The quickest way to send a browser’s web connections through an SSH server is a dynamic forward: ssh -N -D 127.0.0.1:1080 [email protected]. This opens a SOCKS listener on your computer. Configure the browser to use SOCKS5 at 127.0.0.1, port 1080, and enable remote DNS lookups. The browser then asks the local SSH client to reach each destination; the SSH server makes the onward connection from its own network.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
This is an application-level TCP proxy, not a device-wide VPN. Only programs configured to use the SOCKS endpoint are covered, UDP is not automatically carried, and the SSH server must be able to resolve and reach the sites you request.
As an Amazon Associate I earn from qualifying purchases.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallWhat an SSH SOCKS tunnel does
OpenSSH’s -D option creates a dynamic application-level forward. The SSH client listens on a local address and port and behaves like a SOCKS4/SOCKS5 server for a SOCKS-capable application. Your browser connects to that local listener, the SSH client sends the request through the encrypted SSH session, and the remote SSH server opens the connection to the destination.
For a website, the path is therefore:
- Your browser sends a SOCKS request to
127.0.0.1:1080. - The local SSH process carries the requested host and port through the SSH channel.
- The SSH server resolves the name when necessary and connects to the destination from its own network.
- Replies travel back over SSH to the local browser.
The public IP seen by a website will normally be the egress address of the SSH server, not your home connection. That only works when the server’s network permits outbound access and its account is allowed to use forwarding.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
What you need before starting
- A user account on a server with working SSH access.
- The server’s hostname or IP address and your SSH username.
- A server network that can reach the websites you need.
- An SSH client on your computer. OpenSSH is included with most Linux distributions, macOS, and current Windows installations; a graphical SSH client can also provide dynamic forwarding.
- A free local TCP port. Port
1080is conventional, but any unused local port works. - A browser or other application that supports a SOCKS proxy.
Test ordinary SSH login first. If you cannot establish a normal shell session, dynamic forwarding will not work; fix credentials, host-key prompts, firewall access, account restrictions, or server availability before changing proxy settings.
Start the dynamic SOCKS forward
Use the standard OpenSSH command
- Open a terminal.
- Run
ssh -N -D 127.0.0.1:1080 [email protected], replacing the username and server with your own. - Authenticate when prompted. Leave this terminal window open for as long as you want the proxy to operate.
-D 127.0.0.1:1080 tells SSH to listen only on the local loopback interface and dynamically forward destinations requested by SOCKS clients. Binding to loopback prevents other devices on your local network from using the listener accidentally. -N tells SSH not to run a remote command; the session exists solely for forwarding.
A successful command may appear to do nothing after authentication. That is expected: the SSH process is holding the tunnel open. Keep the session in the foreground so you can see disconnects and errors.
Choose another port when 1080 is occupied
If SSH reports “Address already in use,” another process already owns that local port. Select an unused port, such as 1081:
ssh -N -D 127.0.0.1:1081 [email protected]
Use exactly the same port in the browser’s proxy settings. Changing the browser alone does not change where SSH is listening.
Keep the session reliable
A dropped SSH session stops forwarding immediately. On networks that disconnect idle sessions, use OpenSSH keepalive options appropriate to your environment, such as ServerAliveInterval and ServerAliveCountMax. These send traffic over the SSH connection and can expose a dead path sooner; they do not keep a server reachable when the underlying network or account has failed. Do not assume a browser connection continues after the terminal reports that SSH has exited.
Recommended Free Tools
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Configure Firefox
Firefox exposes the clearest per-browser SOCKS controls, including an option to send DNS lookups through the proxy.
- Open the Firefox menu and choose Settings.
- Scroll to Network Settings and select Settings….
- Select Manual proxy configuration.
- In SOCKS Host, enter
127.0.0.1. - In Port, enter
1080(or the alternate port you selected). - Select SOCKS v5.
- Enable Proxy DNS when using SOCKS v5.
- Save the settings and open a new tab for testing.
Do not put http:// or socks5:// in the host field; the address is just 127.0.0.1. SOCKS v5 is the appropriate choice for this setup because Firefox can route its DNS requests through the SOCKS path when that option is enabled.
Configure Chrome and Chromium-based browsers
Chrome generally follows the operating system’s proxy configuration rather than offering the same complete per-profile SOCKS dialog as Firefox. Set the system or desktop proxy to a SOCKS5 server at 127.0.0.1 and the port used by SSH, then restart or reload the browser as required by your operating system.
