Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Possible Duplicate:
SSH and port forward socks proxy

When I set up a tunnel using dynamic forwarding (ssh -D), which side is running the SOCKS proxy? That is, is the proxy running on the local end (client) or the remote end (server)?

Here's the situation: I want to set up several tunnels chained together using -L. Should the -D tunnel be the last one in the chain or the first one?

Edit: I found the answer to the second paragraph on Super User (the -D tunnel should be at the remotest end). But I'd still like to know where the proxy code is running.

share|improve this question

marked as duplicate by Wesley, Michael Hampton, rnxrx, Scott Pack, Iain Sep 24 '12 at 21:12

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

A quick perusal of the OpenSSH sources reveals:

The local ssh client handles -D very simply, just like all other forwarding sockets: listen locally, push over a channel to the server.

The remote sshd server handles all the proxying involved with SSH_CHANNEL_DYNAMIC, including decoding SOCKS headers, making outbound connections, and multiplexing the data.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.