Quick answer
How do I use SSH as a SOCKS proxy through my VPS?
Run ssh -D 127.0.0.1:1080 -N user@your-vps from your computer, then point an application at the SOCKS5 proxy 127.0.0.1:1080. Traffic leaves from the VPS address. A Gloamport Ember plan, 1 vCPU, 1 GB RAM, 20 GB NVMe, 1 TB traffic at $3.74 a month on the 12-month term, carries it, because OpenSSH is already on the server.
Which SSH options does a SOCKS proxy use?
| Option | Where | What it does |
|---|---|---|
| -D [bind_address:]port | ssh command line | Local dynamic forwarding: ssh acts as a SOCKS4/SOCKS5 server on that port |
| -N | ssh command line | Do not run a remote command; only forward |
| -f | ssh command line | Go to the background after authentication |
| -o ExitOnForwardFailure=yes | ssh command line | End the connection if the forwarding cannot be set up |
| DynamicForward | ~/.ssh/config | Same as -D, stored in the config file |
| ServerAliveInterval | ~/.ssh/config | Ask the server for a reply after this many silent seconds; the default 0 turns it off |
Option meanings from the OpenSSH ssh and ssh_config manual pages.
What does an SSH SOCKS proxy do, and what does it not do?
An SSH SOCKS proxy sends the traffic of the applications you point at it through an encrypted SSH connection to your VPS, which then opens the real connections. The ssh manual describes -D as local dynamic forwarding in which ssh acts as a SOCKS4 or SOCKS5 server, and the remote machine reads the destination from the application protocol.
The websites you visit then see the VPS address, not your home address. Three things stay the same. Only applications configured for the proxy use it; the rest of your system goes out the usual way. Your VPS provider can see the connection from your address to the VPS. And the sites you log in to still know who you are. A SOCKS proxy moves the origin of requests; it does not hide your identity from the services you sign in to. If you need every application on a device routed, use a tunnel instead: How do I set up WireGuard on a VPS?.
How to use SSH as a SOCKS proxy
You need a VPS you can already log in to over SSH. If you have no key yet, start with the key guide.
Log in once to confirm access
Connect with ssh root@YOUR_VPS_IP or the user you created. Gloamport hands you root over SSH: the key you pasted at checkout, or a temporary root password if you left the field empty. Change that password at first login.
Open the dynamic forward
On your own computer, run the first command in the code block below. The terminal stays busy and prints nothing: the proxy is open for as long as it runs. Binding to 127.0.0.1 keeps the port reachable from your computer only.
Test it with curl
In a second terminal, run the curl command from the code block. --socks5-hostname makes the proxy resolve the name, so DNS lookups also go through the VPS. Replace example.org with an address-check page of your choice to see the VPS address.
Point your browser at the proxy
In the browser’s network settings choose a manual proxy: SOCKS host 127.0.0.1, port 1080, SOCKS v5. Turn on the browser’s option to resolve DNS through the proxy (Firefox labels it “Proxy DNS when using SOCKS v5”) so lookups do not leak to your local resolver.
Run it in the background if you want
Add -f and -o ExitOnForwardFailure=yes to the command. ssh then goes to the background once the forward is up, and stops with an error if the port is taken. Stop it later with the kill command in the code block.
Save it in ~/.ssh/config
Put a Host entry with DynamicForward and ServerAliveInterval in your SSH config, then start the proxy with ssh -N gloam-proxy. The alive messages keep an idle connection from being dropped silently.
# Foreground: the proxy lives as long as this command runs
ssh -D 127.0.0.1:1080 -N root@YOUR_VPS_IP
# Test from a second terminal; the proxy resolves the name too
curl --socks5-hostname 127.0.0.1:1080 https://example.org/
# Background version
ssh -f -N -o ExitOnForwardFailure=yes -D 127.0.0.1:1080 root@YOUR_VPS_IP
# Stop the background proxy
pkill -f "ssh -f -N -o ExitOnForwardFailure=yes -D 127.0.0.1:1080"Host gloam-proxy
HostName YOUR_VPS_IP
User root
DynamicForward 127.0.0.1:1080
ServerAliveInterval 30
ExitOnForwardFailure yesWhich Gloamport plan is enough for an SSH proxy?
