Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have two web servers each with a public IP that make outbound SFTP connections to various SFTP servers to update content. I would like to setup a Forward proxy for SFTP outbound connections. Does such a proxy exist?

share|improve this question
But... why??? – womble Aug 3 '11 at 8:13

You can proxy SSH connections (and thus also SFTP which is encapsulated within a SSH connection) by using a generic SOCKS proxy. I am not aware of any protocol-specific proxies for SSH/SFTP.

(It would be easier to answer if you gave a hint about your ultimate objective. What is the purpose of wanting to have the proxy?)


Using SSH to tunnel SSH through a proxy:

  1. Install tsocks on the clients which are initiating the SFTP connections.

  2. In your /etc/tsocks.conf set the following:

    server =
    server_type = 5
    server_port = 1080
  3. Open a background SSH connection to your SFTP proxy machine as follows:

    ssh -D 1080 -f -n -N

    ...or if you want it to close automatically after 5 minutes:

    ssh -D 1080 -f -n 'sleep 300'

    (If you do this from a script, you probably need to add -i keyfile in the client and a put a corresponding entry in ~/.ssh/authorized_keys in the SFTP proxy server if you want to open the connection from a script without user attention.)

  4. Run the SFTP operations through the proxy by using the tsocks wrapper:

    tsocks sftp

    (This SFTP connection will look in as if it was initiated from

Alternative method with Dante:

Alternatively you could install dante-server (a SOCKS proxy server software) on the proxy machine and configure your /etc/tsocks.conf to connect there instead of Then just run your SFTP operations with the tsocks wrapper as in the step 4 above. If you do this, you need to make sure that the dante server is configured so that it does not allow connections from unauthorized users.

Hope this helps!

share|improve this answer
My goal is to have all outbound SFTP connections look like they came from the same public IP, instead from the Public IP of the Web server that served the outbound SFTP connection. – Brian Scott Aug 3 '11 at 16:03
Thanks for the clarification. I will update my answer. – snap Aug 3 '11 at 16:10

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.