Sharing Mac’s ShadowSocks via local network

I just got a new iPhone 6, upgraded to iOS 8.4.1, unjailbreakable. So I searched the web for ShadowSocks sharing. Actually the Windows version has such function built-in. But for Mac version we need some other treatment.

First I would like to talk a little about the mechanism of ShadowSocks. There are several methods to circumvent the censorship of GFW, like VPN and http/socks proxy. A normal http/socks proxy does not require special treatment on your device. So why we need GoAgent and ShadowSocks? Because the traffic of normal proxy is easy to be detected by GFW. If we have a private overseas server and use it as a simple http proxy, GFW may block that IP after it detects the traffic.

Both GoAgent and ShadowSocks disguise their traffic, pretending to be normal http. They are actually “encrypted proxies”. However, our OS cannot recognize such encrypted proxies. It has only standard proxy protocol built-in. So we need another program running on our OS, to decrypt the proxy.

programs like browser (via built-in socks protocol) -> ShadowSocks client (interpret to ShadowSocks proxy, via Internet) -> ShadowSocks server -> target website like Google

It is easier to share GoAgent client on Mac to iOS devices. But for ShadowSocks we need one more treatment. For unjailbroken devices, there is only http proxy built-in, no socks proxy. We have to forward the socks proxy from Mac ShadowSocks client as a http proxy.

iOS devices (via local network http proxy) -> privoxy on Mac (transforming http proxy to socks proxy) -> ShadowSocks client (interpret to ShadowSocks proxy, via Internet) -> ShadowSocks server -> target website like Google

I found the steps from this article:
http://1992s.com/blog/share-shadowsocks-over-lan-on-mac-os-x.html

1. Install privoxy: http://www.privoxy.org/#DOWNLOAD
2. Modify /usr/local/etc/privoxy/config
   1. search for the line including “forward-socks5t   /”, delete the comment symbol “#”, change the port to 1080 (or other port using by the ShadowSocks client)

      forward-socks5t   /               127.0.0.1:1080 .

   2. search for the line including “listen-address  127.0.0.1:8118”, delete the comment symbol “#”, change the listen address IP from 127.0.0.1 to 0.0.0.0 (this change enables outside connection). Leave the default port or choose another port.

      listen-address  0.0.0.0:8118

3. run the command in the terminal (sudo may be needed):

   /usr/local/sbin/privoxy --no-daemon /usr/local/etc/privoxy/config

4. Using global proxy mode on iOS devices: Set Wi-Fi Manual http proxy as $IP_OF_MAC:$PORT. The port is the listening port like 8118, not the original ShadowSocks port 1080.

For auto-proxy mode, a pac file is needed. I set the pac on mac and use Apache as the web server.

1. Run the command to start Apache web server

   sudo apachectl start

2. Launch a browser to browse http://127.0.0.1 for verification. If the web server works, you will see an “It Works!” message.
3. The content of the server locates at /Library/WebServer/Documents/, copy the pac file there. Usually the location of the ShadowSocks one is $HOME/.ShadowsocksX/gfwlist.js
4. Change the line containing “var proxy” in the end. Change “SOCKS5” to “PROXY”, and “127.0.0.1” to the Mac’s IP address.

    var proxy = "PROXY 127.0.0.1:1080; DIRECT;";

5. Set Wi-Fi “Auto” http proxy as http://$MAC_IP/$PAC_NAME and enjoy!

I think it should also work when you are outside. Just allowing connections from Internet to privoxy and the pac server.