites you visit. Rather than imitate another protocol, it uses “encryption to appear as a uniformly random byte stream”, as GFW Report’s 2020 paper explains.

Is Shadowsocks blocked in China?

Not across the board, but the Great Firewall has detected Shadowsocks since 2019 and blocks many servers, according to research by GFW Report and university researchers. The studies below explain how, in order.

2017 to 2019: blocking reports, then active probing

Users in China reported Shadowsocks servers blocked from as early as October 2017. Notable reports came in October 2017 and January 2018, during two political congresses. The evidence was mixed: other researchers who tested Shadowsocks reachability every day at that time saw no sign of blocking anywhere (GFW Report, IMC 2020).

Users reported a sudden rise in blocking from around September 16, 2019. A Net4People post in October 2019 said servers were being blocked by IP address within about 30 minutes of being used from China, though its author couldn’t tell whether that held for every server.

GFW Report’s paper at the Internet Measurement Conference, published October 7, 2020, showed how the firewall did it:

1. Passive check. It looks at the first data packet of each connection. The packet’s length and entropy, or how random it looks, mark probable Shadowsocks traffic.
2. Active probes. It then sends the server seven types of probes, in stages: replays of real connections, some with bytes changed, and random data of different lengths. The probes came from thousands of IP addresses that appeared to be centrally controlled.
3. Blocking. Blocked servers lost one port or their whole IP address. Only traffic from the server to the user was dropped.

Blocking was patchy. The researchers ran servers from July 2019, and many were probed heavily, but only three were blocked, all running ShadowsocksR or Shadowsocks-python rather than the Shadowsocks-libev and Outline versions they mostly used. User reports suggested those weren’t immune either. One blocked server came back more than a week later. One of the researchers’ hypotheses was that people decide which detected servers to block. That would partly explain the reports of more blocking at sensitive times.

The paper advised using only AEAD ciphers, which also detect tampered data. It also advised rejecting replayed connections by their timestamp, not only by remembering each connection’s random starting value, and making servers react the same way to bad data. The Shadowsocks project now says its old stream ciphers “are completely broken”.

Probe-resistant updates followed. Shadowsocks, Outline and V2Ray were unblocked in China from September 2020 until November 2021, according to the 2023 paper. Not every user saw that. In March and April 2021, three users told GFW Report that properly configured Shadowsocks-libev servers had become unreachable, two of them for an hour or less (Net4People).

November 2021: blocking fully encrypted traffic

On November 6, 2021, users in China reported their Shadowsocks and VMess servers blocked (VMess is V2Ray’s own protocol), and two days later an Outline developer reported a sudden drop in use from China. A paper by GFW Report and university researchers, released in April 2023 and presented at USENIX Security 2023, found that the firewall had started blocking fully encrypted traffic in real time, based on passive analysis alone:

• It blocks by elimination. Rather than define fully encrypted traffic, the firewall exempts connections whose first packet looks like a common protocol, has an unusually low or high share of 1 bits, or contains enough printable characters. It blocks the rest.
• It is selective. It applied the rules only to IP ranges of popular data centers, and only to about one in four connections to them. In a May 2022 scan, Alibaba US was heavily affected, Akamai and Cloudflare were not, and Amazon, DigitalOcean and Linode were mixed. Applied to all traffic, the researchers estimated, the rules would also catch about 0.6% of normal connections.
• Blocks are short. A flagged connection blocks the same user, server and port for 120 or 180 seconds.
• It feeds the probes. The active probing system uses the same traffic analysis, with extra rules on packet length.

The paper lists Shadowsocks, Outline, VMess, obfs4, Lantern, Psiphon and Conjure among the tools affected, “partially or in full”.

2022 and 2023: countermeasures

The researchers shared a first fix with developers on January 13, 2022, and by the next day Shadowsocks-rust, V2Ray and Sagernet had added it as an option. It changes how the first bytes of a connection look. On October 14, 2022, the researchers released a modified Shadowsocks that changes the share of 1 bits, and on October 25 Outline added its own version of the first fix.

