SSH with a SOCKS Proxy

ssh has no proxy option of its own. It runs the command in ProxyCommand, which opens the connection through the proxy and hands it to ssh; %h and %p stand for the server and port.

With your IP on the allowlist (no proxy login), the netcat that ships with macOS and most Linux systems is enough:

ssh -o ProxyCommand="nc -X 5 -x PROXY_HOST:PROXY_PORT %h %p" [email protected]

-X 5 selects SOCKS5 and -x names the proxy. This netcat sends a proxy login (-P user, with the password prompted) only to HTTP proxies (-X connect), not to SOCKS5 proxies, so for SOCKS5 it needs your IP on the proxy's allowlist.

With a username and password, use Nmap's ncat:

ssh -o ProxyCommand="ncat --proxy PROXY_HOST:PROXY_PORT --proxy-type socks5 --proxy-auth PROXY_USER:PROXY_PASS %h %p" [email protected]

The same command with --proxy-type http goes through the HTTP proxy instead (it opens the connection with CONNECT), which works when SOCKS5 isn't an option.

Write the proxy once per host instead of on every command:

Host myserver
    HostName server.example.com
    User me
    ProxyCommand nc -X 5 -x PROXY_HOST:PROXY_PORT %h %p

Then ssh myserver, scp file myserver: and sftp myserver all go through the proxy, and other hosts connect directly. Prefer the allowlist here: a password in a ProxyCommand line sits in plain text in the file. If you must use one, keep the file readable only by you (chmod 600 ~/.ssh/config).

OpenSSH on Windows 10 and 11 reads the same ProxyCommand. Windows has no nc, so use ncat from the Nmap installer, or connect.exe, which comes with Git for Windows:

Host myserver
    HostName server.example.com
    ProxyCommand "C:\Program Files\Git\mingw64\bin\connect.exe" -S PROXY_USER@PROXY_HOST:PROXY_PORT %h %p

connect reads the proxy password from the SOCKS5_PASSWORD environment variable; -H instead of -S uses the HTTP proxy.

PuTTY has the proxy built in:

1. Open Connection → Proxy.
2. Set Proxy type to SOCKS 5, and enter the proxy's address in Proxy hostname and its port in Port.
3. Enter the proxy's Username and Password.
4. Go back to Session, enter your server, save the session and select Open.

Git uses ssh for git@ remotes, so a Host block in ~/.ssh/config covers git clone, pull and push:

Host github.com
    ProxyCommand nc -X 5 -x PROXY_HOST:PROXY_PORT %h %p

For one command only, set GIT_SSH_COMMAND='ssh -o ProxyCommand="nc -X 5 -x PROXY_HOST:PROXY_PORT %h %p"' before it. HTTPS remotes use the HTTP proxy instead (git config --global http.proxy http://<login>:<password>@gate.proxyfield.io:7000); see Linux for setting it system-wide.

An SSH session is one long TCP connection, and a TCP connection through a proxy keeps one exit IP for its whole life. Rotation matters between connections: on a rotating proxy, each new ssh, scp or git command may leave from a different IP. If the server only accepts known IPs, or you don't want it to see a new address every time:

• use a sticky session in the username, which keeps one IP for 30 s to 36 h;
• or a dedicated ISP proxy, one IP for 30 days: from $2.29 per IP (static residential (ISP) proxies).

ssh -D turns an SSH connection into a SOCKS proxy on your computer, and the traffic exits from the SSH server:

ssh -D 1080 -N -C [email protected]
curl --socks5-hostname 127.0.0.1:1080 https://api.ipify.org   # prints the server's IP

-D 1080 opens the SOCKS proxy on 127.0.0.1:1080, -N runs no remote command and -C compresses. Point a browser or app at 127.0.0.1:1080 as a SOCKS5 proxy with "proxy DNS" on, and it browses from the server's IP. This gives you one IP, the server's, in the server's country. ProxyField is the other way round: 412M+ residential IPs in 195+ countries, without a server to run.

ssh -R 1080 user@server (OpenSSH 7.6 or later) is the reverse: it opens a SOCKS proxy on the server whose traffic exits from your computer.

ssh -v shows each step, including the ProxyCommand it runs. To check your ProxyField login itself, run curl -x http://<login>:<password>@gate.proxyfield.io:7000 https://api.ipify.org or use the proxy checker; more commands are on cURL. Gateway error messages: 407 Proxy Authentication Required for a wrong login or password, an IP not on the allowlist or a malformed location, 402 Payment Required when no traffic is left and 502 Bad Gateway when no exit could be connected; a restricted site gets no separate response, and a 403 comes from the site itself. Our 24/7 live chat helps with setup and integration.

Connect only to servers you are allowed to use. Scanning, password guessing and attacks on systems are not allowed under our acceptable use policy, and some site categories are restricted to protect the network, including financial and government services.

Start with the Easy Trial: 1 GB for $2.95, with no minimum purchase and no subscription. The traffic never expires and all purchases are final. See pricing per GB and SOCKS5 proxies.