Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

is it any easy way to route all traffic through a ssh proxy with -D?

I can configure individual specific applications to do this, but I would like a configuration that routes all the traffic on the machine. Thanks for your help!

share|improve this question
Forgot to say that I was on linux so idealy, something by which I can route using iptables. – grm Feb 23 '10 at 8:13

In Linux:

  1. iptables -t nat -A OUTPUT ! -d -j REDIRECT --to 1081
  2. Run program that listens 1081, retrieves actual, non-redirected destination address, negotiates with SOCKS server and relays.

I have written such program for private usage in Perl (prototype quality) and writing a better version in C. It is not yet published.

Update: now published: Use Send me some notice if you interested in development of better version.

Update 2 Created a bit better version of it: and a patch for Socat 2:

P.S. Most of my (and sometimes some of neighbours') traffic now goes through the tcpsocks->ssh.

share|improve this answer
Very interesting project Vi. Thanks! I will give this a look. – grm Mar 15 '10 at 11:19
You should probably use more iptables rules to select which traffic do you want to be socksified. I use "iptables -t nat -A OUTPUT -j QQQ", then bunch of "iptables -t nat -A QQQ <checks> -j RETURN" and finally "iptables -t nat -A QQQ -p tcp -j REDIRECT --to 1234". – Vi. Mar 15 '10 at 11:53
Thank you! I've been wondering if this was doable, it was on my loong list of project ideas to try sometime. – Tobu Nov 19 '10 at 21:39
@Tobu, I have implemented this more: now there is a Socat patch (…) for this and also light-weight tcpsocks program ( – Vi. Nov 20 '10 at 14:40
See related: – ephemient Nov 20 '10 at 18:27

Avery Pennarun's sshuttle works similar to Vi's answer, but requires less setup and works on BSD and OS X as well as Linux.

share|improve this answer

Maybe you should considering setting up VPN instead.

share|improve this answer
Wouldn't that require more access on the gateway side? – grm Feb 23 '10 at 8:14
I got a VPN server (poptop) setup at home on Ubuntu. And at work I just use the builtin VPN client in windows to connect to it. No bother ing my network administrator or anything. – Espennilsen Feb 23 '10 at 8:53

I don't think there's any way to do this, but maybe you can try programs like FreeCap(windows), SocksCap(windows) or proxychains(linux). These programs may help you a little bit.

share|improve this answer

Depends which OS you are using. If you are on MacOS there are global Proxy settings which should be used by every Application, even though there are some who don't honor them (Firefox ie).

share|improve this answer
With MacOS in particular, trusting the global proxy settings needs to be verified. – chiggsy Nov 20 '10 at 21:17

You could also use something like Proxifier( for both Mac or Windows.

Though this doesn't really answer you question.

share|improve this answer
answer not at point – Alex H Jan 24 '13 at 10:01

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.