Connect SSH Through an HTTP Proxy

With an OpenBSD-compatible nc, add this host entry to the SSH client configuration, such as ~/.ssh/config:

Host work-through-proxy
    HostName ssh.example.com
    User alex
    ProxyCommand nc -X connect -x proxy.example.net:8080 %h %p

Use ssh work-through-proxy for that route. The helper asks the HTTP proxy for CONNECT to ssh.example.com and passes the accepted stream to SSH. Directly pointing SSH at the proxy's port would send its handshake to a service expecting HTTP.

Replace the endpoint, destination and account. For a publicly reachable SSH destination where a public intermediary is allowed, the HTTP proxy list offers candidates to check for access to that host and port; select an endpoint needing no proxy account for the command shown. These OpenBSD nc options are implementation-specific; another executable named nc may not support them.

The proxy can require its own login or deny the requested SSH port. A 407 concerns that proxy exchange. After the tunnel opens, SSH still verifies the target host and authenticates its user; a rejected SSH key is a different failure.

Keep the ProxyCommand under the intended Host section and use the selected helper's supported proxy-authentication path when required. The command supplies a stream, not permission through the intermediary. If only HTTPS destinations are allowed, obtain an approved SSH access arrangement rather than assume another command spelling changes the policy.