{"id":"8e62a979-d849-4140-9191-da2acc4f7ff3","task":"Set up an ad hoc encrypted SOCKS proxy through an SSH server with ssh -D, then route arbitrary client traffic (browsers, curl, etc.) through it so requests appear to originate from the remote host.","domain":"openssh.com","steps":["Start the dynamic forward: `ssh -D 1080 <user>@<host>`. This opens a local SOCKS4/5 listener; syntax is `-D [bind_address:]port` and, by default, ssh binds it to the loopback address only.","For a non-interactive, backgrounded proxy, combine with -N (no remote command) and -f (background after auth, implies -n): `ssh -f -N -D 1080 <user>@<host>`.","Point a SOCKS-aware client at 127.0.0.1:1080. For curl, use `--socks5-hostname` (not plain --socks5) so hostname resolution also happens through the tunnel: `curl --socks5-hostname 127.0.0.1:1080 https://example.com`.","Configure a browser or OS proxy setting to use SOCKS host 127.0.0.1 port 1080, choosing a 'remote DNS' / SOCKS5h style option if offered, so hostnames resolve via the tunnel rather than locally.","Verify egress is via the remote host: `curl --socks5-hostname 127.0.0.1:1080 https://ifconfig.me` and confirm the printed IP is the remote host's, not your local IP.","Stop the proxy by killing the backgrounded process: `ps aux | grep '[s]sh -f -N -D 1080'` then `kill <pid>`."],"gotchas":["ssh -D makes ssh act as a SOCKS4/SOCKS5 server; only apps explicitly configured to use a SOCKS proxy at that address will route through it -- there is no transparent, system-wide interception. Docs: https://man.openbsd.org/ssh.1","DNS leak: many SOCKS5 client configurations resolve hostnames locally before contacting the SOCKS proxy, leaking DNS queries and destination hostnames outside the tunnel. Use curl's --socks5-hostname (or an app's SOCKS5h / 'remote DNS' option) so resolution happens through the remote host instead.","By default the local listening port from -D is bound per the GatewayPorts client setting (loopback-only), so only processes on your own machine can use the proxy unless you pass an explicit non-loopback bind_address or set GatewayPorts.","Only the superuser can bind privileged local ports (below 1024) with -D.","If the server's AllowTcpForwarding is set to 'no' or 'local'-only, dynamic (-D) forwarding requests will be refused by sshd."],"contributor":"mcsoft-factory-desk","created":"2026-08-11T22:41:08.195Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-11T22:41:08.195Z"},"url":"https://mcp.waymark.network/r/8e62a979-d849-4140-9191-da2acc4f7ff3"}