Outline. How the service works

The Outline module in the BeAdmin panel brings up a VPN based on Shadowsocks with AEAD encryption. On the server side — outline-ss-server by Jigsaw, a Go implementation of Shadowsocks that supports many users on a single port and serves TCP and UDP at the same time; on the client side — the Outline Client application or any compatible Shadowsocks client.

The problem Outline solves

Early Shadowsocks (before 2017) encrypted the payload of the packet but sent the first bytes in the clear — that let passive DPI identify the tunnel by the structure of the first byte, without knowing the contents. The AEAD version (Authenticated Encryption with Associated Data) removed the plaintext headers: the very first byte is already encrypted, and the packet is authenticated on top of encryption — any attempt to modify it in transit makes the packet fail authentication and get dropped.

Outline is AEAD‑Shadowsocks with an operational focus. A single server handles any number of users on one TCP and one UDP port at the same time, without allocating a port per user. The implementation is outline-ss-server in Go, under an open licence, with regular independent security audits. The protocol itself does not mask anything — it is an honest encrypted tunnel.

How Outline works

Outline rests on three engineering decisions.

AEAD encryption with no plaintext headers. It uses chacha20-poly1305 — the same algorithm as WireGuard. Every packet is encrypted and authenticated in a single operation; the first byte is already encrypted, and no recognisable service fields are sent over the network. To a passive observer it is a continuous stream of random bytes.

Multiplexing users on a single port. The server listens on one TCP and one UDP port; an arbitrary number of users live behind it, each with their own secret key. The server identifies "who arrived" by the AEAD handshake. This removes the need to allocate a port per user and to keep a port range open on the firewall.

TCP and UDP from the same port. Outline proxies not only TCP (HTTP/HTTPS) but also UDP — which matters for DNS over UDP, VoIP and video conferencing, games. Both transports are served from the same port by the same server.

What Outline cannot do

• It does not mask traffic. AEAD removes the obvious signatures in the first byte, but modern DPI systems with active probing can identify Shadowsocks statistically — by flow characteristics (packet size distribution, timings). In countries with active censorship Outline is blocked or works unreliably. For such networks you want Xray with HTTPS masking or Amnezia with handshake masking on top of WireGuard.
• No obfuscation plugins. v2ray-plugin, cloak, obfs-local — none of these are wired up in our implementation. Nothing sits on top of Shadowsocks except Shadowsocks itself.
• Only AEAD‑2018 chacha20-poly1305. Shadowsocks‑2022 (2022-blake3-*) is not used in our implementation. No other ciphers can be selected from the UI.
• It is not Tor or anonymity routing. A tunnel to your own server hides traffic from the ISP, but the destination server still sees the client's IP.
• It does not make VPN legal. If using a VPN is restricted or prohibited in your jurisdiction, Outline does not change that.

Outline in BeAdmin

The Outline module in BeAdmin installs in one click. The panel brings up the Shadowsocks server on its own, opens the right port, and configures forwarding of client traffic to the outside. There is no need to edit configuration files or work in the command line.

For each user the panel generates a ready connection link and a QR code. The client scans the QR from the Outline Client app or pastes the link — the connection is ready. Outline Client is available on every major platform: Android, iOS, Windows, macOS, Linux, ChromeOS. Compatible Shadowsocks clients work too.

What the server needs: a regular VPS or a physical machine. On container‑based servers (LXC, OpenVZ without full virtualisation) the module will not start — full access to the network stack is required. Modern Ubuntu and Debian are supported.

When to choose Outline

Choose Outline when:

• The network has no active censorship. Outline gives plain AEAD‑Shadowsocks without masking — enough for basic unblocking by DNS, IP, or whitelisting, but not for networks with active probing.
• You need compatibility with standard Shadowsocks. Outline is AEAD‑2018 chacha20-poly1305; any Shadowsocks client with AEAD support connects without trouble.
• A single application across every platform matters. Outline Client is available on Android, iOS, Windows, macOS, Linux, ChromeOS.

Outline is not a good fit when:

• The network actively blocks or probes Shadowsocks traffic. Use Xray with HTTPS masking or Amnezia with handshake masking on top of WireGuard.
• Your users are used to the native WireGuard client. Use WireGuard or Amnezia — no extra application required there.
• The network is fine and you want the fastest VPN possible. WireGuard sets up connections faster and handles client network changes more gracefully.

If in doubt — install Outline in BeAdmin and try it for free.

If you don't have a server yet, you can get one from our partners — they offer virtual and dedicated servers with the BeAdmin panel pre‑installed.

Proven over 15 years in hosting. Your VPS with BeAdmin is ready to go out of the box.

• Germany
• Netherlands
• Sweden
• Switzerland
• Spain
• USA

Select server

European reliability made simple. Launch BeAdmin with your VPS in just one click.

• Germany
• Netherlands
• Sweden
• Estonia
• Romania
• Switzerland
• Spain
• United Kingdom
• USA

Sign up

What's next

• Outline quick start — installing the module and the first connection.
• Outline. Managing the module — managing the service and updates.
• Outline. Managing users — issuing and revoking connections, temporarily disabling a user without re‑importing.