Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Run ssh -N -D 127.0.0.1:1080 user@ssh.example.com, leave that session open, and configure your browser to use a SOCKS5 proxy at 127.0.0.1 port 1080. The browser then sends proxy requests to your local SSH client; the SSH server makes the onward TCP connection, so websites generally see the SSH server’s public network rather than your local one.
This is an application-level tunnel, not a full-device VPN. Only programs configured to use the SOCKS endpoint are covered, DNS must be handled deliberately to avoid leaks, and the SSH server must be allowed to reach the destinations you need.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →What you need before starting
Prepare these items before opening the tunnel:
- A user account on an SSH server you are authorized to use.
- Working SSH connectivity to that server, including valid credentials, accepted host keys, and any required firewall access.
- An SSH server whose network can resolve and reach the websites you intend to visit.
- Permission for TCP forwarding. Server-side restrictions can disable dynamic forwarding even when ordinary shell login works.
- A free local TCP port. The examples use
1080; use another unused port if a local service already occupies it.
The SSH server is the egress point. Its geography, routing, DNS resolver, filtering, and outbound firewall rules affect what the browser can reach and what public IP address websites report.
How the SSH SOCKS tunnel works
Dynamic forwarding creates a SOCKS listener on your computer. The SSH client application opens the local port and behaves as a SOCKS4/SOCKS5 server for a SOCKS-aware application. The sequence is:
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
- Your browser connects to
127.0.0.1:1080using the SOCKS protocol. - The browser sends the requested destination and port to the local SSH client.
- The SSH client carries that request through the encrypted SSH connection.
- The SSH server opens the onward connection to the destination and relays bytes in both directions.
The destination therefore sees a connection originating from the SSH server’s network. The local-to-server leg is protected by SSH. If the destination uses HTTPS, TLS separately protects the browser-to-site session; SSH does not replace or weaken the website’s own security model.
What this design does not do
- It does not automatically tunnel other applications, background services, operating-system updates, or device traffic.
- It is primarily a TCP application proxy. It does not automatically carry arbitrary UDP traffic.
- It does not make the SSH server trustworthy. The server operator can observe connection metadata and any traffic that is not protected by the destination protocol.
- It does not guarantee access to every site. The remote network may be blocked, filtered, unable to resolve a hostname, or denied by the destination.
Start the dynamic SSH forward
Use the standard foreground command
Open a terminal and run:
ssh -N -D 127.0.0.1:1080 user@ssh.example.comReplace user with your SSH account and ssh.example.com with the server name or address. Enter your password, approve the host key only if it matches a server you trust, and leave the terminal session running.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →-D 127.0.0.1:1080requests a dynamic forward and binds the SOCKS listener to the local loopback address and port.-Ntells SSH not to run a remote shell command; the session exists for forwarding.- Binding to
127.0.0.1keeps the proxy available only on your computer. Do not replace it with a public interface unless you intentionally want to expose a proxy and have secured that exposure.
A successful command normally remains attached to the terminal without printing a new shell prompt. That idle-looking session is the tunnel. Open a second terminal for tests or other work.
Choose another local port when 1080 is occupied
If SSH reports bind: Address already in use, select another unused port, for example:
ssh -N -D 127.0.0.1:1081 user@ssh.example.comUse exactly the same port, 1081 in this example, in the browser’s proxy settings. Changing only one side leaves the browser connecting to the wrong listener.
Use verbose output to diagnose startup failures
Add one or more -v flags when you need connection details:
ssh -v -N -D 127.0.0.1:1080 user@ssh.example.comVerbose output can distinguish authentication, host-key, network, and forwarding errors. Do not paste private keys, passwords, or sensitive host details into public support forums.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Keep a long-lived session alive
Unstable networks can drop an otherwise idle SSH connection. OpenSSH keepalive options can detect a dead path and request a response:
ssh -N -o ServerAliveInterval=60 -o ServerAliveCountMax=3 -D 127.0.0.1:1080 user@ssh.example.comThese values send a keepalive approximately every 60 seconds and give up after three unanswered probes. Adjust them to your network and server policy; a keepalive cannot repair a server that has been shut down or a route that is permanently unavailable. When the SSH process exits, forwarding stops.
Configure Firefox
Firefox exposes the controls needed for a SOCKS5 tunnel, including a setting intended to send DNS lookups through the proxy.
- Open the Firefox menu and choose Settings (or Options on some releases).
- In General, scroll to Network Settings and select Settings….
- Choose Manual proxy configuration.
- Leave the HTTP, HTTPS, and FTP proxy fields empty unless you have a separate reason to use them.
