Setting Persistent Reverse SSH SOCKS Proxies on Windows

Abstract: Learn how to set up a persistent reverse SSH SOCKS proxy on Windows using OpenSSH command line options. SOCKS proxies allow you to forward connections to a remote server, and with a persistent reverse proxy, you can maintain a stable connection for extended periods.

Created: 2025-01-26 by UserComp.com Editors

SSH supports setting reverse SOCKS proxies, such as using the -R command-line option with OpenSSH.

SOCKS proxies, except for port listening connections on the remote side, work by creating a tunnel from the local machine to the remote machine through the SOCKS proxy server.

To set up a reverse SOCKS proxy using OpenSSH, follow these steps:

Install OpenSSH on your local and remote machines.
On the remote machine, open the SSH daemon configuration file. This file is usually located at /etc/ssh/sshd_config.

Add the following line to the configuration file, replacing localhost with the IP address of your local machine and <local_port> with the desired local port:

GatewayPorts clientspecified

AddressFamily inet

UsePrivilegeSeparation yes

SSHProxyCommand /usr/bin/nc %h %p %r

Match Address <remote_IP>

ChrootDirectory /var/chroot/%u

X11Forwarding no

AllowTcpForwarding yes

ForceCommand internal-sshd

AllowGroups ssh

Port <remote_port>

# Replace this line with the following:
# RhostsAuthentication no

# Replace this line with the following:
# PasswordAuthentication no

# Replace this line with the following:
# HostbasedAuthentication no

# Replace this line with the following:
# UsePAM no

# Replace this line with the following:
# ChallengeResponseAuthentication no

# Replace this line with the following:
# PermitEmptyPasswords no

# Replace this line with the following:
# GSSAPIAuthentication no

# Replace this line with the following:
# GSSAPICleanupCredentials yes

# Replace this line with the following:
# GSSAPIKeyExchange no

# Replace this line with the following:
# GSSAPIDelegateCredentials no

# Replace this line with the following:
# GSSAPINoAnon no

# Replace this line with the following:
# KerberosAuthentication no

# Replace this line with the following:
# KerberosGetAFSToken no

# Replace this line with the following:
# KerberosOrLocalPasswd yes

# Replace this line with the following:
# PasswordAuthentication yes

# Replace this line with the following:
# PermitRootLogin no

# Replace this line with the following:
# StrictModes yes

# Replace this line with the following:
# RSAAuthentication yes

# Replace this line with the following:
# PubkeyAuthentication yes

# Replace this line with the following:
# AuthorizedKeysFile .ssh/authorized_keys

# Replace this line with the following:
# AuthorizedPrincipalsFile none

# Replace this line with the following:
# AuthorizedKeysCommand none

# Replace this line with the following:
# AuthorizedKeysCommandUser nobody

# Replace this line with the following:
# AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES

# Replace this line with the following:
# AcceptEnv LC_ALL LANGUAGE LINGUAS

# Replace this line with the following:
# Subsystem sftp /usr/lib/openssh/sftp-server

# Replace this line with the following:
# Subsystem sftp internal-sftp

# Replace this line with the following:
# UseDNS no

# Replace this line with the following:
# UseLogin yes

# Replace this line with the following:
# PermitLocalCommand no

# Replace this line with the following:
# VisualHostKey no

# Replace this line with the following:
# ServerKeyBits 1024

# Replace this line with the following:
# HostKey /etc/ssh/ssh_host_rsa_key

# Replace this line with the following:
# HostKey /etc/ssh/ssh_host_dsa_key

# Replace this line with the following:
# HostKey /etc/ssh/ssh_host_ecdsa_key

# Replace this line with the following:
# HostKey /etc/ssh/ssh_host_ed25519_key

# Replace this line with the following:
# HostKey /etc/ssh/ssh_host_ed448_key

# Replace this line with the following:
# HostKeyAlgorithms +ssh-rsa,+ssh-dss,+ssh-ecdsa,+ssh-ed25519,+ssh-ed448

# Replace this line with the following:
# Ciphers aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,[email protected],[email protected]

# Replace this line with the following:
# MACs hmac-md5,hmac-sha1,[email protected],hmac-ripemd160,hmac-sha2-256,hmac-sha2-512,hmac-sha1-96,hmac-md5-96