In the October 2022 post that released it, the researchers wrote that the firewall “can already accurately identify Shadowsocks, VMess, and Obfs4”, with 0.6% false positives and false negatives “almost negligible”. They released it to counter “massive blocking of multiple censorship circumvention tools since October 3rd, 2022” (Net4People).

As of February 14, 2023, all of these fixes were reportedly still effective in China, and Outline reported that the number of Outline servers sharing anonymous metrics had doubled since it adopted its fix. The researchers called the first fix “a stopgap solution” that “could potentially be blocked by the censor fairly easily”. Outline’s own documentation says that when China “started blocking seemingly random traffic”, “the protocol ended up blocked”, and calls its fix a “connection prefix disguise”.

That February 2023 result is the newest published measurement of Shadowsocks in China we found.

Timeline

Date	What was reported	Source
Oct 2017 and Jan 2018	Users report Shadowsocks blocking during two political congresses; a daily reachability study sees none	IMC 2020 paper
May 2019	First-packet checks and active probing of Shadowsocks servers begin	USENIX Security 2023 paper
Sep 16, 2019	Sudden rise in blocking; servers reportedly blocked by IP within about 30 minutes	Net4People
Sep 2020 to Nov 2021	Probe-resistant Shadowsocks, Outline and V2Ray unblocked in China	USENIX Security 2023 paper
Mar to Apr 2021	Three users report properly configured servers unreachable, two briefly	Net4People
Nov 6, 2021	Real-time blocking of fully encrypted traffic begins	USENIX Security 2023 paper
Jan 14, 2022	First countermeasure added to Shadowsocks-rust, V2Ray and Sagernet	USENIX Security 2023 paper
Oct 3, 2022	Large-scale blocking of TLS-based tools; researchers report blocking of multiple tools	GFW Report, Net4People
Feb 14, 2023	Countermeasures reportedly still effective	USENIX Security 2023 paper
Sep 29, 2024	Users report Shadowsocks servers on port 80 blocked	Net4People
2025 and 2026	User reports conflict; no new measurement found	See below

Shadowsocks in China in 2025 and 2026

The 2025 and 2026 sources we found are a research summary, forum posts and user reports, not new measurements, and they disagree.

• Research summary, May 2025. In a paper on regional censorship in Henan province, GFW Report and other researchers wrote that the firewall uses active probing against tools such as Tor and Shadowsocks, “which have been successfully defended against”. They added that it “also conducts traffic analysis to identify and block fully encrypted proxies”.
• Net4People, September 2025. A user preparing for a year in China listed Shadowsocks among protocols they considered “either fully obsolete or irreparably flawed” for their purposes. They added that it “might sometimes pass under certain conditions (region, timing, political agenda, clean IPs)”. NaiveProxy’s developer replied that “the protocol design itself is a poor indication of its survival in real world conditions”.
• Xray’s developer, September 2025. RPRX, who develops the rival Xray project, wrote on Net4People that Shadowsocks servers reached directly across the firewall had “almost disappeared” in China, because the firewall had long blacklisted traffic that looks fully random. He added that commercial services that pass traffic through relay servers still almost all used Shadowsocks (our translation).
• Mullvad, April 2026. Mullvad’s guide says the firewall blocks all Mullvad servers in Asia, and still lists Shadowsocks among the settings to try. See Mullvad Shadowsocks in China below.
• A Reddit claim, June 2026. A post on r/RecommandedVPN said an April 2026 crackdown left “Shadowsocks, V2Ray, standard WireGuard” failing “near-100%”. It cited no sources, and a reply said the post “only seems half-true”. Not confirmed.