- In SOCKS Host, enter
127.0.0.1. In Port, enter1080(or the alternate port you selected). - Select SOCKS v5.
- Enable Proxy DNS when using SOCKS v5.
- Save the settings and keep the SSH terminal session running.
The DNS option matters because a browser that resolves a hostname locally can send the DNS request outside the SSH path even when the eventual web connection uses SOCKS. Remote DNS through SOCKS asks the proxy path to perform the lookup instead.
Check Firefox exclusions
Review any “No proxy for” or bypass-list entries in the same dialog. A matching hostname can avoid the SOCKS proxy by design. Remove an entry if that site must use the tunnel, or keep it when direct access is intentional.
Configure Chrome or Chromium
Chrome and Chromium generally obtain proxy settings from the operating system, and the exact controls differ by Windows, macOS, and Linux release. Open the browser or system Proxy settings, choose a manual SOCKS proxy, enter host 127.0.0.1, and enter the same local port used by SSH. Select SOCKS5 when the interface offers a SOCKS version choice.
Some desktop builds can be launched with a proxy command-line switch:
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchRank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
google-chrome --proxy-server="socks5://127.0.0.1:1080"Use the executable name supplied by your installation. This starts a browser instance whose proxy configuration applies to that instance; it does not reconfigure every application on the computer.
Pay attention to name resolution
Chrome does not present one universal “Proxy DNS when using SOCKS v5” checkbox across all platforms and versions. Secure DNS, operating-system resolver behavior, extensions, and proxy bypass rules can affect where lookups occur. If preventing DNS leakage is essential, verify the actual resolver path with a hostname test, avoid applications that bypass the configured proxy, and use a browser/platform configuration that delegates DNS to the SOCKS proxy. Do not assume that setting an address and port alone proves that DNS is remote.
Verify that traffic is really tunneled
Test before relying on the setup for sensitive browsing. Perform the checks in a browser window configured for SOCKS and keep the SSH session open.
- Visit a reputable page that displays the apparent public IP address. The result should correspond to the SSH server’s network, not your normal local connection.
- Open a hostname that requires DNS resolution. Confirm that it loads while the SSH server is connected.
- Temporarily stop the SSH process with
Ctrl-C. A correctly configured browser should fail to reach sites that depend on the SOCKS listener rather than silently continuing through a direct path. - Restart SSH, restore the proxy if necessary, and repeat the IP check.
An IP match is evidence that the web connection is using the remote egress; it does not by itself prove that every DNS query, every browser feature, or every other application is covered.
Understand coverage, DNS, and protocol limits
Only configured applications are covered
The listener is not a system-wide redirector. A browser configured for SOCKS uses it, while an unconfigured mail client, command-line tool, game, updater, or background service normally connects by its own route. If several applications need the tunnel, configure each one separately or use a different technology designed for device-wide routing.
TCP is the practical scope
Web browsing over HTTP and HTTPS normally uses TCP, which fits this dynamic forward. UDP-based protocols are not automatically transported through it. Features that depend on direct UDP connectivity may fail or use another route.
DNS can take a different path
There are two separate decisions: where the browser opens the web connection and where it resolves the hostname. A local resolver can reveal the names you request even when page traffic exits through the SSH server. Firefox’s SOCKS5 DNS option is designed to keep those lookups in the proxy path. Other browsers and applications require their own tested configuration.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
The remote server controls reachability
The SSH host must be able to resolve the destination, establish the onward connection, and comply with its forwarding policy. Private addresses reachable only from your local network will not automatically become reachable from the server. Conversely, a site blocked by the server’s provider can fail even though it works directly from your computer.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsSSH SOCKS tunnel compared with other approaches
| Characteristic | SSH dynamic SOCKS forwarding | Full-device VPN | Static HTTP proxy |
|---|---|---|---|
| Coverage | Only applications configured for the local SOCKS endpoint | Usually device-wide, subject to routing and split-tunnel rules | Applications that support the HTTP proxy |
| Remote vantage point | SSH server’s network | VPN gateway’s network | HTTP proxy’s network |
| DNS handling | Must be configured and verified per browser or application | Depends on VPN routes and resolver policy | Depends on client and proxy implementation |
| Protocol support | Dynamic forwarding is intended for application TCP connections; UDP is not automatic | Can carry routed IP traffic, including UDP, when supported by the VPN | Primarily HTTP-family traffic |
| Setup complexity | One SSH command plus per-application proxy settings | VPN client, profile, and routing configuration | Proxy address, credentials, and application settings |
| Authentication | SSH keys or account credentials, plus server host-key verification | VPN-specific credentials or certificates | Proxy-specific credentials when required |
| Critical dependency | SSH login, outbound reachability, and forwarding permission | VPN gateway and client compatibility | Proxy availability and protocol support |
Choose SSH dynamic forwarding when you control or trust an SSH endpoint and need selected TCP applications to use that server’s egress. Choose a device-wide solution only when the requirement includes applications that cannot be configured for SOCKS or traffic beyond browser TCP sessions.
