Create a Local SOCKS Proxy with SSH

With authorized SSH access to a server, OpenSSH can create a SOCKS listener on your computer. The SSH connection carries the forwarded traffic, and the remote server makes the destination connection.

A loopback-only listener

ssh -N -T -o ControlPath=none -o ForkAfterAuthentication=no -o ExitOnForwardFailure=yes -D 127.0.0.1:1080 [email protected]

Replace the account and hostname. The SSH server must permit forwarding; its administrator can restrict forwarding and destinations independently of account login.

-D creates dynamic forwarding, and the explicit loopback address limits the listener to this machine. -N omits a remote command; -T omits a pseudo-terminal. ControlPath=none avoids an existing sharing master, while ForkAfterAuthentication=no keeps this invocation in the foreground.

Keep the process running while using the proxy. If port 1080 is occupied, choose another unused high port and update the client. ExitOnForwardFailure=yes makes SSH exit if it cannot create the listener.

Using the SOCKS endpoint

curl --proxy socks5h://127.0.0.1:1080 --noproxy '' --connect-timeout 5 --max-time 15 https://example.com/

This request delegates destination-name handling through SOCKS5. Other applications need their own SOCKS configuration; an HTTP-proxy field cannot speak SOCKS to this listener.

To check which process owns the port:

ss -ltnp 'sport = :1080'

The intended SSH process should own a loopback listener. A request through it checks whether the remote server can also reach the target. Use a controlled destination when you need to inspect the observed exit.

Session lifetime

Ctrl-C closes the SSH process, listener, and forwarded connections. A dropped SSH connection likewise makes the proxy unavailable.

ExitOnForwardFailure checks setup. It does not terminate SSH whenever a later destination connection fails, so diagnose the session, local port, and destination request separately.