prefix 偽裝的連線
透過集合功能整理內容
你可以依據偏好儲存及分類內容。
自 Outline 用戶端 1.9.0 版起，存取金鑰支援「prefix」選項。「prefix」是 Shadowsocks TCP 連線中做為鹽開頭的一串位元組。這可以使連線偽裝成網路中允許的協定，從而繞過防火牆對未知通訊協定的封鎖。
何時應嘗試使用 prefix？
如果您懷疑 Outline 部署的使用者仍然受到封鎖，可以考慮嘗試幾組 prefix。
操作說明
prefix 的長度不應超過 16 個位元組。較長的 prefix 可能會導致鹽值重複，因而影響加密安全性，使得連線被偵測到。建議盡可能使用最短的 prefix 來繞過封鎖。
您使用的通訊埠應與 prefix 偽裝的通訊協定一致。在 IANA 維護的傳輸通訊協定埠號註冊表中，您可以查看各種通訊協定對應的埠號。
以下是一些模擬常見通訊協定的有效 prefix：
|
建議通訊埠 |
JSON 編碼 |
網址編碼 |
| HTTP 要求 |
80 (http) |
"POST " |
POST%20 |
| HTTP 回應 |
80 (http) |
"HTTP/1.1 " |
HTTP%2F1.1%20 |
| DNS-over-TCP 要求 |
53 (dns) |
"\u0005\u00DC\u005F\u00E0\u0001\u0020" |
%05%C3%9C_%C3%A0%01%20 |
| TLS ClientHello |
443 (https)、463 (smtps)、563 (nntps)、636 (ldaps)、989 (ftps-data)、990 (ftps)、993 (imaps)、995 (pop3s)、5223 (Apple APN)、5228 (Play 商店)、5349 (turns) |
"\u0016\u0003\u0001\u0000\u00a8\u0001\u0001" |
%16%03%01%00%C2%A8%01%01 |
| TLS 應用程式資料 |
443 (https)、463 (smtps)、563 (nntps)、636 (ldaps)、989 (ftps-data)、990 (ftps)、993 (imaps)、995 (pop3s)、5223 (Apple APN)、5228 (Play 商店)、5349 (turns) |
"\u0013\u0003\u0003\u003F" |
%13%03%03%3F |
| TLS ServerHello |
443 (https)、463 (smtps)、563 (nntps)、636 (ldaps)、989 (ftps-data)、990 (ftps)、993 (imaps)、995 (pop3s)、5223 (Apple APN)、5228 (Play 商店)、5349 (turns) |
"\u0016\u0003\u0003\u0040\u0000\u0002" |
%16%03%03%40%00%02 |
| SSH |
22 (ssh)、830 (netconf-ssh)、4334 (netconf-ch-ssh)、5162 (snmpssh-trap) |
"SSH-2.0\r\n" |
SSH-2.0%0D%0A |
動態存取金鑰
如要在動態存取金鑰 (ssconf://) 中使用 prefix 功能，請在 JSON 物件中新增「prefix」鍵，並將所需的 prefix 以 JSON 編碼表示 (參見上表示例)。您可以使用 \u00FF 之類的逸出代碼，表示 U+0 至 U+FF 範圍內的不可列印 Unicode 代碼點，例如：
{
"server": "example.com",
"server_port": 8388,
"password": "example",
"method": "chacha20-ietf-poly1305",
"prefix": "\u0005\u00DC\u005F\u00E0\u0001\u0020"
}
靜態存取金鑰
如要在靜態存取金鑰 (ss://) 中使用 prefix，您需要先修改現有金鑰再發布。如果您使用 Outline Manager 生成的靜態存取金鑰，請將您的 prefix 轉換為網址編碼版本 (參見上表示例)，然後加入存取金鑰末端，如下所示：
ss://Z34nthataITHiTNIHTohithITHbVBqQ1o3bkk@127.0.0.1:33142/?outline=1&prefix=<your url-encoded prefix goes here>
對於進階使用者，您可以運用瀏覽器的 encodeURIComponent() 函式將 JSON 編碼的 prefix 轉換為網址編碼版本。如要這麼做，請開啟網頁檢查器控制台 (在 Chrome 中依序點選「Developer」>「JavaScript Web Console」) 並輸入以下內容：
encodeURIComponent("<your json-encoded prefix goes here>")
按下 Enter 鍵，生成的值即為「網址編碼」版本，例如：
encodeURIComponent("\u0016\u0003\u0001\u0000\u00a8\u0001\u0001")
'%16%03%01%00%C2%A8%01%01'
除非另有註明，否則本頁面中的內容是採用創用 CC 姓名標示 4.0 授權，程式碼範例則為阿帕契 2.0 授權。詳情請參閱《Google Developers 網站政策》。Java 是 Oracle 和/或其關聯企業的註冊商標。
上次更新時間：2025-07-25 (世界標準時間)。
[null,null,["上次更新時間：2025-07-25 (世界標準時間)。"],[[["\u003cp\u003eOutline Client version 1.9.0 and later supports the "prefix" option for access keys, allowing users to define a sequence of bytes at the beginning of the Shadowsocks TCP connection salt.\u003c/p\u003e\n"],["\u003cp\u003eThe "prefix" feature is designed to help bypass firewalls by making connections appear to use a recognized protocol, and is useful if users are being blocked.\u003c/p\u003e\n"],["\u003cp\u003ePrefixes should not exceed 16 bytes to avoid salt collisions and potential compromise of encryption, with shorter prefixes being recommended.