Back to Guides

Shadowsocks and Mullvad VPN

Shadowsocks is an open-source proxy project intended to circumvent internet censorship. It is high performing and has support for new ciphers.

Shadowsocks is available for Windows, Linux, and OS X. It exists on ports 443, 1234, 1235, 1236.

In this guide, we take you through the steps to use Shadowsocks to connect to Mullvad's VPN servers.

Note: Mullvad has not performed an audit of Shadowsocks. Downloading software via an untrusted third party could potentially mean acquiring unwanted malware, adware, and/or backdoors.

Installing Shadowsocks

Install Shadowsocks for your operating system.

Linux (Debian 9 / Ubuntu 16.10)
sudo apt-get install shadowsocks-libev

Linux (Debian 8 / Ubuntu 16.04)
sudo sh -c 'printf "deb http://httpredir.debian.org/debian jessie-backports main" > /etc/apt/sources.list.d/jessie-backports.list'
sudo apt update
sudo apt -t jessie-backports install shadowsocks-libev

macOS
/usr/bin/ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)"
brew install shadowsocks-libev

Windows (64 bit)

On the Github page for shadowsocks-qt5 releases, download the 7-Zip file (file ending in .7z) that corresponds to the latest release.

You'll need to download and install a 7-Zip file archiver to unpack it.

Android

Install Shadowsocks from the play store.

 

Running Shadowsocks

In the instructions below, replace "185.65.134.66" (nl1-bridge.mullvad.net)  with the bridge server you'd like to connect to. See our list of bridge servers.

Linux
ss-local -s 185.65.134.66 -p 443 -l 1080 -k 23#dfsbbb -m chacha20

macOS
ss-local -s 185.65.134.66 -p 443 -l 1080 -k 23#dfsbbb -m chacha20

Windows

Run the file ss-qt5.exe that was extracted from the 7-Zip file you downloaded.

Add the Mullvad bridge profile either manually or by scanning a QR code.

To manually add the profile:

  1. Click on Connection Add Manually
  2. Profile name: Mullvad
  3. Server Address: 185.65.134.66
  4. Server port: 443
  5. Password: 23#dfsbbb
  6. Local Address: 127.0.0.1
  7. Local Port: 1080
  8. Local server type: SOCKS5
  9. Encryption Method: CHACHA20

To use the QR code:

  1. Scan the following for se1-bridge.mullvad.net:
  2. Save the QR code to your computer.
  3. Click on Connection → Add → From QR Code Image file, then select the QR code you downloaded.
  4. After you have scanned the QR code right-click the profile and select Connect to establish a connection.

 

Android

In Shadowsocks

  1. Click on the Hamburger menu
  2. Click on Settings
  3. Click on Service mode and change it to Proxy only
  4. Click on back button
  5. Click on the + to add a profile
  6. Select Manual Settings
  7. Change Server to one of our bridge servers IP-address (list here: https://mullvad.net/servers/#bridge)
  8. Change the Remote port to 443
  9. Change the Password to 23#dfsbbb
  10. Change Encrypt Method to CHACHA20
  11. Click on the Checkmark to save

In OpenVPN for Android

  1. Edit the VPN profile
  2. Click on ALLOWED APPS
  3. Ensure that "VPN is used for all apps but exclude selected" is enabled
  4. Scroll down and and enable Shadowsocks  (Check)
  5. Paste the OpenVPN Configuration options found below

 

Configuring OpenVPN to use Shadowsocks

 

Follow these instructions if you do not run the Mullvad client.

Don't have OpenVPN installed?
First, follow our guides on how to install OpenVPN for your Operating system:

Be sure to download the configuration for port 443.

Open your OpenVPN configuration file
After you have installed OpenVPN, edit the OpenVPN configuration file for your operating system:

  • Windows: mullvad_windows.conf.ovpn
  • Linux: mullvad_linux.conf
  • OSX: mullvad_osx.conf  (found inside the OSX subdirectory and then Mullvad.tblk/).
  • Android: Edit the VPN profile, then click on Advanced and then enable "Enable Custom Options" and then click on Custom Options
    and paste the following into it:

Edit the OpenVPN configuration file
Add the following to the file
socks-proxy 127.0.0.1 1080
route 193.138.218.71 255.255.255.255 net_gateway
route 185.213.152.66 255.255.255.255 net_gateway
route 91.90.44.10 255.255.255.255 net_gateway
route 185.65.134.66 255.255.255.255 net_gateway
route 185.236.200.82 255.255.255.255 net_gateway
route 209.58.185.59 255.255.255.255 net_gateway

 

You're all set!