Exclude One SSH Host from a Default SOCKS Route

When an OpenSSH configuration uses a SOCKS connector by default, put a named exception before that broad rule:

Host internal.example
    ProxyCommand none

Host *
    ProxyCommand nc -X 5 -x proxy.example:1080 %h %p

This example uses the OpenBSD nc option interface for SOCKS5. Connecting with ssh internal.example selects the exception; the remaining hosts obtain the default connector. For allowed public SSH destinations, a no-account entry from the SOCKS5 proxy list can supply the default proxy address if it permits each actual host and SSH port; retain the intended internal exception.

Order matters because OpenSSH uses the first obtained value for a parameter. The exception must be encountered before a matching default supplies ProxyCommand, including defaults read through Include files.

Inspect the effective settings for a particular invocation with:

ssh -G internal.example

Host patterns match the name used to invoke SSH. If a command uses an alias whose HostName points at internal.example, give that alias the intended exception too. That keeps the rule attached to the actual configuration lookup rather than assuming a DNS-equivalent name selects the same block.