ShadowsocksR Obfuscation Methods and Plugins: Complete Configuration Guide

ShadowsocksR (SSR) extends the original Shadowsocks protocol with plugin-based obfuscation that disguises proxy traffic via external binaries like simple-obfs and v2ray-plugin, configured through plugin and plugin_opts fields.

The bannedbook/fanqiang repository documents how ShadowsocksR obfuscation methods and plugins transform encrypted traffic to evade deep-packet inspection (DPI). Unlike standard Shadowsocks, SSR delegates traffic masking to external executables that run as subprocesses, making the architecture modular across Windows, Android, macOS, and OpenWrt platforms.

How the SSR Plugin Architecture Works

SSR implements a three-layer design that decouples encryption from obfuscation:

• Core SSR client – Handles the encrypted SOCKS5 proxy traffic and parses the extended SSR URL schema.
• Obfuscation plugins – External executables or libraries (such as obfs-local) that transform the outbound data stream before it reaches the network interface.
• Server-side support – The remote ShadowsocksR server must mirror the obfuscation configuration (e.g., obfs=http and obfs-host=example.com) to decode the traffic correctly.

When the SSR client initiates a connection, it launches the plugin as a subprocess and pipes the encrypted traffic through it. This subprocess model means new plugins can be added without modifying the core client code.

Available Obfuscation Plugins

The bannedbook/fanqiang repository bundles and documents several well-known plugins across different platforms.

simple-obfs (obfs-local)

The simple-obfs plugin (executable name obfs-local) is documented in [fqnews/plugin/doc.md](https://github.com/bannedbook/fanqiang/blob/master/fqnews/plugin/doc.md). It supports Android, Linux, and macOS platforms and provides basic HTTP and TLS camouflage.

Accepted plugin_opts parameters:

• obfs: Either http or tls
• obfs-host: The target hostname to mimic (e.g., www.bing.com)

v2ray-plugin

The v2ray-plugin (Windows executable v2ray.exe or v2ray-plugin on other platforms) is detailed in [ss_v2ray.md](https://github.com/bannedbook/fanqiang/blob/master/ss_v2ray.md). It supports Windows and Android, offering WebSocket and HTTP tunneling modes.

Accepted plugin_opts parameters:

• mode: websocket or http
• host: The camouflage domain

SSR-Plus+ for OpenWrt

For router deployments, [router/OpenWrt.md](https://github.com/bannedbook/fanqiang/blob/master/router/OpenWrt.md) describes SSR-Plus+, an integrated LuCI application that bundles obfuscation plugins directly into the OpenWrt firmware. The package name is ssr-plus and it handles plugin management internally without requiring separate binary downloads.

Configuration Schema and Parameters

SSR standardizes obfuscation configuration via two key fields: plugin specifies the executable name, while plugin_opts passes semicolon-separated key-value pairs to that executable.

JSON Configuration Structure

When adding a server in any SSR client, the configuration stores a JSON snippet:

{
  "server": "example.com",
  "server_port": 443,
  "password": "myPassword",
  "method": "aes-256-gcm",
  "obfs": "http",
  "obfs_param": "www.bing.com",
  "plugin": "obfs-local",
  "plugin_opts": "obfs=http;obfs-host=www.bing.com"
}

The obfs and obfs_param fields are legacy SSR protocol parameters, while plugin and plugin_opts are used by the newer plugin subsystem. For compatibility, clients like Android SSR and Windows SSR synchronize these values automatically.

Platform-Specific Implementation

• Windows: The [windows/ShadowsocksR.md](https://github.com/bannedbook/fanqiang/blob/master/windows/ShadowsocksR.md) guide instructs users to place obfs-local.exe in the client directory and configure via the "服务器订阅" (Server Subscription) panel.
• Android: According to [android/ShadowsocksR.md](https://github.com/bannedbook/fanqiang/blob/master/android/ShadowsocksR.md), the Android client bundles simple-obfs natively and can download v2ray-plugin-Android from the releases page. Users configure obfuscation in the per-server settings panel.
• macOS: The [macos/ClashX.md](https://github.com/bannedbook/fanqiang/blob/master/macos/ClashX.md) documentation shows that ClashX supports both simple-obfs and v2ray-plugin within its Shadowsocks profile configuration.