The smallest plan is enough, since the server only relays bytes. Ember gives 1 vCPU, 1 GB RAM, 20 GB NVMe, 1 TB traffic for $3.74 a month on the 12-month term, and $22.44 for 3 months. The traffic figure matters more than the CPU: everything you browse counts against the plan’s monthly allowance. One IPv4 address and an IPv6 /64 per VPS, on a 1 Gbit/s port. The traffic of a plan counts outgoing data only, and passing it never creates a bill by itself.
A heavier use, such as several people sharing one proxy, is a reason to step up to Dusk at $5.25 a month, which is sized for A VPN plus a Tor relay or an onion site. Plans come in 1, 3, 6 and 12-month terms, with 3 months at least for Ember and Dusk; see the plans and terms.
How do you make the SSH side safe before you route traffic through it?
Use a key, not a password, and turn password logins off once the key works. That keeps the one open port on your VPS from being a guessing target. The steps are in How do I generate an SSH key for my VPS? and How do I harden SSH on a new VPS?.
A second point is the bind address. The ssh manual says a -D port follows the GatewayPorts setting unless you give an address, and that an empty address or * exposes the port on all interfaces. Always write 127.0.0.1 in front of the port, as in the commands above, so nobody else on your network can use your proxy.
Is an SSH SOCKS proxy better than a VPN?
An SSH proxy is quicker to set up and a VPN covers more. The proxy needs one command and no server software, but it handles only the applications that speak SOCKS. A VPN tunnel carries all traffic from the device. According to Gloamport’s survey of 10 November 2026, 28 of the 49 providers listed ask for no ID document at sign-up, so a server to run a proxy on does not have to cost you your documents. For a longer comparison read Is a self-hosted VPN on a VPS better than a VPN service?.
In summary
- ssh -D 127.0.0.1:1080 -N user@vps makes a local SOCKS5 proxy that exits from the VPS.
- Nothing extra is installed on the server; OpenSSH is enough.
- Use curl --socks5-hostname so DNS is resolved through the proxy as well.
- Bind to 127.0.0.1; an empty bind address exposes the port on every interface.
- Only applications set to use the proxy go through it; a VPN carries everything.
- Ember, $3.74 a month on 12 months, runs it.
- Log in with a key, then switch password logins off.
SSH SOCKS proxy: common questions
Does ssh -D work with SOCKS4 and SOCKS5?
Yes. The ssh manual says ssh acts as a SOCKS4 or SOCKS5 server for -D. Use SOCKS5 where the application offers it, because it can pass host names to the proxy.
Why does my browser still use my local DNS?
The browser resolves names itself unless you tell it to send lookups through the proxy. Turn on the remote DNS option for SOCKS v5, and use curl --socks5-hostname for tests.
How do I keep the proxy from closing when idle?
Set ServerAliveInterval in ~/.ssh/config, for example 30. Its default is 0, which sends no alive messages at all.
Can I share the proxy with other devices on my network?
You can by changing the bind address, but it exposes the proxy to every device that can reach that port. Keep 127.0.0.1 unless you protect the port with a firewall.
Can I chain it through another host?
Yes. ssh -J (ProxyJump) connects through one or more jump hosts first; configure the jump hosts in ~/.ssh/config, because command-line options apply to the destination only.
Sources (3)
- ssh(1) manual page: -D, -N, -f, -J — OpenBSD / OpenSSH (checked 2026-11-10)
- ssh_config(5) manual page: DynamicForward, ExitOnForwardFailure, ServerAliveInterval — OpenBSD / OpenSSH (checked 2026-11-10)
- curl manual: --socks5-hostname — curl project (checked 2026-11-10)