॥ श्री ॥

Outline VPN

Self-Hosting & Servers 2026-08-28
Part of the VPN & Tunnels series: See all networking docs

Outline VPN

Purpose: Shadowsocks-based proxy server by Jigsaw (Google). Designed for ease of deployment and resistance to traffic fingerprinting — traffic is indistinguishable from regular HTTPS to deep packet inspection. Unlike WireGuard, Outline is proxy-based rather than a full network tunnel, making it suitable for censorship circumvention where WireGuard is blocked. Management is via the Outline Manager desktop app (Linux/macOS/Windows) which generates a one-line docker run command and per-user access keys.

# ~/outline/compose.yaml
# Note: Outline Manager generates an exact run command including ports and secrets.
# Use its output directly. The compose below is a representative template.
services:
  outline:
    image: quay.io/outline/shadowbox:stable
    ports:
      - "0.0.0.0:8080:8080/tcp"
      - "0.0.0.0:8080:8080/udp"
      - "0.0.0.0:9090:9090/tcp"    # management API (bind to 127.0.0.1 if behind a proxy)
    volumes:
      - /home/user/outline/persisted-state:/root/shadowbox/persisted-state:Z
    environment:
      SB_API_PORT: "9090"
      SB_API_PREFIX: "your-random-prefix"   # generated by Outline Manager
      SB_CERTIFICATE_FILE: /root/shadowbox/persisted-state/shadowbox-selfsigned.crt
      SB_PRIVATE_KEY_FILE: /root/shadowbox/persisted-state/shadowbox-selfsigned.key
    restart: unless-stopped
Recommended: Use the Outline Manager desktop app to generate the exact command, copy the docker run output and convert it to compose. The Manager handles certificate generation, port selection, and API key management automatically.

Firewall: Open the data port (default 8080/tcp and 8080/udp) and the management API port on your server.

sudo firewall-cmd --add-port=8080/tcp --add-port=8080/udp --permanent
sudo firewall-cmd --reload

Clients

Distribute per-user access keys (ss:// URIs) generated by the Manager. Users install the Outline Client app on Android, iOS, Windows, macOS, or Linux.

Outline and Hysteria 2 solve different problems. Outline is optimised for censorship circumvention (traffic obfuscation). Hysteria 2 is optimised for high-loss / high-latency networks (QUIC transport). Use Outline where WireGuard is fingerprinted and blocked; use Hysteria 2 where packet loss degrades TCP-based protocols.

See Also