How to connect to SSH servers through a SOCKS or HTTP proxy

• Locked-down networks. Some office, school and hotel networks block outgoing SSH but offer an HTTP or SOCKS proxy for everything that leaves.
• Allow-listed servers. A server's firewall may accept SSH only from a set of addresses, such as your office's proxy, rather than from wherever you happen to be.
• Going through a machine you trust. A SOCKS proxy can be any computer you control, including one you start yourself with SSH (see below).
• Keeping your own address out of server logs, where policy calls for it.

If none of these apply, connect directly: a proxy adds a stop on the way and one more thing that can be down.

• SOCKS5 (port 1080 by default): the usual choice. User name and password are optional, and the proxy looks up the server's name, so names that only exist on the proxy's network work.
• SOCKS4 (port 1080): older. It has no password; the user name is sent as its user id, and your PC looks up the server's name.
• HTTP (port 8080 by default): uses the CONNECT method, so the proxy must allow CONNECT to the server's SSH port (often only 443 is allowed). Its password is sent to the proxy in the clear (HTTP Basic), so only use it with a proxy you trust.

1. 1

   Step 1: Add or edit the host

   In the RemoteAccessApp app on Windows, open the Connections page and click Add host, or edit a saved host. Choose SSH or SFTP and fill in the server's address, user and sign-in as usual.

2. 2

   Step 2: Tick Connect through a proxy

   In the host's settings, tick Connect through a proxy. Pick the type: SOCKS5, SOCKS4 or HTTP.

3. 3

   Step 3: Enter the proxy's address and port

   Type the proxy's name or address under Proxy and its port next to it. The port starts at the usual one for the type you picked.

4. 4

   Step 4: Add the proxy's user and password, if it has them

   Both are optional. The hint under the fields says how the type you chose uses them. The proxy password is kept like the host's own password.

5. 5

   Step 5: Save, connect and check the server's key

   Save the host and connect. The first time, check the server's key fingerprint before you trust it, exactly as you would without a proxy; see server keys.

If you can SSH to one machine (a jump server) that can reach the others, OpenSSH can turn it into a SOCKS proxy on your own PC. In PowerShell or Command Prompt on Windows 10 or 11, run:

ssh -D 1080 -N [email protected]

Leave that window open. Then set the hosts behind the jump server to SOCKS5, proxy localhost, port 1080, with no user or password. Their names are looked up by the jump server, so internal names work.

Once a host has a proxy, everything that uses that host goes through it: the SSH terminal, the SFTP file browser, server-to-server copies, the server tools, and the SSH tunnel of a VNC host. FTP hosts always connect directly. If you move files between servers often, how server-to-server file transfers save DevOps time explains where those copies fit.