Common SSR Obfuscation Methods

SSR supports multiple obfuscation strategies, each targeting different DPI techniques:

• plain – No obfuscation; raw SSR traffic (default).
• http_simple – Wraps traffic in minimal HTTP-like headers; effective against basic DPI.
• http_post – Sends data as HTTP POST payloads; harder to fingerprint than GET requests.
• tls1.2_ticket_auth – Simulates TLS 1.2 handshake with session tickets; appears as standard HTTPS traffic to network monitors.
• v2ray-plugin (websocket) – Uses WebSocket framing over port 80/443; blends with normal web traffic.
• v2ray-plugin (http) – Uses plain HTTP tunneling; similar behavioral signature to http_simple.

The obfs field in legacy SSR configuration maps to these methods, while modern plugin-based implementations translate them into the appropriate plugin_opts strings automatically.

Practical Configuration Examples

Below are three runnable configurations demonstrating how to enable ShadowsocksR obfuscation methods and plugins across different clients.

Windows SSR Command Line

For scripted launches on Windows, ensure obfs-local.exe resides in the same directory as ShadowsocksR.exe:

# Launch with obfs-local plugin via command line

ShadowsocksR.exe -c config.json -p obfs-local -o "obfs=http;obfs-host=www.bing.com"

Android SSR JSON Entry

This JSON can be imported via QR code or subscription link in the Android client:

{
  "server": "us.example.com",
  "server_port": 443,
  "password": "StrongPass",
  "method": "aes-256-gcm",
  "obfs": "http",
  "obfs_param": "www.bing.com",
  "plugin": "obfs-local",
  "plugin_opts": "obfs=http;obfs-host=www.bing.com"
}

ClashX (macOS) YAML Profile

For ClashX users on macOS, define the node with plugin options in the configuration YAML:

- name: "SSR-US-obfs"
  type: ss
  server: us.example.com
  port: 443
  cipher: aes-256-gcm
  password: StrongPass
  plugin: simple-obfs
  plugin-opts:
    mode: http
    host: www.bing.com

Summary

• SSR obfuscation is plugin-centric: the core client launches external binaries (obfs-local, v2ray-plugin) as subprocesses to transform traffic.
• Configuration is standardized via plugin and plugin_opts fields, enabling single subscription URLs to work across Windows, Android, macOS, and OpenWrt.
• The bannedbook/fanqiang repository provides platform-specific guides in windows/ShadowsocksR.md, android/ShadowsocksR.md, and router/OpenWrt.md.
• Common methods include http_simple, tls1.2_ticket_auth, and WebSocket tunneling via v2ray-plugin.

Frequently Asked Questions

What is the difference between simple-obfs and v2ray-plugin?

simple-obfs (provided by obfs-local) performs lightweight HTTP or TLS header camouflage suitable for evading basic DPI. v2ray-plugin implements the full V2Ray protocol stack, supporting WebSocket and HTTP/2 transport layers that offer stronger resistance against advanced traffic analysis but require more server-side resources. According to [fqnews/plugin/doc.md](https://github.com/bannedbook/fanqiang/blob/master/fqnews/plugin/doc.md), simple-obfs is preferred for mobile devices due to lower battery consumption, while v2ray-plugin is recommended for desktop environments requiring maximum obfuscation.

How do I configure obfuscation on Android SSR?

Open the Android SSR application, tap the server configuration, and locate the Obfuscation section. Select simple-obfs from the plugin dropdown, then enter obfs=http;obfs-host=www.bing.com in the options field. As documented in [android/ShadowsocksR.md](https://github.com/bannedbook/fanqiang/blob/master/android/ShadowsocksR.md), the Android client automatically downloads the v2ray-plugin-Android binary if you specify it in the plugin field, eliminating manual installation steps.

Why is my obfuscation failing to connect?

The most common failure mode is a mismatch between client and server configurations. Both sides must use identical obfs methods (e.g., http_simple) and matching obfs-host parameters. Additionally, verify that the plugin binary exists in the client's working directory—for Windows, ensure obfs-local.exe is present alongside ShadowsocksR.exe as noted in [windows/ShadowsocksR.md](https://github.com/bannedbook/fanqiang/blob/master/windows/ShadowsocksR.md).

Which obfuscation method works best against DPI?

tls1.2_ticket_auth (via obfs-local with obfs=tls) and v2ray-plugin in WebSocket mode offer the strongest resistance against deep-packet inspection. The TLS method mimics genuine HTTPS handshakes, while WebSocket traffic blends with legitimate web application traffic on ports 80 and 443. For OpenWrt routers, the SSR-Plus+ package documented in [router/OpenWrt.md](https://github.com/bannedbook/fanqiang/blob/master/router/OpenWrt.md) automatically selects optimal methods based on connection stability metrics.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}