A proxy server makes it possible to reach a SSH server that cannot be contacted directly, such as a host inside a private network or behind restrictive firewall rules. The proxy acts as a relay for the initial TCP connection, while the SSH session stays end-to-end encrypted once the tunnel is established.

In PuTTY, proxy settings live under Connection → Proxy and apply to the current session profile. PuTTY can negotiate through common proxy protocols such as HTTP (CONNECT tunneling) and SOCKS (v4/v5), allowing the SSH transport to be carried through the proxy to the target server and port.

Proxy connectivity depends on policy as much as configuration; the proxy must be permitted to reach the destination port (commonly 22) and may require authentication. DNS resolution also matters: internal hostnames might only resolve from the proxy side, and the proxy handshake may fail before any SSH banner appears if the proxy blocks the request.

Step-by-step video guide:

Related: How to connect through a jump host in PuTTY
Related: How to create a SOCKS proxy on Windows using PuTTY

Steps to connect via proxy server in PuTTY:

  1. Launch PuTTY.
  2. Open the Proxy settings from the left sidebar under Connection.
  3. Select the proxy type to match the proxy service.

    HTTP proxies typically require tunneling support (CONNECT), while SOCKS5 is commonly used for generic TCP forwarding.

  4. Enter the proxy hostname or IP address and the proxy port.
  5. Choose whether to resolve DNS locally or at the proxy end.

    Enabling Do DNS name lookup at proxy end can be required when the target hostname only exists in the proxy-side network.

  6. Enter proxy credentials if the proxy requires authentication.

    Proxy Username and Proxy Password are provided to the proxy during negotiation; avoid reusing privileged credentials on untrusted proxies.

  7. Return to the Session category in the left sidebar.
  8. Enter the target SSH server hostname or IP address in Host Name (or IP address).
  9. Enter the target SSH port in Port if it is not the default 22.
  10. Click Open to start the proxied connection.
  11. Verify the server fingerprint at the host key security alert prompt and click Accept.

    Accepting an unexpected host key can indicate a man-in-the-middle attack or a connection to the wrong server.

    Related: How to update or delete PuTTY host key fingerprints on Windows

  12. Confirm the SSH login prompt appears in the PuTTY terminal window.

    Proxy errors typically appear before any SSH banner, while SSH authentication prompts indicate the tunnel is working.