I want to setup my OSX system such that all network traffic is done through an SSH tunnel.

I've written a small script for this purpose, and these are the commands executed by it:

# setup tunnel
ssh -fN -D 1080 -p 22 user@remote

# start up redsocks
sudo redsocks -c /tmp/redsocks.conf -p /tmp/redsocks.pid

# forward all tcp traffic to tunnel
sudo ipfw add 0010 \
    fwd,12345 \
    tcp from me \
    to any not dst-port 12345 \
           not dst-port 1080 \
           not dst-ip REMOTE_IP

I use redsocks to create an http proxy to my ssh-tunnel (so that i can forward all tcp traffic to it via ipfw), redsocks.conf looks like this:

base {
    log_debug = on;
    log_info = on;
    log = "file:/tmp/redsocks.log";
    redirector = generic;
redsocks {
    local_ip =;
    local_port = 55660;
    ip =;
    port = 1080;
    type = socks4;

Everything seems to work so far, all TCP traffic on my OSX system is done through the ssh tunnel, but the problem is with UDP traffic and because of that DNS queries are not working.

How can I get DNS on my local machine to work through the SSH tunnel?

  • You might take a look at this question. Its not easy.. SSH tunneling is really for TCP traffic.
    – heavyd
    Aug 19, 2013 at 19:03
  • Since you're on OSX, this answer might help you. Seems overly complicated though. Aug 28, 2013 at 17:55

3 Answers 3


Your ipfw … line only forwards TCP traffic. Maybe add the following line?

sudo ipfw add 0011 fwd,12345 \
                   udp from me \
                   to any not dst-port 12345 \
                          not dst-port 1080 \
                          not dst-ip REMOTE_IP

It's also a good idea to add set -x (for debugging) and set -e (to fail immediately if any of the commands fail).

  • One should generally use the term 'SSH tunneling' to refer to tun/tap with SSH.
  • Port-forwarding is a specific form of tunneling, but it should be still only be referred to as 'port forwarding' in this context.
  • Do not use SSH tunneling (as in -oTunnel and -oTunnelDevice) except for quick ad-hoc jobs.
  • DNS can use TCP as a transport. It is not restricted to UDP, though that is the preferred transport.

Use sshuttle instead? sshuttle claims to handle DNS and TCP correctly, without this amount of fiddling - just the --dns option.

IME SOCKS seemed a bit old and unloved. And I don't really understand this use of ipfw and redsocks.

However I would point out that SOCKS4 doesn't support tunneling DNS, so I'm not surprised you're having problems. Subsequent versions of SOCKS do support it, so you could look at that. And apparently SSH can support SOCKS5.

  • While this does not exactly answer the original question, it is the easier solution to the problem. Jun 10, 2021 at 9:28

Besides what you are already using, sSH permits tunneling all IP traffic, independet from the employed layer 4 protocol. Your remote server must have PermitTunnel yes and the client must request a tunnel using the Tunnel directive. Then you can use that new link as your default gateway. See detailed instruction for the tunnel here.

  • Do you know if I can do this with the WinSSHD server from Bitvise on Windows? Aug 27, 2013 at 4:40
  • @CihatKeser: I don't, I'm afraid. But as you are paying money for it, I would expect they have a support to answer this question. Aug 27, 2013 at 14:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.