# ShadowsocksR Obfuscation Methods and Plugins: Complete Configuration Guide

> Master ShadowsocksR obfuscation methods and plugins. Configure simple-obfs and v2ray-plugin to disguise proxy traffic effectively. Your complete guide.

- Repository: [如何翻墙/fanqiang](https://github.com/bannedbook/fanqiang)
- Tags: how-to-guide
- Published: 2026-08-10

---

**ShadowsocksR (SSR) extends the original Shadowsocks protocol with plugin-based obfuscation that disguises proxy traffic via external binaries like `simple-obfs` and `v2ray-plugin`, configured through `plugin` and `plugin_opts` fields.**

The `bannedbook/fanqiang` repository documents how ShadowsocksR obfuscation methods and plugins transform encrypted traffic to evade deep-packet inspection (DPI). Unlike standard Shadowsocks, SSR delegates traffic masking to external executables that run as subprocesses, making the architecture modular across Windows, Android, macOS, and OpenWrt platforms.

## How the SSR Plugin Architecture Works

SSR implements a three-layer design that decouples encryption from obfuscation:

- **Core SSR client** – Handles the encrypted SOCKS5 proxy traffic and parses the extended SSR URL schema.
- **Obfuscation plugins** – External executables or libraries (such as `obfs-local`) that transform the outbound data stream before it reaches the network interface.
- **Server-side support** – The remote ShadowsocksR server must mirror the obfuscation configuration (e.g., `obfs=http` and `obfs-host=example.com`) to decode the traffic correctly.

When the SSR client initiates a connection, it launches the plugin as a subprocess and pipes the encrypted traffic through it. This subprocess model means new plugins can be added without modifying the core client code.

## Available Obfuscation Plugins

The `bannedbook/fanqiang` repository bundles and documents several well-known plugins across different platforms.

### simple-obfs (obfs-local)

The `simple-obfs` plugin (executable name `obfs-local`) is documented in [[`fqnews/plugin/doc.md`](https://github.com/bannedbook/fanqiang/blob/main/fqnews/plugin/doc.md)](https://github.com/bannedbook/fanqiang/blob/master/fqnews/plugin/doc.md). It supports Android, Linux, and macOS platforms and provides basic HTTP and TLS camouflage.

Accepted `plugin_opts` parameters:
- `obfs`: Either `http` or `tls`
- `obfs-host`: The target hostname to mimic (e.g., `www.bing.com`)

### v2ray-plugin

The `v2ray-plugin` (Windows executable `v2ray.exe` or `v2ray-plugin` on other platforms) is detailed in [[`ss_v2ray.md`](https://github.com/bannedbook/fanqiang/blob/main/ss_v2ray.md)](https://github.com/bannedbook/fanqiang/blob/master/ss_v2ray.md). It supports Windows and Android, offering WebSocket and HTTP tunneling modes.

Accepted `plugin_opts` parameters:
- `mode`: `websocket` or `http`
- `host`: The camouflage domain

### SSR-Plus+ for OpenWrt

For router deployments, [[`router/OpenWrt.md`](https://github.com/bannedbook/fanqiang/blob/main/router/OpenWrt.md)](https://github.com/bannedbook/fanqiang/blob/master/router/OpenWrt.md) describes SSR-Plus+, an integrated LuCI application that bundles obfuscation plugins directly into the OpenWrt firmware. The package name is `ssr-plus` and it handles plugin management internally without requiring separate binary downloads.

## Configuration Schema and Parameters

SSR standardizes obfuscation configuration via two key fields: `plugin` specifies the executable name, while `plugin_opts` passes semicolon-separated key-value pairs to that executable.

### JSON Configuration Structure

When adding a server in any SSR client, the configuration stores a JSON snippet:

```json
{
  "server": "example.com",
  "server_port": 443,
  "password": "myPassword",
  "method": "aes-256-gcm",
  "obfs": "http",
  "obfs_param": "www.bing.com",
  "plugin": "obfs-local",
  "plugin_opts": "obfs=http;obfs-host=www.bing.com"
}

```

The `obfs` and `obfs_param` fields are legacy SSR protocol parameters, while `plugin` and `plugin_opts` are used by the newer plugin subsystem. For compatibility, clients like Android SSR and Windows SSR synchronize these values automatically.

### Platform-Specific Implementation

- **Windows**: The [[`windows/ShadowsocksR.md`](https://github.com/bannedbook/fanqiang/blob/main/windows/ShadowsocksR.md)](https://github.com/bannedbook/fanqiang/blob/master/windows/ShadowsocksR.md) guide instructs users to place `obfs-local.exe` in the client directory and configure via the "服务器订阅" (Server Subscription) panel.
- **Android**: According to [[`android/ShadowsocksR.md`](https://github.com/bannedbook/fanqiang/blob/main/android/ShadowsocksR.md)](https://github.com/bannedbook/fanqiang/blob/master/android/ShadowsocksR.md), the Android client bundles `simple-obfs` natively and can download `v2ray-plugin-Android` from the releases page. Users configure obfuscation in the per-server settings panel.
- **macOS**: The [[`macos/ClashX.md`](https://github.com/bannedbook/fanqiang/blob/main/macos/ClashX.md)](https://github.com/bannedbook/fanqiang/blob/master/macos/ClashX.md) documentation shows that ClashX supports both `simple-obfs` and `v2ray-plugin` within its Shadowsocks profile configuration.