\u003c/p\u003e\n"],["\u003cp\u003eThe selected port should align with the protocol the prefix is mimicking, and several examples of effective prefixes are provided for common protocols like HTTP, DNS, TLS, and SSH.\u003c/p\u003e\n"],["\u003cp\u003eDynamic Access Keys require adding a JSON-encoded "prefix" key, while Static Access Keys need the URL-encoded prefix appended to the key, and a browser's \u003ccode\u003eencodeURIComponent()\u003c/code\u003e function can convert between the two formats.\u003c/p\u003e\n"]]],["Outline Client version 1.9.0 and later supports the \"prefix\" option for access keys. Prefixes are byte lists placed at the beginning of the Shadowsocks TCP connection salt, masking the connection as a recognized protocol. To implement, select a prefix (max 16 bytes) resembling a common protocol (e.g., \"HTTP/1.1 \") and a matching port from IANA. Dynamic Access Keys use JSON-encoded prefixes, while Static Access Keys require URL-encoded prefixes added to the access key URL.\n"],null,["# Connection Prefix Disguises\n\nAs of Outline Client version 1.9.0, access keys support the \"prefix\" option. The\n\"prefix\" is a list of bytes used as the first bytes of the\n[salt](https://shadowsocks.org/guide/aead.html) of a Shadowsocks connection.\nThis can make the connection look like a protocol that is allowed in the\nnetwork, circumventing firewalls that reject protocols they don't recognize.\n\nWhen should I try this?\n-----------------------\n\nIf you suspect the users of your Outline deployment are still being blocked, you\nmay want to consider trying a few different prefixes.\n\nInstructions\n------------\n\nThe prefix should be no longer than 16 bytes. Longer prefixes may cause salt\ncollisions, which can compromise the encryption safety and cause connections to\nbe detected. Use the shortest prefix you can to bypass the blocking you are\nfacing.\n\nThe port you use should match the protocol that your prefix is pretending to be.\nIANA keeps a [transport protocol port number registry](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml)\nthat maps protocols and port numbers.\n\nSome examples of effective TCP prefixes that look like common protocols:\n\n| | Recommended Port | YAML-encoded | URL-encoded |\n|----------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------|----------------------------|\n| HTTP request | 80 (http) | `\"POST \"` | `POST%20` |\n| HTTP response | 80 (http) | `\"HTTP/1.1 \"` | `HTTP%2F1.1%20` |\n| DNS-over-TCP request | 53 (dns) | `\"\\u0005\\u00DC\\u005F\\u00E0\\u0001\\u0020\"` | `%05%C3%9C_%C3%A0%01%20` |\n| TLS ClientHello | 443 (https), 463 (smtps), 563 (nntps), 636 (ldaps), 989 (ftps-data), 990 (ftps), 993 (imaps), 995 (pop3s), 5223 (Apple APN), 5228 (Play Store), 5349 (turns) | `\"\\u0016\\u0003\\u0001\\u0000\\u00a8\\u0001\\u0001\"` | `%16%03%01%00%C2%A8%01%01` |\n| TLS Application