Port reference
Port 8388 (TCP) – Shadowsocks proxy
Shadowsocks encrypted proxy server used for censorship circumvention and traffic tunneling.
Quick facts
- Transport
- tcp
- Category
- Registered
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open on hosts running a Shadowsocks server. Exposed to the internet by design, relying on a pre-shared key for both access control and encryption.
What is port 8388 used for?
Port 8388 is a common default for Shadowsocks, an encrypted proxy widely used for censorship circumvention and secure tunneling. Clients such as Shadowsocks-libev, the official mobile apps, and Outline encrypt traffic with a pre-shared key and send it to a Shadowsocks server on 8388, which decrypts and forwards it. The single key provides both the encryption and the access control.
When would you open it?
Open or forward 8388 on a server where you run Shadowsocks and want your own devices to connect through it. Unlike most services, Shadowsocks is meant to face the internet, so the port is typically reachable publicly.
Is it safe to open?
Since the port is internet-facing, its security rests entirely on the key, so use a long random key with a modern AEAD cipher. See the security notes below.
How to check if this port is open
ss -tulpn | grep :8388
nmap -p 8388 <target>netstat -ano | findstr :8388
Test-NetConnection <host> -Port 8388lsof -i :8388
nmap -p 8388 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 8388 to your device's local IP, internal port 8388, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 8388/tcpsudo firewall-cmd --permanent --add-port=8388/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 8388 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 8388" -Direction Inbound -Protocol TCP -LocalPort 8388 -Action AllowSecurity & risks
Common attacks
- Brute force or guessing of weak pre-shared keys
- Open-proxy abuse once the key is recovered or default
- Active probing to fingerprint and block Shadowsocks servers
- Relaying spam, scraping, or attack traffic through the host
Hardening
- Use a long, random pre-shared key and a modern AEAD cipher
- Restrict source IPs where possible and rate-limit connections
- Run the server unprivileged and keep it patched
- Rotate keys and monitor for unexpected outbound traffic
- Avoid default ports/keys that scanners check first
How to block this port
sudo ufw deny 8388/tcpsudo firewall-cmd --permanent --remove-port=8388/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 8388 -j DROPNew-NetFirewallRule -DisplayName "Block 8388" -Direction Inbound -Protocol TCP -LocalPort 8388 -Action Blocknmap snippet
nmap -p8388 --script banner <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- Is Shadowsocks on 8388 encrypted?
- Yes. Shadowsocks encrypts traffic with a pre-shared key, ideally a modern AEAD cipher. Security depends on key strength — a weak or guessable key undermines both confidentiality and access control.
- Can a Shadowsocks server be abused as an open proxy?
- If the key is weak, default, or leaked, anyone who recovers it can route arbitrary traffic through your host, laundering spam or attacks behind your IP. Use a long random key and rotate it.