How to Create an SSH Dynamic SOCKS5 Proxy Tunnel on Linux VPS (OpenSSH, PuTTY & Browser Guide)

Routing your web traffic through an encrypted SSH Dynamic SOCKS5 Proxy Tunnel turns any remote Linux VPS or bare-metal dedicated server into a private, high-speed encrypted proxy. Unlike commercial VPN services that require dedicated client software, an SSH SOCKS5 tunnel leverages the native OpenSSH protocol to bypass local firewall restrictions, prevent ISP packet inspection, mask your home IP address, and encrypt web browsing sessions on public Wi-Fi networks.

This technical guide provides step-by-step instructions for establishing dynamic port forwarding on Windows (PuTTY & OpenSSH), macOS, and Linux, configuring major web browsers (Chrome, Firefox, Edge) to prevent DNS leaks, and verifying proxy routing. If you want to compare encrypted proxy protocols against graphical remote sessions, explore our analysis on RDP vs VPN for Remote Access.

Why use an SSH SOCKS5 proxy tunnel?

• End-to-End Encryption: All browser requests between your computer and the VPS are encrypted using modern SSH ciphers (ChaCha20-Poly1305, AES-GCM).
• Zero Additional Software on Server: SOCKS5 dynamic proxying is built into the standard OpenSSH daemon (sshd)—no proxy packages (Squid, Shadowsocks) required.
• Remote DNS Resolution: SOCKS v5 forwards domain name queries through the tunnel, preventing DNS hijacking and DNS leak tracking.
• Granular Application Routing: Only applications explicitly pointed at 127.0.0.1:1080 use the tunnel, leaving other computer network traffic unaffected.

Method 1: Create SSH tunnel via OpenSSH terminal (macOS, Linux & Windows 11)

The fastest way to launch an encrypted SOCKS5 proxy on macOS Terminal, Linux shell, or Windows PowerShell:

1. Open your terminal and run the dynamic forwarding command (replace 198.51.100.50 with your VPS IP address):

   # Create background dynamic SOCKS5 proxy on local port 1080
   ssh -D 1080 -C -q -N [email protected]

2. Command parameters explained:
   • -D 1080: Binds a local dynamic SOCKS5 listening socket on 127.0.0.1:1080.
   • -C: Enables gzip payload compression to speed up web browsing.
   • -q: Quiet mode (suppresses background warnings).
   • -N: Tells SSH not to execute remote commands (pure proxy forwarding).
3. Verify your local proxy socket is actively listening:

   # Verify local SOCKS5 listener
   ss -tulpn | grep 1080

Method 2: Create SSH tunnel using PuTTY (Windows GUI)

If you prefer using the classic PuTTY client on Windows:

1. Launch PuTTY. In the Host Name (or IP address) field, enter your VPS IP and ensure port is set to 22.
2. In the left sidebar category tree, expand Connection > SSH > Tunnels.
3. In the Source port field, enter 1080.
4. Under Destination, select the Dynamic and Auto radio buttons. Leave the Destination text box blank.
5. Click the Add button. You will see D1080 appear in the Forwarded ports list.
6. Click Session in the top-left, enter a name (e.g. VPS SOCKS Proxy), and click Save.
7. Click Open and log in with your root credentials. Keep the PuTTY window minimized in the background.

Step 3: Configure web browser proxy settings

Route your web browser traffic through the active tunnel:

Mozilla Firefox (Recommended — Native SOCKS DNS support)

1. Open Settings > General, scroll to the bottom, and click Settings… next to Network Settings.
2. Select Manual proxy configuration.
3. In the SOCKS Host field, enter 127.0.0.1 and Port 1080.
4. Select SOCKS v5.
5. Check the box for Proxy DNS when using SOCKS v5 (prevents local ISP DNS leaks).
6. Click OK.

Google Chrome, Microsoft Edge, and Brave

Launch Chrome with dedicated proxy flags to avoid altering your entire Windows system proxy:

# Launch Chrome isolated through SOCKS5 proxy with remote DNS
chrome.exe --proxy-server="socks5://127.0.0.1:1080" --host-resolver-rules="MAP * ~NOTFOUND , EXCLUDE 127.0.0.1"

Step 4: Verify proxy egress IP and DNS leak protection

Confirm your proxy connection is functioning properly:

1. Run a quick curl test through the local SOCKS5 port:

   # Query public egress IP through SOCKS5 proxy
   curl --socks5-hostname 127.0.0.1:1080 https://api.ipify.org

2. The command will output your VPS IP address.
3. Visit IPLeak.net in your configured browser to confirm that your public IP and DNS resolvers originate exclusively from your remote hosting facility.

To secure access to your server ports, explore our tutorials on How to Change Default SSH Port and Configuring CSF Firewall on Linux.

For high-bandwidth, unmetered proxy infrastructure with dedicated static IPv4/IPv6 addresses, explore Aminserve Linux Cloud VPS and Swiss Offshore Servers.