🌍 Setup Outline VPN — Shadowsocks Server
Deploy Outline, a Shadowsocks-based VPN server by Jigsaw (Google). Share access keys with anyone and manage your server through the Outline Manager desktop app.
📦 Resources & Setup Scripts
Grab the automated bash script from GitHub to follow along.
Quick Install:
wget https://raw.githubusercontent.com/mhmdali94/Docker/main/vpn/outline/outline-ubuntu.sh
chmod +x outline-ubuntu.sh
sudo bash outline-ubuntu.shTutorial Steps
1 Download & Run the Script
The script installs Docker, deploys the Outline server, and prints a management API URL and certificate fingerprint for use in the Outline Manager app.
wget https://raw.githubusercontent.com/mhmdali94/Docker/main/vpn/outline/outline-ubuntu.sh
chmod +x outline-ubuntu.sh
sudo bash outline-ubuntu.sh2 Connect Outline Manager
Download the Outline Manager desktop app. Click 'Set up Outline anywhere' and paste the API URL printed by the script to link your server.
3 Create and Share Access Keys
In Outline Manager, create access keys and share the generated ss:// link or QR code with users. Each key can have its own data limit.
4 Connect with Outline Client
Install the Outline Client app on any device (Windows, macOS, Linux, iOS, Android). Add the access key to connect instantly through your server.
Ports Used
| Port | Protocol | Purpose |
|---|---|---|
| 8092 | TCP | Management API |
| 12345 | TCP/UDP | Shadowsocks VPN Tunnel |
Files Location
/root/docker/outline/docker-compose.ymlOverview
Outline is a VPN and proxy tool developed by Jigsaw (Google) that uses the Shadowsocks protocol, optimized for bypassing censorship and resisting traffic analysis. The Outline Manager desktop app manages access keys, while the Outline Client app on any device connects to your server. Server setup takes under 5 minutes.
Why Use It
Outline's defining advantage is simplicity for both the operator and the end user. You deploy the server in one command, link it to the Outline Manager desktop app, and share access via a URL that clients open with one tap — no VPN configuration, no certificate import, no IT support needed on the client side. Backed by Jigsaw (Google's security think tank), the Shadowsocks protocol is battle-tested in some of the world's most aggressively censored environments, making Outline the go-to choice when you need to share internet access with non-technical people in restrictive regions.
When You Need It
Who Should Use It
Real Use Cases
Main Features
How to Use After Installation
Security Best Practices
Ports and Firewall Notes
Outline uses a random high port for the Shadowsocks tunnel (e.g., 12345/TCP+UDP) and port 8092/TCP for the management API. The install script opens the tunnel port automatically. Restrict port 8092 to your management IP only. For maximum censorship resistance, configure the tunnel port to 443 in the Manager app under 'Advanced' — this makes Outline traffic look like HTTPS. Both TCP and UDP must be open on the chosen tunnel port since Shadowsocks uses both.
Backup and Maintenance
Common Mistakes
Troubleshooting
Alternatives
3X-UI with VLESS Reality offers stronger DPI resistance than Shadowsocks for highly aggressive censors, with per-user quotas and a full web panel — but is significantly more complex to set up. WireGuard Easy is a better choice for team VPN where censorship resistance is not the primary concern. Hiddify is an all-in-one proxy server that supports multiple protocols including Shadowsocks, VLESS, and VMess with a simpler management UI than 3X-UI. For pure personal use, a Shadowsocks-libev server configured manually is lighter than Outline's Docker deployment.
When Not to Use It
Avoid Outline if you need a full-mesh or hub-and-spoke VPN for internal service access — it is a proxy, not a network tunnel. If your threat model requires stronger DPI evasion than Shadowsocks provides (e.g., active probing resistance), use 3X-UI with VLESS Reality instead. Outline also has no user authentication layer — anyone with a valid access key can use the server — so it is not appropriate for corporate environments where identity-tied access control is required.
PrismaTechWork Professional Help
PrismaTechWork provides end-to-end infrastructure services — from initial deployment and security hardening to ongoing monitoring, automated backups, and dedicated support. Whether you need a single-server setup or a multi-site network, our team ensures your infrastructure is built right, secured properly, and maintained reliably.
Frequently Asked Questions
What is Shadowsocks and why does it bypass censorship better than standard VPN?
Shadowsocks is a proxy protocol designed to disguise traffic as ordinary HTTPS. Unlike VPN protocols (OpenVPN, WireGuard) which have identifiable handshake patterns, Shadowsocks uses random padding and encryption that makes the traffic look like noise to deep packet inspection systems. It was originally developed to bypass the Great Firewall of China, where standard VPN protocols are actively blocked.
What is the Outline Manager and do I need it running all the time?
Outline Manager is a desktop app (Windows, macOS, Linux) used to manage access keys on your server. You only need it when you want to create, delete, or monitor keys — it does not need to run continuously. The Outline server runs as a Docker container on your VPS and operates independently. You can close Manager after making changes and re-open it later to reconnect.
How many users can I support on one Outline server?
Outline has no built-in user limit — it is constrained only by your VPS bandwidth and CPU. A $5 VPS with 1TB/month bandwidth can comfortably support dozens of light users. Create a separate access key per user and set individual data limits to prevent any single user from consuming disproportionate bandwidth.
Can I set a data limit per user?
Yes. In Outline Manager, click the three-dot menu next to any access key and select 'Set data limit'. Set a monthly GB limit. When the user reaches the limit, their key stops working until the next month or until you manually reset it. This prevents bandwidth abuse on shared servers.
Is Outline completely anonymous?
No. Outline hides your traffic content and destination from your local network and ISP, but your VPS provider can see that your server is sending and receiving traffic. The VPS IP is visible to websites you visit through the proxy. For anonymity, you would need to combine Outline with additional layers (Tor, etc.) — which is beyond its intended use case.
What if my Outline server's IP gets blocked?
If the server IP is blocked, you have a few options: change the tunnel port to 443 (blends with HTTPS and harder to block without collateral damage), migrate to a new VPS with a different IP, or use a CDN like Cloudflare in front of the server. For users facing active IP blocking, 3X-UI with VLESS Reality is a more resilient alternative since it borrows a legitimate domain's TLS fingerprint.
How do I update Outline?
Run: docker compose -f /root/docker/outline/docker-compose.yml pull && docker compose -f /root/docker/outline/docker-compose.yml up -d. The access keys are stored in the persisted-state volume and survive the update. Back up the persisted-state directory before pulling in case a migration fails.
Can I use Outline on a $5 VPS?
Yes, Outline is one of the lightest VPN/proxy options available. The server container uses under 50MB of RAM and negligible CPU at rest. A $5/month VPS (512MB RAM, 1 vCPU, 1TB bandwidth) is more than sufficient for dozens of light users. Outline is deliberately designed to run cheaply so that individuals and small organizations can afford to deploy it.