ShadowsocksR — mihomo

mihomo includes a ShadowsocksR client outbound. Outbound only; no SSR inbound type exists.

Outbound

Entry under proxies: with type: ssr. Embeds BasicOption.

Field	Type	Default	Allowed values	Description
name	string	(required)	<string>	Unique proxy name.
server	string	(required)	<host>	Upstream server hostname or IP.
port	int	(required)	<port>	Upstream server port.
password	string	(required)	<string>	Server password.
cipher	string	(required)	aes-256-cfb | aes-128-ctr | chacha20-ietf | rc4-md5 | <other SSR ciphers>	SSR cipher. mihomo's name for `method`.
obfs	string	(required)	plain | http_simple | http_post | random_head | tls1.2_ticket_auth	Obfuscation plugin.
obfs-param	string	(unset)	<string>	Obfs parameter (Host header for HTTP-style obfs).
protocol	string	(required)	origin | auth_aes128_md5 | auth_aes128_sha1 | auth_sha1_v4 | auth_chain_a | auth_chain_b	Protocol-layer plugin.
protocol-param	string	(unset)	<string>	Protocol-layer parameter.
udp	bool	false	true | false	Allow UDP packets to be relayed through this outbound.

Source: adapter/outbound/shadowsocksr.go:28-40 · pinned at v1.19.27 (5184081)

Examples

Plain SSR with chained auth:

proxies:
  - name: ssr-server
    type: ssr
    server: example.com
    port: 443
    password: <password>
    cipher: aes-256-cfb
    obfs: http_simple
    obfs-param: www.bing.com
    protocol: auth_chain_a
    protocol-param: "32"
    udp: true

TLS-ticket obfs:

proxies:
  - name: ssr-tls
    type: ssr
    server: example.com
    port: 443
    password: <password>
    cipher: chacha20-ietf
    obfs: tls1.2_ticket_auth
    obfs-param: www.bing.com
    protocol: auth_chain_b
    udp: true

Notes

• SSR is legacy. Prefer the Shadowsocks AEAD / 2022 ciphers for new deployments — they have better forward secrecy and no known DPI distinguishers.
• obfs and protocol are required fields in the YAML — even if you want the plain pass-through behavior, set them explicitly to plain and origin.
• UDP relay (udp: true) interoperates with the original ShadowsocksR reference implementation but not with the libev fork that drops UDP-over-protocol-plugin combinations.

Cross-core notes

• Xray-core does not support SSR. See SSR — Xray-core.
• sing-box uses method (not cipher) and snake_case for the parameter fields (obfs_param, protocol_param). See SSR — sing-box.

Source: adapter/outbound/shadowsocksr.go:28-40 · v1.19.27 (5184081)