I want to use my computer as a SOCKS proxy. Do you just have to do
ssh -D port_number hostname? Do I have to put my Linux username as the
tl;dr -- seek the bold text below.
Note: I use
$ prefix for strings you have to substitute with your desired values. This syntax is not meant to be fully compatible with variables in any shell.
ssh -D is indeed like this:
ssh -D $port_number $hostname
ssh -D $port_number $username@$hostname
$hostname identifies some machine; it can be IP address, address resolvable via DNS or via
/etc/hosts file or via
ssh_config file etc. The first command will use your current (local) username unless your
ssh_config file tells otherwise (by default it doesn't). You need to provide credentials (like
$username and password when asked) valid to the
This will open the
$port_number TCP port on your local computer and establish a SOCKS server on it. Note you may not be allowed to open some ports as regular user, especially lower than
1024, use higher number then.
In general the situation without SOCKS proxy provided by
ssh is like this:
A -> D
A is a client (e.g. web browser),
D is a server (e.g. web server). But with proxy this is as follows:
A -> B -> C -> D
Arepresents a single client that uses
B:$port_numberas SOCKS address; there may be many clients.
Bis the machine where
ssh -D $port_number Cruns and where the TCP
$port_numberlistens for incoming connections from any
Bconnects to; communication that normally goes to
Dis any server, it sees communication from
Cand may not be aware that
Bare involved; there may be many servers.
Some of these letters may refer to same machine in some particular usage cases. Obviously any case where
C gives no direct advantage over simple
A -> D connection, but there are other useful cases.
Let's say you run the
ssh command shown above and you tell your local browser to use SOCKS at
localhost:$port_number. This is the case where
B. Your browser's traffic will be forwarded and sites you visit (
D) will see communication coming from the
C) as if your browser run there.
If you'd like other computers to connect to your open port (
B, they will use
$your_IP:$port_number as SOCKS server address) you need to:
- configure your firewall to allow incoming connections to TCP port
- tunnel each client e.g. via their own separate
sshconnection so their connections appear local (as if
B) to your already running
ssh -D ...thus firewall doesn't interfere nor
-gis necessary; this can be done by
ssh -L $some_port:localhost:$port_number $your_IPinvoked at their side or
ssh -R $some_port:localhost:$port_number $their_IPinvoked at your side; clients will use
localhost:$some_portas SOCKS server address in their browsers.
There's no reason
$hostname cannot be
localhost; it can. In this case
C. This is pointless when you use this SOCKS proxy with your local browser (
C) but if you allow connections from the outside then it makes perfect sense. I guess this is what you want to do. The command may be:
ssh -g -f -N -D $port_number localhost
You may want to establish key-based authentication so this
ssh connection from
localhost doesn't ask for your password. The above remark regarding firewall stands. Anyone able to use
$your_IP:$port_number as SOCKS server address will be seen by servers they visit as if they are at your computer.
Relevant fragments of
man 1 ssh:
Specifies a local "dynamic" application-level port forwarding. This works by allocating a socket to listen to
porton the local side, optionally bound to the specified
bind_address. Whenever a connection is made to this port, the connection is forwarded over the secure channel, and the application protocol is then used to determine where to connect to from the remote machine. Currently the SOCKS4 and SOCKS5 protocols are supported, and
sshwill act as a SOCKS server. Only root can forward privileged ports. [...]
sshto go to background just before command execution. [...]
Allows remote hosts to connect to local forwarded ports.
Do not execute a remote command. This is useful for just forwarding ports. [...]