How to create an SSH SOCKS proxy

When web or API traffic needs to leave from a remote server, an SSH SOCKS proxy gives selected applications a temporary egress path without changing the whole system network route. The local port accepts SOCKS requests, and the SSH connection carries those requests to the server that opens the outbound connections.

OpenSSH creates this path with dynamic port forwarding through ssh -D. The ssh client listens on a local address and port, acts as a SOCKS4 or SOCKS5 server, and forwards each requested destination over the encrypted channel so the remote side makes the final connection.

The proxy works only while the SSH process remains connected, and the remote server must allow TCP forwarding. Keep the listener bound to 127.0.0.1 unless another trusted host must use it, and prefer socks5h in clients such as curl when hostnames should be resolved through the tunnel instead of the local network.

1. Confirm that the remote SSH login works.

   $ ssh user@host.example.net hostname
   host.example.net

2. Start a local-only SOCKS listener on port 8080.

   $ ssh -fN -D 127.0.0.1:8080 -o ExitOnForwardFailure=yes user@host.example.net

   -D creates the SOCKS listener, -N skips a remote command, and ExitOnForwardFailure=yes makes ssh exit if the local port cannot be opened. Keep 127.0.0.1 unless another host must use the tunnel.
   Related: How to allow remote hosts to use an SSH tunnel

3. Confirm that ssh is listening on the local SOCKS port.

   $ ss -ltnp 'sport = :8080'
   State  Recv-Q Send-Q Local Address:Port Peer Address:Port Process
   LISTEN 0      128        127.0.0.1:8080      0.0.0.0:*    users:(("ssh",pid=24819,fd=4))

   Replace 8080 with the port chosen for the local listener.

4. Check the direct public address before using the proxy.

   $ curl https://api.ipify.org
   203.0.113.10

5. Check the public address through the SOCKS proxy.

   $ curl --proxy socks5h://127.0.0.1:8080 https://api.ipify.org
   203.0.113.50

   The socks5h proxy scheme sends hostname resolution through the SSH tunnel, which avoids a separate local DNS lookup for the destination.

6. Configure the application to use the local SOCKS5 proxy.

   Set the proxy host to 127.0.0.1 and the port to 8080. Use SOCKS v5, not an HTTP proxy, and enable proxy DNS when the application exposes that setting.
   Tool: What Is My IP Address?

7. Stop the background tunnel when the proxy is no longer needed.

   $ kill 24819

   Use the ssh process ID shown in the listener check. Killing the wrong process can close an unrelated SSH session.