TL;DR: Learn and use iptables instead. Much faster and has wide support (at least in docker).

I use UFW since I started to self-host because people kept talking about it and how much it's good and easy to use, and it was, do not get me wrong. It's easy to use, but it was slow. And I can live with its slowness, but I could not bear it when I started to use mailcow, Because of slow SMTP connection times. I thought it's the normal to be honest, sending email takes around 30s to complete. And after asking online I found people usually wait 5s to complete sending email and I said FUUUUUCK. You guys wait 5s? Started to look into it more to understand what causes it, but nothing. Until I suspected in UFW and I closed it and boom, sending email only takes 3s now. I said wow, but then said fuck, now I have to live without firewall? No, no, no. So I gave up and enabled UFW again and called it a day, but I had enough with it, so I came back and someone recommended for me to use IPTABLES instead, and I was like, WTF? UFW is IPTABLES, but I tested and indeed now sending time only takes ~5s, and I was like wow (again) it's much faster. And this is why in the last couple of days I had major outages because simply I was learning iptables 😂. So what we learn here is if you have a chance, learn iptables, it's much faster than UFW (at least in my case) plus what I learned too is that docker uses its own iptables (so you do not need to add ports for your docker containers because docker already do it for you) so if you want to control docker rules, you will have to do it inside iptables not UFW.

Here are some good sources, I learned from it: – github.com/ChrisTitusTech/fire…– serverfault.com/a/200658– serverfault.com/a/758499– cyberciti.biz/faq/how-to-set-u…– superuser.com/a/427472

NOTE: Unlike UFW, you need to save your rules in a file by using iptables-save and in my case that file was /etc/iptables/rules.v4

Intro

I as you know have a VPS where i self-host most of services i use (en.esmailelbob.xyz/src/pages/s… also feel free to donate so i can keep the server running en.esmailelbob.xyz/src/pages/d…) and i installed pihole for personal use and as you know i need a VPN connect so i do not be open resolver online and ANYONE use my dns server and living in a country like mine with lots and lots of internet filters and most of VPN companies along side tor browser and of course wireguard and openvpn themselves blocked too. It's basically impossible to use pihole and vpn (ideally pivpn) to connect to my pihole server. So first as you might now i used udp2raw which is a great application and it worked with me but for a week or two then i noticed i really can't use it anymore so i had to ask more and search more (mostly chinese of course) and if you know me i got bad English language so imagine my Chinese one. So thanks on kind redditors and for u/SodaWithoutSparkles i started to try new applications including v2ray, shadowsocks and wireguard. I first found a script which done an amazing job to install 3 of them but i found out that i do not need all of them actually, i just need shadowsocks so yup as always i get a problem so i search for it then i find more than one article so i try to glue them then i write my own article in hope it helps someone else! and if you are the unlucky one who my article did not help. Cheer up! you are the next me who is going to take an adventure online to find your own articles and glue them together and who knows maybe you write your own and add my blog as sources in your article 😀___

Setup – Shadowsocks – Server side!

We first need to install shadowsocks and i will assume you are using Debian 11 OS so simply run:

sudo apt install shadowsocks-libev

sudo nano /etc/shadowsocks-libev/config.json

{
    "server":["::0","0.0.0.0"],
    "server_port":8388,
    "method":"chacha20-ietf-poly1305",
    "password":"MY BIG FAT PASSWORD",
    "mode":"tcp_and_udp",
    "nameserver":"127.0.0.1",
    "fast_open":false
}

Firewall

If you are using firewall (which is really something you should use to protect your server) like ufw you need to unblock same port used for shadowsocks in our case it's 8388

sudo ufw allow 8388

SOYSTEMD

Now we are done and we can enable shadowsocks as systemd service

sudo systemctl enable shadowsocks-libev
sudo systemctl start shadowsocks-libev

Setup – Shadowsocks – Client Side (your computer)

This step really changes from different systems and OSes of course but as i right now using Artix (btw) i will use v2ray desktop because it got gui and it's kinda simple to use.

So if you are on arch linux, install v2ray desktop:

yay -S v2ray-desktop

Then we go to servers tab on left sideThen click on Add new serverAnd select Shadowsocks from drop menu aboveThen fill data as it's described in photo (and click on Add new server button):Then right click and click connect:At the end, go to settings tab and make sure to set dns to 127.0.0.1 it's not required but it's a protective measure!

Then at system tray of v2ray desktop you need to right click and check socks proxy and global proxy options and then you can set proxy of your applications as you like. The IP will be 127.0.0.1 the port will be 1080 (defualt) and select socks 5 (or http if you would like but select it from v2ray menu first!)

After everything is set you should see 'You can access the free internet':___

Conclusion

At the end, if you get any weird problems you can check looks in v2ray desktop at logs tab

I still looking into a way to use split tunnling just like i did with wireguard so i do not need to use my VPS's IP address all the time and use VPN when i need VPN but most of time i use it for DNS only so i'm still looking into this to only query DNS and nothing more and i will update this blog onces i find the way!

Sources ❤

• gfw.report/blog/ss_tutorial/en… i recommend to keep an eye for this for updates!
• upcloud.com/community/tutorial…

If you use my onion links, you will notice my old domain lqs5fjmajyp7rvp4qvyubwofzi6d4i… has changed to http://esmail5pdn24shtvieloeedh7ehz3nrwcdivnfhfcedl7gf4kwddhkqd.onion and if you are asking why, try and read my new domain. If you still can't catch it. It's because it has part of my name in it now, Why? To make sure it's actually me (sure anyone can brute force it my name part) but at least it kinda looks cool, right?

NOTE: Changed my crypto address too, to get EE inside of it, like: XMR's address: 46EEHDTGt5PHDcc7hXQhgrULcQ2JZMTJMTEVRHvsaZeUhrN9DmXkQyViZokxoNqqqBHBCAYoH7YRpFfKDs5WcoAA8Bgr5rC

So it's either esmail or ee.

Why not full name? Well, because it turned out it takes MASSIVE computing power to generate 11 characters so I had to settle for 6 or 2.

Last but not least, here are the programs I used: – For BTC: github.com/JeanLucPons/VanityS… (it's for windows, but you can run it with wine) – For ETH: vanity-eth.tk/– For XMR: github.com/monero-ecosystem/va…– For onion: github.com/cathugger/mkp224o