ssh_config's ProxyCommand allows to establish some connection to a proxy prior to establishing the connection to the actual target machine.

Simple question: how can I leverage the dynamic or SOCKS proxy functionality built into ssh such that I don't have to rely on nc or socat to be installed and TCP redirection to be compiled into the installed Bash?

I have literally only found examples of the above all over the web.


If the ssh on the proxy side is new enough (>= OpenSSH 5.4), you can use its -W option which works similar than nc. Add to the corresponding entry in your .ssh/config file:

ProxyCommand ssh -W %h:%p PROXYHOST


  ProxyCommand ssh -W %h:%p PROXYHOST
  • 2
    if the PROXYHOST takes a different user than TARGETHOST, you can specify it at the end of ProxyCommand with -l <proxyuser>. And for the TARGETHOST you specify it on a different line with User <targetuser> – Ciprian Tomoiagă Dec 20 '16 at 11:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.