1. On server:
2.  
3. ss-server -s 0.0.0.0 -s ::0 -p 443 -k shadowsocks-password -m
4. aes-128-gcm -U # change to lowercase u if you want to be able to
5. connect to the server over TCP too.
6.  
7. On client:
8.  
9. ss-tunnel -s shadowsocks-server -p 443 -l 51820 -L
10. wireguard-server:51820 -k shadowsocks-password -m aes-128-gcm -U
11.  
12. Connect WireGuard to 127.0.0.1:51820. Done.