Put the SOCKS Exit at the Last SSH Jump

Combine SSH jump-host transport with a local dynamic forward while keeping the final website-facing connection at the intended gateway.

Configure the final SSH server as the host, and put the intermediate server in ProxyJump:

Host proxy-exit
    HostName exit.example
    User operator
    ProxyJump [email protected]
    DynamicForward 127.0.0.1:1080

With authorized accounts on those hosts, start ssh -N proxy-exit. Configure the local application to use SOCKS at 127.0.0.1:1080. The listener is on the client; the SSH connection reaches exit.example through jump.example.

Requested website connections open from the remote side of the final SSH session—exit.example. The jump carries SSH transport to that host and does not become the SOCKS exit merely because it was the first reachable machine.

The destination sees the address selected by the exit host's routing and any NAT. It need not match the hostname's login address. Both servers need the forwarding permissions required for their roles, and host-key checks still apply to the intended SSH endpoints.

This configuration creates the SOCKS service through SSH dynamic forwarding. If the gateway already runs an independent SOCKS listener, reaching that listener with a fixed forward is a different arrangement.

འབྲེལ་བའི་རྩོམ་ཡིག