ProxyCommand

ProxyCommand is an SSH client configuration directive that specifies an external command used to establish the network connection to the remote host. It enables tunneling through intermediaries such as proxies, bastion hosts, or custom network setups. The directive is supported by OpenSSH in ssh_config and can be used on the command line with the -o option.

When an SSH connection is initiated, the SSH client launches the program named by ProxyCommand. The program must create a bidirectional data stream connected to the SSH process through standard input and output, effectively acting as the network path to the target host. The command can use placeholders such as %h for the target host, %p for the target port, and %r for the remote user, allowing dynamic substitution for each connection. A wide range of helper programs can serve as the proxy, including netcat (nc) or socat, or custom scripts.

Common use cases include routing connections through a forward proxy or SOCKS proxy, connecting via a jump or bastion host, or implementing nonstandard transport mechanisms. For example, a command like ProxyCommand 'nc -X 5 -x proxy.example.com:1080 %h %p' would direct SSH traffic through a proxy, while ProxyCommand 'ssh -W %h:%p jump.example.com' tunnels the connection via a dedicated jump host.

ProxyCommand remains flexible but can add complexity and potential security considerations, since it executes external programs on the client. In modern setups, ProxyJump provides a simpler, commonly recommended alternative for multi-hop SSH, while ProxyCommand remains useful for non-SSH proxies or specialized tunneling scenarios.