# Replace this line with the following:
# KexAlgorithms [email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1

# Replace this line with the following:
# Compression none

# Replace this line with the following:
# TCPKeepAlive yes

# Replace this line with the following:
# MaxAuthTries 6

# Replace this line with the following:
# MaxSessions 10

# Replace this line with the following:
# MaxStartups 10:30:100

# Replace this line with the following:
# PrintMotd no

# Replace this line with the following:
# PrintLastLog yes

# Replace this line with the following:
# PermitEmptyPasswords no

# Replace this line with the following:
# X11Forwarding yes

# Replace this line with the following:
# X11DisplayOffset 10

# Replace this line with the following:
# X11UseLocalhost yes

# Replace this line with the following:
# AllowTcpForwarding yes

# Replace this line with the following:
# GatewayPorts clientspecified

# Replace this line with the following:
# UsePrivilegeSeparation yes

# Replace this line with the following:
# SSHProxyCommand /usr/bin/nc %h %p %r

# Replace this line with the following:
# Match Address <remote_IP>

# Replace this line with the following:
# ChrootDirectory /var/chroot/%u

# Replace this line with the following:
# X11Forwarding no

# Replace this line with the following:
# AllowTcpForwarding yes

# Replace this line with the following:
# ForceCommand internal-sshd

# Replace this line with the following:
# AllowGroups ssh

# Replace this line with the following:
# Port <remote_port>

# Replace this line with the following:
# RhostsAuthentication no

# Replace this line with the following:
# PasswordAuthentication no

# Replace this line with the following:
# HostbasedAuthentication no

# Replace this line with the following:
# UsePAM no

# Replace this line with the following:
# ChallengeResponseAuthentication no

# Replace this line with the following:
# PermitEmptyPasswords no

# Replace this line with the following:
# GSSAPIAuthentication no

# Replace this line with the following:
# GSSAPICleanupCredentials yes

# Replace this line with the following:
# GSSAPIDelegateCredentials no

# Replace this line with the following:
# GSSAPINoAnon no

# Replace this line with the following:
# KerberosAuthentication no

# Replace this line with the following:
# KerberosGetAFSToken no

# Replace this line with the following:
# KerberosOrLocalPasswd yes

# Replace this line with the following:
# PasswordAuthentication yes

# Replace this line with the following:
# PermitRootLogin no

# Replace this line with the following:
# StrictModes yes

# Replace this line with the following:
# RSAAuthentication yes

# Replace this line with the following:
# PubkeyAuthentication yes

# Replace this line with the following:
# AuthorizedKeysFile .ssh/authorized_keys

# Replace this line with the following:
# AuthorizedPrincipalsFile none

# Replace this line with the following:
# AuthorizedKeysCommand none

# Replace this line with the following:
# AuthorizedKeysCommandUser nobody

# Replace this line with the following:
# AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES

# Replace this line with the following:
# AcceptEnv LC_ALL LANGUAGE LINGUAS

# Replace this line with the following:
# Subsystem sftp /usr/lib/openssh/sftp-server

# Replace this line with the following:
# Subsystem sftp internal-sftp

# Replace this line with the following:
# UseDNS no

# Replace this line with the following:
# UseLogin yes

# Replace this line with the following:
# PermitLocalCommand no

# Replace this line with the following:
# VisualHostKey no

# Replace this line with the following:
# ServerKeyBits 1024

# Replace this line with the following:
# HostKey /etc/ssh/ssh_host_rsa_key

# Replace this line with the following:
# HostKey /etc/ssh/ssh_host_dsa_key

# Replace this line with the following:
# HostKey /etc/ssh/ssh_host_ecdsa_key

# Replace this line with the following:
# HostKey /etc/ssh/ssh_host_ed25519_key

# Replace this line with the following:
# HostKey /etc/ssh/ssh_host_ed448_key

# Replace this line with the following:
# HostKeyAlgorithms +ssh-rsa,+ssh-dss,+ssh-ecdsa,+ssh-ed25519,+ssh-ed448

# Replace this line with the following:
# Ciphers aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,[email protected],[email protected]

# Replace this line with the following:
# MACs hmac-md5,hmac-sha1,[email protected],hmac-ripemd160,hmac-sha2-256,hmac-sha2-512,hmac-sha1-96,hmac-md5-96

