Fair enough. I mean, there are ways around that too, like some port knocking scheme, but I assume that this shadowsocks thing solves the same problem in a better way.

But I do stand by what I was responding to on, the bit about the internal IP packets being encrypted and not readable.