Because DNS behavior depends on the operating system, browser build, and proxy integration, verify name lookups instead of assuming they are remote. If preventing DNS leakage is essential and your Chrome setup does not clearly provide remote DNS for SOCKS, use a browser configuration that explicitly supports “Proxy DNS when using SOCKS v5,” or choose a system-wide networking solution designed to handle DNS.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Proxy exclusions can silently bypass the tunnel. Review any “bypass,” “no proxy,” or local-address exceptions and remove entries that include the sites you intend to test.
Verify that traffic really uses the tunnel
Check the apparent public address
- With the SSH command still running, visit a reputable page that displays the connection’s public IP address.
- Confirm that the result corresponds to the SSH server’s network rather than your normal internet connection.
- Turn the SSH session off with
Ctrl-C, reload the page, and observe that the address returns to your normal connection. Restart the tunnel afterward if you need to continue.
The server’s address may not identify a precise city, and a hosting provider can have several egress ranges. The important check is that it belongs to the remote network and changes when the tunnel is removed.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Check hostname resolution
Open a hostname that requires a fresh DNS lookup, or use a DNS-leak test that reports which resolvers answered. With Firefox’s Proxy DNS when using SOCKS v5 enabled, the browser is intended to send those lookups through the proxy path. If a test still shows your local resolver, inspect the browser’s DNS settings, operating-system resolver behavior, extensions, and applications that bypass the proxy.
Test the actual sites you need
An IP check proves only that one browser request used the tunnel. Visit the services you care about, including any login, media, or regional endpoint, because the SSH server may have different DNS results, firewall rules, IPv6 behavior, or destination access from your local network.
DNS leaks and how to reduce them
SOCKS can carry a destination hostname, but a browser may resolve that hostname locally before it contacts the proxy. In that case, the web connection can use SSH while the DNS request exposes the domain to your local resolver. This is the most common leak in an otherwise correctly configured browser proxy.
- Use SOCKS5 rather than SOCKS4.
- In Firefox, enable Proxy DNS when using SOCKS v5.
- Check for browser features, extensions, or operating-system services that perform their own DNS resolution.
- Remember that applications outside the configured browser can continue using the normal resolver.
- Repeat a DNS test after changing networks, browser profiles, or proxy exclusions.
Remote DNS does not guarantee that every lookup on the computer is remote. It applies to requests made by the configured browser through its SOCKS implementation.
Scope: what is and is not tunneled
| Traffic or feature | Covered by this setup? | Reason |
|---|---|---|
| Configured browser’s TCP web connections | Yes | The browser sends them to the local SOCKS5 listener. |
| DNS from a browser with remote SOCKS DNS enabled | Intended to be yes | The browser asks the proxy path to resolve names. |
| Other desktop applications | No, unless separately configured | Only SOCKS clients pointed at the listener use it. |
| System services and background updaters | No | They retain their own network configuration. |
| UDP traffic | Not automatically | This dynamic forward is a TCP application proxy. |
| All device traffic | No | It is not a full-device VPN. |
This distinction matters for games and launchers: a browser tab can use the SSH server’s address while a game client, voice application, launcher, or update service continues to use the ordinary network. Applications that require UDP will not be transparently carried by this TCP SOCKS arrangement.
Security and privacy boundaries
What SSH protects
The SSH layer encrypts the connection between your computer and the SSH server. Someone observing that segment can see an SSH connection rather than the individual browser destinations carried inside it. The remote server, however, can observe and control the onward connections it makes, subject to the protections of the destination protocol.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
What HTTPS still does
HTTPS separately protects the browser-to-website session, including its contents, when the site is configured for HTTPS. SSH does not replace certificate validation or make an unsafe destination safe. Continue to check the browser’s HTTPS warnings and do not bypass certificate errors.
What the server operator can learn
The SSH host is the network vantage point for onward connections. Its operator can generally see connection metadata and, for destinations that do not use end-to-end encryption, may be able to read or alter traffic. Use an SSH account and server you trust, and treat the tunnel as a transport path rather than an anonymity guarantee.
Local exposure
Binding to 127.0.0.1 limits the SOCKS listener to the local machine. Do not bind it to a LAN or public interface unless you deliberately intend to provide a proxy to other devices and understand the access controls required. An exposed unauthenticated SOCKS listener can be abused to relay traffic.