# Replace this line with the following:
# KexAlgorithms [email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1

# Replace this line with the following:
# Compression none

# Replace this line with the following:
# TCPKeepAlive yes

# Replace this line with the following:
# MaxAuthTries 6

# Replace this line with the following:
# MaxSessions 10

# Replace this line with the following:
# MaxStartups 10:30:100

# Replace this line with the following:
# PrintMotd no

# Replace this line with the following:
# PrintLastLog yes

# Replace this line with the following:
# PermitEmptyPasswords no

# Replace this line with the following:
# X11Forwarding yes

# Replace this line with the following:
# X11DisplayOffset 10

# Replace this line with the following:
# X11UseLocalhost yes

# Replace this line with the following:
# AllowTcpForwarding yes

# Replace this line with the following:
# GatewayPorts clientspecified

# Replace this line with the following:
# UsePrivilegeSeparation yes

# Replace this line with the following:
# SSHProxyCommand /usr/bin/nc %h %p %r

# Replace this line with the following:
# Match Address <remote_IP>

# Replace this line with the following:
# ChrootDirectory /var/chroot/%u

# Replace this line with the following:
# X11Forwarding no

# Replace this line with the following:
# AllowTcpForwarding yes

# Replace this line with the following:
# ForceCommand internal-sshd

# Replace this line with the following:
# AllowGroups ssh

# Replace this line with the following:
# Port <remote_port>

# Save the file and exit.

On the local machine, open a terminal and run the following command, replacing <remote_user>, <remote_IP>, <local_port>, and <remote_port> with the appropriate values:
```
ssh -R <local_port>:localhost:<remote_port> <remote_user>@<remote_IP>
```

Now, you can use the local port to connect to the remote machine through the reverse SOCKS proxy. For example, if you want to access the remote machine's port 80 using the local machine's port 8080, you can use the following command:

socat - TCP4:localhost:8080 TCP4:<remote_IP>:80

This will create a SOCKS proxy connection from the local machine's port 8080 to the remote machine's port 80.

References

OpenSSH Configuration File Options: https://man.openbsd.org/sshd_config.5
Reverse SSH Tunnel: https://www.digitalocean.com/community/tutorials/how-to-set-up-ssh-tunnels
SOCKS Proxy: https://en.wikipedia.org/wiki/SOCKS

Latest News

Generating SSH Key Failed on Windows 11 (Simplified Chinese)

This article provides solutions for the issue of SSH key generation failure on Windows 11 in Simplified Chinese. Learn how to resolve this problem and continue with your Git installation.

Windows 11: Duplicate and Extend Displays in a Home Office Setup

Learn how to duplicate and extend displays in a home office setup using Windows 11. This guide provides step-by-step instructions to optimize your workspace comfort.

Increase Timeout Limit in Firefox

Learn how to increase the timeout limit in Firefox to avoid high network latency issues causing the browser to hit the timeout limit while loading pages.

Creating Non-Persistent Shadow Copy Backups on Windows 11 Pro

Learn how to create non-persistent shadow copy backups on Windows 11 Pro using WSL and Google Cloud Storage, solving the issue of WSL seeing open Windows files locked.

HP ProLiant MicroServer Gen8: DHCP Server Not Pinging Gateway

This article provides a solution for connecting an HP ProLiant MicroServer Gen8 running a fresh install of Linux Mint 22.1, using an Ethernet cable previously used with an HP laptop, which has proven internet connectivity, but fails to connect with the DHCP server not pinging the gateway.

Disabling Tenor GIF selector window in Emoji picker on Windows 11

Learn how to disable the Tenor GIF selector window in the Emoji picker on Windows 11, which starts flashing distracting animations when invoked.

Troubleshooting Webcam Upgrade on Windows 11 N Pro

This article provides a solution for the error encountered while upgrading a computer running Windows 11 N Pro, as the upgrade is not officially supported due to the lack of TPM. The issue starts when attempting to launch the Windows Camera app.

Setting up Office PC Server with Raspberry Pi: Multihop SSH Tunnel Reverse Forward Tunnel

Learn how to set up an Office PC Server with a Raspberry Pi using a Multihop SSH Tunnel Reverse Forward Tunnel. This guide will walk you through the process of connecting your home PC (192.168.1.42) to a Raspberry Pi and opening an SSH remote tunnel. Follow this tutorial to securely access your office server from home.

Why does the mouse cursor trail on older Windows versions?

Older versions of Windows sometimes cause the mouse cursor to trail, leaving copies of the cursor on the screen as it moves. This can be a problem when the computer is running slowly.

Optimizing ChatGPT Web App Performance in Firefox

This article provides tips and tricks to improve the performance of a ChatGPT web app in Firefox without losing functionality. Long conversations and slow typing input delays are common issues addressed in this article.

Troubleshooting HDR Luminance Levels Mapping/Scaling while Playing HDR on PC

This article provides solutions for issues encountered while playing downloaded HDR content on PC, such as incorrect luminance levels, mapping, or scaling. Common problems include games and YouTube not supporting HDR, even when setup is correct.

Conditional Formatting: Chart Title Greyed

This article explains how to use Conditional Formatting in a chart, but the chart title is greyed out. Here's how to resolve this issue...

VeraCrypt Dual Boot Setup Disappears After Windows Reinstallation

This article provides a solution for the issue where the VeraCrypt dual boot setup disappears after a Windows reinstallation.

