Connecting to the SSH Server Through a Proxy

An outbound HTTP or SOCKS proxy changes only how SshTunnel reaches the SSH server. It does not choose the final forwarded destination and it is different from dynamic SOCKS port forwarding.

Connecting SshTunnel to an SSH server through an outbound proxy The application process contains SshTunnel and its background network work. Its outbound connection to the SSH server first passes through a separate HTTP or SOCKS proxy process. After SSH is established, the remote SSH server reaches the final destination service. APPLICATION COMPUTER Your Application Process Application threadConfigures either HttpProxy*or outbound Socks* propertiesbefore calling Connect SshTunnel background network workCreates the outbound TCP connectionthrough the proxy, then negotiates SSHinside the application process NETWORK / REMOTE SYSTEMS HTTP or SOCKS ProxySeparate process, often ona gateway or corporate proxyserver SSH Server ProcessThe proxy only helps reachthis SSH endpoint.SSH begins after the proxy hop. Destination ServiceReached by the SSH server,not by the outbound proxy. proxy protocol TCP after CONNECT / SOCKS SSH session logically spans the proxy path ordinary TCP

The proxy is a separate network process. Chilkat's proxy negotiation and SSH protocol handling occur inside the application process.

Chilkat object or managed thread Separate process or application code SSH server or remote network component Destination service Local-computer boundary

HTTP proxy configuration

PropertyPurpose
HttpProxyHostname, HttpProxyPortIdentify the proxy used for the outbound connection to the SSH server.
HttpProxyAuthMethodSelect proxy authentication such as Basic or NTLM.
HttpProxyUsername, HttpProxyPasswordCredentials for the HTTP proxy, not for the SSH server.
HttpProxyDomainOptional NTLM domain when NTLM proxy authentication is used.

Outbound SOCKS proxy configuration

PropertyPurpose
SocksVersion0 for no proxy, 4 for SOCKS4, or 5 for SOCKS5.
SocksHostname, SocksPortIdentify the existing SOCKS proxy used to reach the SSH server.
SocksUsername, SocksPasswordCredentials for the outbound SOCKS proxy. SOCKS4 does not use a password.

Three independent authentication layers

  1. Proxy authentication allows SshTunnel to pass through the HTTP or SOCKS proxy.
  2. SSH authentication authenticates to the SSH server using AuthenticatePw, AuthenticatePk, or another SSH authentication method.
  3. Destination-service authentication is performed by the local client protocol, such as a database login.
Do not combine the two SOCKS concepts: InboundSocks* properties configure a SOCKS server provided by SshTunnel to local clients. Socks* properties configure an existing SOCKS proxy that SshTunnel uses for its outbound connection to the SSH server.

Example sequence

// Configure before Connect.
tunnel.HttpProxyHostname = "proxy.corp.example"
tunnel.HttpProxyPort = 8080
tunnel.HttpProxyAuthMethod = "NTLM"
tunnel.HttpProxyUsername = "proxy-user"
tunnel.HttpProxyPassword = "proxy-password"
tunnel.HttpProxyDomain = "CORP"

success = tunnel.Connect("ssh.example.com", 22)
// Now verify the SSH host key and authenticate to the SSH server.

Configure either the HTTP proxy family or the outbound SOCKS proxy family for a connection path unless the network design explicitly requires something more unusual.