Troubleshoot common failures
SSH login fails
- Confirm the server name, account name, and port.
- Check that the account credentials or key are valid and that the server’s host key is expected.
- Verify firewall access from your current network.
- Use verbose mode to identify whether the failure occurs during DNS lookup, TCP connection, authentication, or session setup.
- Ask the administrator whether the account is restricted from forwarding.
“Address already in use” appears
Another process owns the local port. Stop that process if appropriate or select a different unused port, such as 1081, in both the SSH command and the browser configuration.
The tunnel starts but sites do not load
- Confirm the browser is using SOCKS5, not HTTP, and that the host is
127.0.0.1. - Confirm the browser port matches the SSH
-Dport. - Check that the SSH server can resolve and reach the destination.
- Check server forwarding policy and outbound firewall rules.
- Remove an unintended browser proxy exclusion.
DNS appears to leak
- In Firefox, enable Proxy DNS when using SOCKS v5.
- Check Chrome/Chromium and operating-system resolver settings rather than assuming SOCKS automatically handles DNS.
- Disable or reconfigure applications that bypass the browser proxy.
- Run a hostname-resolution test while the tunnel is active and compare behavior with the SSH session stopped.
Only some sites fail
Different sites can use different address families, destination ports, filtering rules, or DNS behavior. IPv6 reachability, the remote network’s policy, destination-side blocking, and browser exclusions can each affect only a subset of sites. Test the same hostname from the SSH server when you have authorized shell access, and inspect verbose SSH output for forwarding errors.
The tunnel drops
Check local network changes, server idle timeouts, and firewall state. Add suitable ServerAliveInterval and ServerAliveCountMax values, then reconnect when the process exits. Do not assume a browser session remains proxied after the SSH process has terminated.
Operate the tunnel safely
- Bind the SOCKS listener to
127.0.0.1so other devices cannot use it accidentally. - Use key-based SSH authentication where appropriate and protect private keys with a passphrase.
- Verify the server host key through a trusted channel before accepting it.
- Use an SSH server whose operator and network you trust; SSH protects the local-to-server path, not the server’s onward network.
- Remember that HTTPS remains important for confidentiality and authentication at the destination.
- Stop the foreground tunnel with
Ctrl-Cwhen finished. If you started it in a background process, terminate that specific SSH process and confirm the local port is closed.
Stop the tunnel or change its port
For the foreground command, return to the terminal running SSH and press Ctrl-C. The local SOCKS listener closes immediately, and configured applications lose their proxy path.
To move the tunnel, stop the existing session, start SSH with a new local port, and update every application that used the old port. For example:
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
ssh -N -D 127.0.0.1:1081 user@ssh.example.comThen set the browser’s SOCKS5 host to 127.0.0.1 and port 1081.
When this method is the right fit
An SSH SOCKS tunnel is a practical choice when you need a browser or another SOCKS-aware application to originate TCP connections from a server you control. It requires little software beyond an SSH client, makes the path between your computer and the server confidential, and lets the remote network perform onward connections.
Recommended Free Tools
It is the wrong tool when you need every device packet routed, reliable UDP transport, transparent coverage for applications without proxy support, or a remote server that cannot reach the required destinations. In those cases, use an architecture that explicitly provides those capabilities rather than treating ssh -D as a general-purpose VPN.
Frequently Asked Questions
Can I use the tunnel for UDP applications?
Not automatically. Dynamic SOCKS forwarding is intended for application-level connections and practical web use over TCP; UDP traffic requires a separate solution that supports it.
Will closing the terminal stop the proxy?
Yes. The SOCKS listener exists while the SSH process is running. Pressing Ctrl-C ends forwarding, so applications must either reconnect directly or report a proxy failure.
Why does the website still show my local IP address?
The browser may not be using the configured SOCKS endpoint, the port may not match the SSH command, or a bypass rule may apply. Recheck the proxy settings and repeat the public-IP test with the SSH session active.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Does an SSH SOCKS tunnel protect me from the SSH server operator?
No. The operator controls the server and can observe connection metadata and traffic that is not protected by the destination protocol. Use HTTPS and only an endpoint you trust.
Can several browsers share one SSH SOCKS listener?
Yes. Any SOCKS-aware application can use the same local host and port, but each application must be configured explicitly and DNS behavior must be checked separately.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