What Reddit users say about Shadowsocks in China

Reddit users in 2025 and 2026 disagree about Shadowsocks in China. These are single users’ experiences, not tests:

• Is it over for China? (r/mullvadvpn, started September 20, 2026). One reply said Outline “basically runs shadowsocks which is fully blocked in china”. On September 23, another user wrote: “I often use outline and it works just fine.”
• Going to China, could I use my home server as a VPN? (r/selfhosted, July 5, 2026). One user said that on a trip about two years earlier, Shadowsocks “worked and was the fastest” but “had trouble with certain apps since its a proxy and not a traditional VPN”. Another said they had moved from OpenVPN to Shadowsocks, then to VLESS and VLESS REALITY, “as the GFW upgraded”.
• Shadowsocks china (r/mullvadvpn, October 7, 2025). The poster asked: “Did China just nerf shadowsocks?” A reply said “Shadowsocks is detected by GFW for a long time”, and that IP bans get aggressive “during sensitive time frames”.
• China ran its most coordinated VPN crackdown in years (r/RecommandedVPN, June 11, 2026): the unsourced claim above.

Shadowsocks-2022 and plugins

Shadowsocks-2022 is the 2022 edition of the protocol, set out in the project’s SIP022 specification. It improves on the AEAD edition of 2017 and “drops usage of obsolete cryptography”. The spec says:

• Replay protection is mandatory. Messages more than 30 seconds off the current time count as replays, and servers remember each connection’s random starting value, its salt, for 60 seconds to catch repeats. The 2020 paper recommended this kind of time-based replay filter.
• Servers give probes less to measure. Requests must carry data or random padding, and servers must not reveal how many bytes they read before closing a connection. The spec says this “defends against probes that send one byte at a time”.
• Traffic looks random. The spec says the traffic “is indistinguishable from a random byte stream” and can therefore get past censors “that rely on DPI” (deep packet inspection, which looks inside traffic). Random-looking traffic is what the firewall has blocked since November 2021, according to the 2023 paper. We found no research on how the firewall treats Shadowsocks-2022 in particular, so how it fares in China is not confirmed.

Shadowsocks-rust supports the 2022 ciphers. The older C version, shadowsocks-libev, spent years in bug-fix-only maintenance while new development went to shadowsocks-rust. It was modernized in September 2026 and has been renamed shadowsocks-c.

Plugins. Shadowsocks plugins, defined in SIP003, work much like Tor’s pluggable transports: a plugin runs alongside the client and the server and tunnels Shadowsocks traffic through another transport. Only one plugin can run at a time, and plugins carry TCP traffic only. The spec gives simple-obfs as an example and lists GoQuiet, Cloak, Kcptun and v2ray-plugin as “known good” plugins. Outline’s developer docs offer Shadowsocks over WebSockets “in case of blocking of ‘look-like-nothing’ protocols like Shadowsocks”.

We found no 2025 or 2026 measurement of any plugin in China. In September 2024, Net4People users reported Shadowsocks servers on port 80 blocked, two of them running over WebSocket.

For setup, follow the Shadowsocks documentation or the shadowsocks-rust project.

Mullvad Shadowsocks in China

Mullvad offers Shadowsocks as one of its anti-censorship settings, but 2025 and 2026 reports on it from China are mixed, and the October 2026 reports we found mention QUIC instead.

• What Mullvad offers. Mullvad added Shadowsocks obfuscation for its WireGuard connections in October 2024, first on desktop and Android. Its app had already used Shadowsocks for OpenVPN bridges since version 2019.2. At launch, Mullvad said that with default settings the app would switch to WireGuard over Shadowsocks after failing to reach a server three times, and that it knew of stability issues with Shadowsocks when switching networks.
• What Mullvad says about China. Its guide for restrictive locations, last updated April 22, 2026, says “the great firewall of China is blocking all Mullvad servers in Asia” and suggests US servers with its obfuscation methods. It lists five settings to try one at a time: WireGuard port, LWO, QUIC, Shadowsocks and UDP-over-TCP. Mullvad’s guide has the steps.
• What users report.
  • October 7, 2025: a user said their Malaysia server “Connects but dead internet” with Shadowsocks, and “Only UDP/TCP working for me tonight”.
  • January 29, 2026: a user said WireGuard obfuscation set to Shadowsocks “Worked well for me”.
  • April 8, 2026: a user on China Telecom Wi-Fi found QUIC and Shadowsocks with US servers “all very slow with very high ping”.
  • October 16, 2026: a user said Mullvad connected only after they switched to QUIC.