Server-side requirements and restrictions
Dynamic forwarding depends on the SSH server’s policy as well as your local command. The account must be permitted to open forwarded connections, and the server must be able to resolve and reach the requested destination. An administrator may disable TCP forwarding, restrict which destinations can be reached, or place the host behind a firewall that blocks particular ports.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesIf the SSH login succeeds but every proxied site fails, ask the administrator whether forwarding is enabled and whether outbound connections are restricted. A server that can accept SSH connections is not necessarily a server that can reach every public website.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Troubleshooting by symptom
SSH login fails
- Confirm the username, hostname, port, and authentication method.
- Resolve host-key confirmation or changed-key warnings safely; do not blindly accept an unexpected key.
- Check local and server firewalls and whether the account is locked or restricted.
- Verify that ordinary SSH login works before testing browser settings.
“Address already in use” appears
Another local process owns the selected port. Stop that process if appropriate or choose an unused port such as 1081, then enter the same value in the browser.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
The browser says it cannot connect
- Make sure the SSH command is still running and authenticated.
- Confirm that the browser uses SOCKS5, host
127.0.0.1, and the exact listening port. - Check that a proxy-exclusion list is not bypassing the destination.
- Try a different site to distinguish a browser configuration error from a destination-specific failure.
The tunnel opens but sites fail
The SSH server may be unable to resolve the hostname, reach the destination, or open the requested port. Forwarding may also be disabled or filtered by policy. Test a hostname and service known to be reachable from the server, and ask the server administrator about outbound restrictions.
There is a DNS leak
Enable Firefox’s remote-DNS option, verify that the browser is actually using SOCKS5, and inspect extensions and operating-system services that resolve names independently. Applications not configured for the proxy will continue to use their normal DNS path.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Only some sites fail
Different destinations can have different policies, address families, and regional routing. Compare IPv4 and IPv6 behavior where your browser exposes it, check the remote server’s DNS result, and look for browser proxy exclusions. A site can also block the SSH server’s network while allowing your local connection.
The tunnel drops during use
Check the terminal for the disconnect reason and network interruptions. Use suitable SSH keepalive settings for your environment, then reconnect and retest. A browser cannot keep using a forwarding session after the SSH process has exited.
Stopping and changing the tunnel
Return to the terminal running SSH and press Ctrl-C. The local SOCKS listener closes immediately, and new browser requests revert to normal behavior only if the browser proxy settings are removed or disabled. To use the tunnel again, start the SSH command and re-enable the browser’s matching proxy configuration.
If you maintain several SSH endpoints, run each on a different local port and switch the browser between those ports. Never point the browser at a port unless an SSH process is actively listening there.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Choosing this method versus a VPN
| Decision factor | SSH dynamic forwarding | Full-device VPN |
|---|---|---|
| Application coverage | Only configured SOCKS-capable applications | Normally system-wide, depending on routes and exclusions |
| DNS handling | Must be configured and verified in each client | Usually handled by the VPN client or system tunnel |
| Protocol coverage | TCP application traffic; UDP is not automatic | Designed to carry broader IP traffic, including UDP where supported |
| Setup complexity | One SSH command plus per-application proxy settings | VPN client, profile, credentials, and route/DNS configuration |
| Server requirement | An SSH account with forwarding permission and suitable egress | A VPN server or service with compatible access |
| Authentication | SSH keys, passwords, or other SSH methods | VPN-specific credentials or certificates |
| Failure visibility | Visible terminal session; stopping it ends forwarding | Managed by the VPN client and its reconnect behavior |
Use SSH dynamic forwarding when you need a focused browser path through a server you control or administer. Choose a full-device tunnel when the requirement includes multiple applications, background services, UDP, or consistent DNS handling across the entire device.
Quick Recap
A repeatable setup checklist
- Confirm ordinary SSH access and verify that the server is allowed to forward connections.
- Start
ssh -N -D 127.0.0.1:1080 [email protected]. - Configure the browser for SOCKS5 at
127.0.0.1:1080. - Enable remote DNS in browsers that provide that setting.
- Check the apparent public IP and compare it with the SSH server’s network.
- Run a DNS-leak check and test the real sites you need.
- Keep the SSH process alive while browsing and stop it with
Ctrl-Cwhen finished.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
