Protocols

Moved here from the README ｜ Wiki home ｜ 中文

Snell

Snell is a lightweight encrypted proxy protocol designed by the Surge team, balancing privacy and performance through a deliberately minimal protocol design. It is supported by the Surge client only.

Snell v4 / v5 / v6

Feature	Snell v4	Snell v5	Snell v6 (RC)
Status	Stable	Stable	Pre-release (rc2)
QUIC Proxy	No	Yes	Removed
Dynamic Record Sizing	No	Yes	Yes
Egress control (egress-interface)	No	Yes	Yes
Deployment-level protocol diversity	No	No	Yes (PSK-derived)
Cipher mode	No	No	default / unshaped / unsafe-raw
obfs	http	http	Removed
Address-family control	ipv6	ipv6	Adds dns-ip-preference; this project uses it on v6
Multi-address listen	No	No	Yes (comma-separated listen)
Official armv7l build	Yes	Yes	No

Recommendation: choose v5 for stability (a v5 server also serves v4 clients), v6 if you want the newest features, and v4 / v5 for older or armv7 devices.

Client config format

# v4 / v5
HK = snell, 1.2.3.4, 6160, psk = your_psk, version = 5, reuse = true, tfo = true

# v6: mode must match the server
HK = snell, 1.2.3.4, 6160, psk = your_psk, version = 6, mode = default, reuse = true, tfo = true

Snell v6-only options

The scripts prompt for both options when installing or upgrading to v6; Docker sets them through environment variables.

mode (transport mode)

Server and client must match exactly, or the connection fails.

Value	Behaviour	When to use
default	Traffic obfuscation + AES encryption	Recommended default. Strongest fingerprint camouflage and blocking resistance
unshaped	No obfuscation, AES encryption only	~10% higher throughput than default. Use on clean links, when speed matters most, or when ShadowTLS already provides camouflage
unsafe-raw	Plaintext forwarding, no encryption	⚠️ Traffic can be fully reconstructed — never use on the public internet. Local or trusted links only

dns-ip-preference (DNS address-family preference)

Controls which address family the server prefers after resolving a destination hostname. Unrelated to the listen address.

Value	Behaviour	When to use
default	Follow system default resolution	Recommended default, fits most VPSes
prefer-ipv4	Prefer IPv4, fall back to IPv6	Poor IPv6 egress, or destinations with weak IPv6 unblocking
prefer-ipv6	Prefer IPv6, fall back to IPv4	Better IPv6 route, or IPv6-based streaming unblocking
ipv4-only	IPv4 results only	VPS without IPv6 egress — avoids waiting on IPv6 timeouts
ipv6-only	IPv6 results only	IPv6-only VPS (no IPv4 egress)

Recommended combinations

Scenario	mode	dns-ip-preference
General use (when unsure)	default	default
Link prone to interference, need max camouflage	default	default
Clean link, maximum throughput	unshaped	default
Already behind ShadowTLS	unshaped	default
IPv4-only VPS	default	ipv4-only
IPv6-only VPS	default	ipv6-only
IPv6 streaming unblocking	default	prefer-ipv6
LAN / trusted-link benchmarking	unsafe-raw	default

The resulting server config:

[snell-server]
listen = ::0:6160
psk = your_psk
mode = unshaped
dns-ip-preference = default
dns = 1.1.1.1

The same settings via Docker:

-e SNELL_VER=v6 -e SNELL_MODE=unshaped -e SNELL_DNS_IP_PREFERENCE=default

v6 also accepts a comma-separated multi-address listen, e.g. listen = 0.0.0.0:6160,[::]:6160, binding IPv4 and IPv6 explicitly instead of relying on the system's dual-stack behaviour. The scripts do not expose this interactively yet — edit the config file directly if you need it.

ShadowTLS

ShadowTLS is a lightweight TLS camouflage tool that makes proxy traffic look like ordinary HTTPS traffic, improving stealth and stability. This project uses ShadowTLS v3.

Once enabled, the Snell backend listens only on 127.0.0.1:<snell port>; clients connect to the ShadowTLS port, so the raw Snell port is no longer exposed:

client ──TLS camouflage──▶ ShadowTLS(:8443) ──plain──▶ Snell(127.0.0.1:6160)

# Snell + ShadowTLS: use the ShadowTLS port
HK = snell, 1.2.3.4, 8443, psk = your_psk, version = 5, reuse = true, tfo = true, shadow-tls-password = your_stls_password, shadow-tls-sni = www.microsoft.com, shadow-tls-version = 3