Whether Mullvad’s Shadowsocks setting works in China now is not confirmed. For Mullvad’s overall status this month, see which VPN works in China now.

Which VPNs for China use Shadowsocks?

Of the five VPNs below, only Mullvad offers Shadowsocks, according to their own pages. Astrill and NordVPN use their own obfuscated protocols, ExpressVPN hasn’t announced Shadowsocks support, and Surfshark dropped it in 2021.

VPN	Shadowsocks	What its own pages describe
Mullvad	Yes, as an obfuscation setting for WireGuard, since October 2024	Also LWO, QUIC and UDP-over-TCP
Astrill	Not mentioned on its protocol page, FAQ or September 2026 guide	StealthVPN, “inspired by OpenVPN” with extra obfuscation, and OpenWeb, a TCP-based protocol whose traffic “looks like regular website browsing”. Its iOS app only switches between UDP and TCP
ExpressVPN	Not announced	Its China page, updated February 4, 2026, lists protocols to try in order on Windows, Mac, iOS and Linux: Automatic, Lightway UDP, Lightway TCP, WireGuard and OpenVPN. For Android it lists Automatic and Lightway TCP
NordVPN	No help-center article mentions it	NordWhisper, which makes VPN traffic “resemble regular web traffic”. Its Obfuscated servers moved to NordWhisper from May 2026
Surfshark	Dropped on November 11, 2021	OpenVPN on obfuscated servers, WireGuard, IKEv2 and its own Dausos protocol

Surfshark said only 0.5% of its users used Shadowsocks, and that most of them would “get a better connection” with OpenVPN or WireGuard.

In March 2026, TechRadar found inactive Shadowsocks code in ExpressVPN’s Windows app, version 12.201.0, with a server flag for Shadowsocks set to false at every location it looked at. ExpressVPN’s COO told TechRadar the company had no “specific feature announcements to share regarding Shadowsocks support”.

Shadowsocks vs V2Ray in China

No source we found compares Shadowsocks and V2Ray head to head in China in 2026, and the two overlap: V2Ray is a platform that can run Shadowsocks itself.

• What V2Ray is. V2Ray’s project site says it supports “Socks, HTTP, Shadowsocks, Trojan, Vmess, VLESS, and more”, each with its own transport such as TCP, mKCP, QUIC, gRPC or WebSocket. It says V2Ray nodes “can masquerade as normal websites (HTTPS)”.
• Both have been blocked. The November 2021 blocking hit Shadowsocks and VMess, both fully encrypted protocols (USENIX Security 2023). From October 3, 2022, more than 100 users reported servers blocked for TLS-based tools, which wrap traffic in the encryption HTTPS websites use. They included Trojan, Xray, V2Ray TLS+WebSocket, VLESS and gRPC. GFW Report suspected the clients’ TLS fingerprints.
• Users’ choices. On Reddit, a user who runs their own server described moving from Shadowsocks to VLESS with REALITY (July 2026), and an October 2025 reply suggested V2Ray with VLESS instead of Shadowsocks. These are personal accounts, not tests.

Our best VPN protocol for China guide compares the protocols side by side.

Shadowsocks server for China

A Shadowsocks server for China runs outside the mainland, and in the research and reports we found, most blocked servers sat in the data centers of popular VPS providers, which rent out virtual servers.

• Where blocking lands. The 2021 blocking applied only to IP ranges of popular data centers, and all the affected networks the 2023 paper names are popular VPS providers. The 2020 paper notes that Shadowsocks servers “are usually dedicated solely to circumvention”, so blocking a whole server costs the censor little.
• Routes and latency. In our ping measurements from 29 cities on October 13, 2026, the Chinese carrier mattered as much as the distance. See ping to China for the results and our guide to CN2 GIA, China Telecom’s premium route.
• Host rules. Our CN2 GIA VPS comparison lists each host’s rules on proxies and VPN tunnels.
• Setup. Use the official instructions from Outline, whose server runs Shadowsocks, or from the Shadowsocks project.

Before you run a server for yourself or share one with others, read what the law says about VPNs in China.