Data | 443 (https), 463 (smtps), 563 (nntps), 636 (ldaps), 989 (ftps-data), 990 (ftps), 993 (imaps), 995 (pop3s), 5223 (Apple APN), 5228 (Play Store), 5349 (turns) | `\"\\u0013\\u0003\\u0003\\u003F\"` | `%13%03%03%3F` |\n| TLS ServerHello | 443 (https), 463 (smtps), 563 (nntps), 636 (ldaps), 989 (ftps-data), 990 (ftps), 993 (imaps), 995 (pop3s), 5223 (Apple APN), 5228 (Play Store), 5349 (turns) | `\"\\u0016\\u0003\\u0003\\u0040\\u0000\\u0002\"` | `%16%03%03%40%00%02` |\n| SSH | 22 (ssh), 830 (netconf-ssh), 4334 (netconf-ch-ssh), 5162 (snmpssh-trap) | `\"SSH-2.0\\r\\n\"` | `SSH-2.0%0D%0A` |\n\nSome examples of effective UDP prefixes that look like common protocols:\n\n| | Recommended Port | YAML-encoded |\n|---------------------|------------------|--------------------------------------------------------------------------------|\n| DNS request | 53 (dns) | `\"\\u006b\\u007b\\u0001\\u0020\"` (note: randomize the first two bytes) |\n| DNS response | 53 (dns) | `\"\\u006b\\u007b\\u0081\\u00a0\\u0000\\u0001\"` (note: randomize the first two bytes) |\n| QUIC Client Initial | 443 (https) | `\"\\u00cd\\u0000\\u0000\\u0000\\u0001\"` |\n\n### Dynamic Access Keys\n\nTo use the prefix feature with [Dynamic Access Keys](/outline/docs/guides/service-providers/dynamic-access-keys) (`ssconf://`),\nadd a \"prefix\" key to the YAML object, with a **YAML-encoded** value\nrepresenting the prefix you want_ (see examples in the table above)_. You can\nuse escape codes (like \\\\u00FF) to represent non-printable Unicode codepoints in\nthe `U+0` to `U+FF` range. For example: \n\n transport:\n $type: tcpudp\n tcp:\n \u003c\u003c: &shared\n $type: shadowsocks\n endpoint: 147.182.248.224:20478\n secret: cqXYJ2BtMyNHneQHjpIXyg\n cipher: chacha20-ietf-poly1305\n prefix: \"\\u0013\\u0003\\u0003\\u003F\"\n udp:\n \u003c\u003c: *shared\n prefix: \"\\u006b\\u007b\\u0001\\u0020\"\n\n### Static Access Keys\n\nTo use prefixes with **Static Access Keys** (ss://), you'll need to modify your\nexisting key before distributing it. If you have a Static Access Key generated\nby Outline Manager, grab a **URL-encoded** version of your prefix (see examples\nof these in the table above) and add it to the end of the access key like so:\n\n`ss://Z34nthataITHiTNIHTohithITHbVBqQ1o3bkk@127.0.0.1:33142/?outline=1&prefix=\u003cyour url-encoded prefix goes here\u003e`\n\nPrefixes in the URL format only work for TCP connections.\n\nFor advanced users, you can use your browser's `encodeURIComponent()` function\nto convert your **JSON-encoded** prefix to a **URL-encoded** one. To do this,\nopen your web inspector console\n(\\*Developer \\\u003e Javascript Web Console \\*on Chrome), and type the following: \n\n encodeURIComponent(\"\u003cyour json-encoded prefix goes here\u003e\")\n\nPress enter. The value produced will be the \\*URL-encoded \\*version. For example: \n\n encodeURIComponent(\"\\u0016\\u0003\\u0001\\u0000\\u00a8\\u0001\\u0001\")\n '%16%03%01%00%C2%A8%01%01'"]]
