Skip to content
Reroutefor Mac
Guide

How to send one Mac app through an SSH tunnel

If you can SSH into a server, you already have a proxy. Here is how to send one app through it and keep everything else on your normal connection.

Updated 6 November 2026

Turn SSH into a SOCKS5 proxy

OpenSSH, built into macOS, can act as a SOCKS5 proxy. In Terminal:

ssh -D 1080 -N -o ServerAliveInterval=30 you@server.example.com
  • -D 1080 opens a SOCKS5 proxy on your Mac at 127.0.0.1, port 1080. Anything sent to it leaves from the server.
  • -N just holds the tunnel open, without running a command on the server.
  • ServerAliveInterval=30 keeps a quiet connection from being dropped.

Leave that Terminal window open while you use the tunnel. Ports below 1024 need admin rights, so stick to 1080 or another high port.

Check the tunnel works

curl --socks5-hostname 127.0.0.1:1080 https://www.cloudflare.com/cdn-cgi/trace

The ip= line should show the server's public address, not yours. --socks5-hostname hands the hostname to the server, so the DNS lookup happens there too.

Point one app at it (free)

  • Firefox: Settings → General → Network Settings → Settings… → Manual proxy configuration. Enter SOCKS Host 127.0.0.1, Port 1080, choose SOCKS v5 and tick Proxy DNS when using SOCKS v5.
  • Chrome: start a separate Chrome on the tunnel with open -na "Google Chrome" --args --proxy-server="socks5://127.0.0.1:1080" --user-data-dir="$HOME/chrome-tunnel".
  • Terminal: export all_proxy=socks5h://127.0.0.1:1080 sends curl and many other tools in that window through the tunnel. For git, use git -c http.proxy=socks5h://127.0.0.1:1080 ….
  • Other apps: look for a SOCKS5 proxy option in the app's settings.

Avoid the system-wide SOCKS proxy in System Settings unless you want every app that reads it to go through the server.

Reaching a private machine behind the server

If what you need is one machine on the server's private network, such as a database at 10.0.0.5, forward a single port instead:

ssh -N -L 5432:10.0.0.5:5432 you@bastion.example.com

Then connect your tool to localhost:5432. That works with any app, for free, and needs no proxy at all.

Apps with no proxy setting

API clients, database tools and chat apps often have no SOCKS setting, or ignore it. Reroute routes them anyway:

  1. Add the tunnel as a proxyOpen Proxies, click + and add a SOCKS5 proxy at 127.0.0.1, port 1080, with no login. Press Test: it should show the server's public IP and country.
  2. Route the appOpen Apps, click + and choose the app, then pick the tunnel. Quit and reopen the app.
  3. Check ActivityIts connections appear with the tunnel as the route. The browser and every other app stay on your normal connection.

A common use: your staging site only accepts connections from the server's IP, and you want just your API client to reach it. If the SSH session drops, routed apps' connections fail rather than going out direct. Start ssh -D again and they work again.

Reroute leaves local and private network addresses alone, so use ssh -L above for machines on the server's private network. SSH's SOCKS proxy only carries TCP, which suits Reroute: it refuses a routed app's UDP by default, and browsers fall back to TCP. Plain DNS lookups from the app stay on your normal connection; the hostname itself goes through the tunnel with each connection.

Questions people ask

How do I use an SSH tunnel as a proxy on a Mac?

Run ssh -D 1080 -N you@server in Terminal. It opens a SOCKS5 proxy at 127.0.0.1, port 1080, and anything sent to it leaves from the server. Point an app's SOCKS5 setting at it.

Can I send only one app through an SSH tunnel?

Yes. Set that app's own proxy setting to the tunnel, start Chrome with --proxy-server, or use a per-app proxy tool for apps without a setting. Leave the system-wide proxy off.

Does ssh -D send DNS through the tunnel?

Only when the app passes hostnames to the proxy. Tick Proxy DNS when using SOCKS v5 in Firefox, and use socks5h:// or --socks5-hostname in Terminal.

How do I reach a private server through an SSH tunnel?

Forward a port with ssh -L, for example ssh -N -L 5432:10.0.0.5:5432 you@bastion, then connect to localhost:5432.

More guides

How to Route One App Through a Proxy on a MacmacOS has one set of proxy settings for the whole Mac. Here is how to put a single app on a proxy instead, starting with the free ways. How to Use a VPN for Only One App on a MacA VPN app normally takes over the whole Mac. If you only want one app on it, these are your options, free ones first. How to Use Tailscale and a VPN at the Same Time on a MacTurn on your VPN app and Tailscale stops reaching your devices, or the other way round. Here is why, and three ways to have both. Help: set up RerouteInstall, approve the extension, add a proxy, route an app and fix common problems.

Questions about your set-up? Email support@flavrapps.com. All guides.