## Common SSR Obfuscation Methods

SSR supports multiple obfuscation strategies, each targeting different DPI techniques:

- **plain** – No obfuscation; raw SSR traffic (default).
- **http_simple** – Wraps traffic in minimal HTTP-like headers; effective against basic DPI.
- **http_post** – Sends data as HTTP POST payloads; harder to fingerprint than GET requests.
- **tls1.2_ticket_auth** – Simulates TLS 1.2 handshake with session tickets; appears as standard HTTPS traffic to network monitors.
- **v2ray-plugin (websocket)** – Uses WebSocket framing over port 80/443; blends with normal web traffic.
- **v2ray-plugin (http)** – Uses plain HTTP tunneling; similar behavioral signature to `http_simple`.

The `obfs` field in legacy SSR configuration maps to these methods, while modern plugin-based implementations translate them into the appropriate `plugin_opts` strings automatically.

## Practical Configuration Examples

Below are three runnable configurations demonstrating how to enable ShadowsocksR obfuscation methods and plugins across different clients.

### Windows SSR Command Line

For scripted launches on Windows, ensure `obfs-local.exe` resides in the same directory as `ShadowsocksR.exe`:

```bash

# Launch with obfs-local plugin via command line

ShadowsocksR.exe -c config.json -p obfs-local -o "obfs=http;obfs-host=www.bing.com"

```

### Android SSR JSON Entry

This JSON can be imported via QR code or subscription link in the Android client:

```json
{
  "server": "us.example.com",
  "server_port": 443,
  "password": "StrongPass",
  "method": "aes-256-gcm",
  "obfs": "http",
  "obfs_param": "www.bing.com",
  "plugin": "obfs-local",
  "plugin_opts": "obfs=http;obfs-host=www.bing.com"
}

```

### ClashX (macOS) YAML Profile

For ClashX users on macOS, define the node with plugin options in the configuration YAML:

```yaml
- name: "SSR-US-obfs"
  type: ss
  server: us.example.com
  port: 443
  cipher: aes-256-gcm
  password: StrongPass
  plugin: simple-obfs
  plugin-opts:
    mode: http
    host: www.bing.com

```

## Summary

- SSR obfuscation is **plugin-centric**: the core client launches external binaries (`obfs-local`, `v2ray-plugin`) as subprocesses to transform traffic.
- Configuration is standardized via `plugin` and `plugin_opts` fields, enabling single subscription URLs to work across Windows, Android, macOS, and OpenWrt.
- The `bannedbook/fanqiang` repository provides platform-specific guides in [`windows/ShadowsocksR.md`](https://github.com/bannedbook/fanqiang/blob/main/windows/ShadowsocksR.md), [`android/ShadowsocksR.md`](https://github.com/bannedbook/fanqiang/blob/main/android/ShadowsocksR.md), and [`router/OpenWrt.md`](https://github.com/bannedbook/fanqiang/blob/main/router/OpenWrt.md).
- Common methods include `http_simple`, `tls1.2_ticket_auth`, and WebSocket tunneling via `v2ray-plugin`.

## Frequently Asked Questions

### What is the difference between simple-obfs and v2ray-plugin?

**`simple-obfs`** (provided by `obfs-local`) performs lightweight HTTP or TLS header camouflage suitable for evading basic DPI. **`v2ray-plugin`** implements the full V2Ray protocol stack, supporting WebSocket and HTTP/2 transport layers that offer stronger resistance against advanced traffic analysis but require more server-side resources. According to [[`fqnews/plugin/doc.md`](https://github.com/bannedbook/fanqiang/blob/main/fqnews/plugin/doc.md)](https://github.com/bannedbook/fanqiang/blob/master/fqnews/plugin/doc.md), `simple-obfs` is preferred for mobile devices due to lower battery consumption, while `v2ray-plugin` is recommended for desktop environments requiring maximum obfuscation.

### How do I configure obfuscation on Android SSR?

Open the Android SSR application, tap the server configuration, and locate the **Obfuscation** section. Select `simple-obfs` from the plugin dropdown, then enter `obfs=http;obfs-host=www.bing.com` in the options field. As documented in [[`android/ShadowsocksR.md`](https://github.com/bannedbook/fanqiang/blob/main/android/ShadowsocksR.md)](https://github.com/bannedbook/fanqiang/blob/master/android/ShadowsocksR.md), the Android client automatically downloads the `v2ray-plugin-Android` binary if you specify it in the plugin field, eliminating manual installation steps.

### Why is my obfuscation failing to connect?

The most common failure mode is a mismatch between client and server configurations. Both sides must use identical `obfs` methods (e.g., `http_simple`) and matching `obfs-host` parameters. Additionally, verify that the plugin binary exists in the client's working directory—for Windows, ensure `obfs-local.exe` is present alongside `ShadowsocksR.exe` as noted in [[`windows/ShadowsocksR.md`](https://github.com/bannedbook/fanqiang/blob/main/windows/ShadowsocksR.md)](https://github.com/bannedbook/fanqiang/blob/master/windows/ShadowsocksR.md).

### Which obfuscation method works best against DPI?

**`tls1.2_ticket_auth`** (via `obfs-local` with `obfs=tls`) and **`v2ray-plugin`** in WebSocket mode offer the strongest resistance against deep-packet inspection. The TLS method mimics genuine HTTPS handshakes, while WebSocket traffic blends with legitimate web application traffic on ports 80 and 443. For OpenWrt routers, the SSR-Plus+ package documented in [[`router/OpenWrt.md`](https://github.com/bannedbook/fanqiang/blob/main/router/OpenWrt.md)](https://github.com/bannedbook/fanqiang/blob/master/router/OpenWrt.md) automatically selects optimal methods based on connection stability metrics.