Options for Installing NVME PCIe Adapter on IBM System x3650 M3 Type 9745KPG

Recently purchased an old IBM System x3650 M3 Type 9745KPG without drives. Wanting to install an NVME PCIe adapter for read support. What are the options?

Transparent Selection in Microsoft Paint Windows 11

Learn how to use the Transparent Selection option in Microsoft Paint Windows 11 for seamless image editing. Follow this guide to make your editing experience more efficient.

Inspiron 155000 Black Screen Boot Loop

A Dell Inspiron 155000 laptop is stuck in a boot loop while charging and downloading a file. The laptop returns 'Found laptop', and turning the charging lights blinks 3 amber and 1 white.

Check Bitvise SSH Server License Validity Period on Windows 10

Bitvise SSH Server license has expired and the server stops working, causing loss of access to remote computers. Check the current license validity date to plan ahead.

Preserving Layers Saving in Microsoft Paint on Windows 11

Learn how to preserve layers when saving an image in Microsoft Paint on Windows 11 to avoid flattening and losing the ability to edit the image.

Change Time Windows CMD Without Admin Rights

Learn how to change the system time in Windows CMD without requiring admin rights using GitHub's Action Runner and Clock Sync.

How to Transpose Rows/Columns in Notepad++ using Python Script Plugin

Learn how to transpose rows or columns in Notepad++ using the Python Script plugin. This article provides a step-by-step guide to install and use the plugin for efficient data manipulation.

File Complaint Expedia

Learn how to file a complaint with Expedia. This guide covers steps for filing a complaint on Linux, Windows, and MacOS platforms.

Unable to Connect Home Sky Broadband Network on Win10 Laptop: WiFi/Ethernet not valid IP configuration

This article provides solutions for Win10 laptop users who are unable to connect their home Sky Broadband network due to the 'WiFi/Ethernet not valid IP configuration' error.

Change Visited Link Color in Firefox (Latest Update: April 2025, v138.0)

Learn how to change the visited link color in Firefox with the latest update (April 2025, v138.0). This article provides step-by-step instructions to customize your Firefox browser.

Resolved Dispute Expedia

Learn how to resolve disputes with Expedia effectively. This article provides a step-by-step guide to help you through the process.

Since upgrading to Windows 11, how to use Ctrl-Alt-Delete to login?

After upgrading to Windows 11, the Ctrl-Alt-Delete key combination no longer brings up the prompt to enter a PIN (logging into Windows). No indication is given when the keys are pressed.

Cron Won't Start VirtualBox VM: A Solution

In this article, we will discuss a solution to a common issue where Cron won't start a VirtualBox VM. This problem can occur on various operating systems, and we will provide a solution that should work across Linux, Windows, and MacOS.

Block Internet Access for VLAN using EdgeRouter X5

This article will guide you on how to block Internet access for a VLAN using EdgeRouter X5. By the end of this article, you will learn how to isolate your printer from the Internet while connected to a specific VLAN.

Export Command Line Column Task Manager Data to CSV

Learn how to export the Task Manager's memory usage data to a CSV file using the command line. This guide covers Windows, Linux, and macOS.

Configuring OS/Browser to Open Certain File Extensions in Specific Websites (Browser-Specific) - Tech Support

Learn how to configure your operating system and browser to open specific file extensions in certain websites, making it easier to handle old computers and access modern web applications.

Recommendation for Weird/Big Multi-Monitor KVM Setup

This article provides a recommendation for a weird/big multi-monitor KVM setup using a Thunderbolt port and drive. It will guide you through the process of setting up a desktop replacement with six screens, ensuring a seamless and efficient work environment.

Running rsync on Windows using MSYS2: Source/Dest Path Formats

This article provides instructions on how to use rsync on Windows with MSYS2, converting Windows source/dest paths to a Linux-compatible format. This allows syncing through rsync.

Automating Keyboard Shortcuts with PowerShell and Task Scheduler

Learn how to automate keyboard shortcuts using PowerShell and Task Scheduler. This guide will show you how to create and schedule a PowerShell script that sends specific keystrokes to open applications.

Splitting Multiline Text Words - PowerShell

Learn how to split multiline text words using PowerShell. This article provides a simple solution to the problem of splitting text at specific characters, even when they are followed by whitespace. Try the provided script to effortlessly split your multiline text.

Creating a User-Defined Snippets Repository in Kate

This article provides a step-by-step guide on creating and setting up a user-defined snippets repository in Kate, a powerful and feature-rich text editor. Follow these instructions to streamline your coding experience.

Creating a Spreadsheet List with Addresses and Tickbox for Payment Received

Learn how to create a spreadsheet list with addresses and a tickbox for payment received. This tutorial will guide you step-by-step to organize your data effectively.