How could I route my SSH traffic through shadowsocks?

I am connecting from behind the Great Fire Wall to a server using shadowsocks. I would like to make outgoing SSH connections but I am concerned that SSH traffic could be identified and so result in my connection getting shutdown. Hence, I would like to be able to route the SSH traffic through the SOCKS5 proxy that I already have working.

Where do I start to achieve this? I assume I need to create a virtual network adaptor that can present a range of ports from which the output is routed over the SOCKS5 proxy somehow?

3 Answers 3


If your configuration of shadowsocks is:

  • local address :
  • local port : 1080
  • server ip

change for your own configuration

sudo apt install connect-proxy

Edit your ~/.ssh/config

# Outside of the firewall, with HTTPS proxy
  ProxyCommand connect -H %h 22
## Inside the firewall (do not use proxy)
Host *
  ProxyCommand connect %h %p

Now you can try:

ssh username@ipserver

check ip connection

netstat -tn 2>/dev/null

normally you can see something like that

Connexions Internet actives (sans serveurs)

Proto Recv-Q Send-Q Adresse locale          Adresse distante        Etat       
tcp        0     68      ESTABLISHED

More skills

Add this script to your ~/.bash_profile.


export http_proxy=socks5://
export https_proxy=socks5://



export http_proxy=
export https_proxy=

if you want setup webconnection for your Web browser

Gui way (gnome)

  1. setting
  2. network
  3. proxy server
  4. enter your configuration
  5. don't forget to disable proxy for localhost

enter image description here

or just add all proxy redirection to your env

env | grep -i proxy

must be return


if you just want config curl through shadowsocks

export socks5=socks5://


curl api.ipify.org

For Git

git config --global http.proxy 'socks5://'
git config --global https.proxy 'socks5://'
  • I'd like to add a note - if you are doing SSH for a user@my-server ( like when connecting to EC2 in the default way) then replace the server IP with the part at my-server
    – tt_Gantz
    Oct 17, 2018 at 3:01

There is an easier way, use a match directive in your ssh config file:

Match Exec "nc -z 1086"
     ProxyCommand nc -X 5 -x %h %p

This directive will execute every time you ssh (Matches everything). First it tries to connect to your shadowsocks proxy using nc: the -z option just means to check the port with no IO. My ssocks proxy runs on port 1086. If it's running, then set a ProxyCommand, if it doesn't, don't, and connect normally, without a proxy.


tsocks works for me on Ubuntu 18.04:

sudo apt install tsocks

Configure it in /etc/tsocks.conf:

# Local networks accessible without socks server
local =
# Socks server address
server =
# Server type SOCKS5
server_type = 5
# Server port
server_port = 1080

Then you can go by:

tsocks ssh USER@SERVER

Had to also configure SSH timeout in SERVER's /etc/ssh/sshd_config:

# 10 minutes
ClientAliveInterval 10m
# Max number of client alive messages without response
ClientAliveCountMax 3

This would automatically disconnect a client after 30 minutes. (See man sshd_config for details about the meaning of these two parameters.)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .