How to Set Up Your Own Shadowsocks VPN with Outline

Why Outline and Shadowsocks

Shadowsocks is a lightweight encrypted proxy built, from the start, to be hard to detect. Instead of the recognisable handshakes that give WireGuard or OpenVPN away, it scrambles your traffic into a stream of random-looking bytes with no tell-tale signatures for deep packet inspection (DPI) to latch onto - which is why it has long been a go-to tool for getting past national firewalls in heavily censored countries around the world. (The most advanced firewalls can still learn to spot that randomness over time - the honest limit we cover at the end.)

Outline, made by Jigsaw (a Google subsidiary), turns Shadowsocks into something anyone can run. It is two free, open-source apps: the Outline Manager, which sets up and runs the server on your own VPS for you, and the Outline Client, which connects. You own the server, you own the keys, and no company sits in the middle logging your traffic - you only pay for a cheap VPS.

• A cheap VPS with an x86-64 CPU, at least 1 GB RAM, running a modern Linux such as Ubuntu 22.04 / 24.04. To bypass censorship, host it outside the country doing the blocking.
• The server's IP address and its root SSH access - your provider emails these after you pay.
• A computer (Windows, macOS or Linux) to run the Outline Manager. The one-time setup is done from a computer, not a phone - after that you can connect from a phone alone. Plus about 10 minutes.

Step 1: Install the Outline Manager

On your computer, download the Outline Manager from the official site, getoutline.org, and install it. It runs on Windows, macOS and Linux. This is the admin tool - you use it once to set up the server and later to add or revoke access keys.

Step 2: Set up the server on your VPS

Open the Outline Manager and choose Set up Outline anywhere (not the built-in cloud options). The Manager shows you a single command to copy. SSH into your server and paste it there - it downloads and runs the official installer (in a Docker container) and prints a line of configuration:

sudo bash -c "$(wget -qO- https://raw.githubusercontent.com/Jigsaw-Code/outline-server/master/src/server_manager/install_scripts/install_server.sh)"

Always use the exact command the Manager displays. When it finishes, the server prints a green line that starts with {"apiUrl": ...}. Copy that whole line, paste it back into the Outline Manager, and click through - your server appears in the Manager, ready to use. (If the command fails with wget: command not found, some minimal images ship without it - run apt update && apt install -y wget first, then paste the command again.)

Step 3: Create an access key

In the Outline Manager, your server now has a default access key. Click Add new key to make one per device (a phone, a laptop, a friend), then use Share to copy the key - it is a short ss:// link that contains everything a client needs.

Treat each key like a password: everyone who has it shares your server's bandwidth, and you can revoke any single key at any time without disturbing the others.

Step 4: Install the Outline Client and connect

Install the Outline Client on the device, then add the ss:// key. Pick your platform:

Step 5: Add more devices and manage keys

Give every device and every person their own key. In the Outline Manager you can see how much data each key has used, rename them, and remove a key the moment a device is lost or a friend no longer needs access - the rest keep working. This is the big advantage of self-hosting: you are the administrator.

Step 6: Verify it works

With Outline connected, confirm two things on our own Network tools page. First, the internet should now show your server's IP - shown at the top of the page. Second, open the DNS Leak Test tab: the resolvers listed should not belong to your home ISP. If both look right, your Outline tunnel is live.

Common mistakes

• Cloud provider firewall. On AWS, Oracle Cloud, Azure or Google Cloud the ports are closed by default in the web panel. Open the management and access-key ports the installer printed (the access-key port for both TCP and UDP), not just on the server itself.
• Server clock out of sync. Shadowsocks rejects connections whose timestamps drift too far, so if your keys are correct but nothing connects, check the server's time. Run timedatectl and make sure the clock is NTP synchronised.
• Blocked hosting IP ranges. The strictest firewalls ban whole IP ranges of the biggest budget hosts. If a brand-new server is blocked from day one, try a smaller, less obvious provider.
• Server inside the censored network. A VPS physically in the country doing the blocking can be blocked at the source. Host it abroad.
• Sharing one key everywhere. Reusing a single key across many devices makes it impossible to revoke just one. Create a separate key per device.
• Very cheap OpenVZ plans. Outline runs in Docker, which needs a proper (KVM) VPS. Avoid the cheapest OpenVZ containers.
• Blocked by advanced DPI. Shadowsocks is strong, but the most aggressive firewalls can still learn to spot it over time. If it stops working, a protocol that mimics a real website - like VLESS + Reality - is the next step up.

The honest limits

Shadowsocks hides that you are using a proxy from network censors, but the usual limits of self-hosting still apply: your provider can see the IP addresses connecting to the server and, on a VPS, can snapshot its RAM. To cut down what your own server keeps on disk, follow up with our guide on how to make your VPS keep no logs. And as always, a VPN or proxy changes where your traffic appears to come from - it does not put you above the law of wherever you live.