I've a web site (HTTPS) only allow authenticated users to access. Currently in the web server I grant access allow connection from a VPN gateway.

So all users need to connect to this gateway in order to access the web site.

I found that Shadowsocks can serve as the same purpose. Given my user case above, do you think it is secure enough for replace my current VPN gateway with Shadowsocks server? (Since it is much more easy to use Shadowsocks clients on mobile devices)

2 Answers 2


Short answer is no. Purpose of shadowsocks is to obfuscate traffic so that Chinese GFW cannot recognize the pattern to bypass it. It is not designed for security purpose. In fact from security perspective, it is poorly designed.


Outline VPN made by Google Jigsaw encapsulates Shadowsock as a VPN-like wrapper to send all your traffic through a server running the same protocol.

Although not designed for security purposes, Shadowsocks has the benefit of being far more lightweight than OpenVPN, and it is much more optimized for mobile devices, as it does not require any keep-alive connections. It has existed since 2012 and is widely used in China due to its censorship-resistant purposes: It is very difficult or impossible to detect and block Shadowsocks traffic automatically although recently there were more and more reports that China has managed to detect and block Shadowsocks traffic intensively(https://github.com/net4people/bbs/issues/22).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .