SSH SOCKS5 Tunneling on Windows with ProxiFyre

Increasing restrictions on internet access, including the blocking of VPN protocols, make alternative connections a practical concern for me. After moving from Russia about a year earlier, I continued to use the home infrastructure I had built over many years.

WireGuard had usually been enough to reach those home networks, but I periodically saw increased UDP packet loss and suspected attempts to block the protocol. Changing parameters of my WireGuard client sometimes helped. I wanted another way to connect if the usual VPN path stopped working.

One time-tested alternative is tunneling TCP connections through SSH. I considered it a useful fallback for reaching my home services when WireGuard traffic was unreliable. SSH dynamic forwarding opens a local SOCKS listener and carries its TCP connections over the encrypted SSH session. It can support application-level split tunneling, but it is not a full VPN: ordinary DNS and UDP traffic need separate handling, and the SSH endpoint can itself be blocked. This is where we come to the main topic of our discussion.

ProxiFyre is an Open Source tool that functions as a ‘socksifier’ for applications that do not have built-in support for working through SOCKS proxy servers. The program is an improved version of one of the demonstration examples for Windows Packet Filter. Unlike the base version, ProxiFyre provides support for the UDP protocol and offers the function of simultaneous use of multiple instances of SOCKS5 proxies, significantly expanding its functional capabilities. A similar application had existed for a couple of years, but I had published ProxiFyre only a few weeks before this article. I published it after several requests for additional features, particularly UDP support, and hoped interested users would help develop it.

To simplify working with ProxiFyre, I added configuration through app-config.json. Its proxy rules can select different applications and protocols. The endpoints and credentials below are illustrative; replace them with your own.

{
    "logLevel": "None",
    "proxies": [
        {
            "appNames": ["chrome", "chrome_canary"],
            "socks5ProxyEndpoint": "proxy1.example.org:1080",
            "username": "username1",
            "password": "password1",
            "supportedProtocols": ["TCP", "UDP"]
        },
        {
            "appNames": ["firefox", "firefox_dev"],
            "socks5ProxyEndpoint": "proxy2.example.org:1080",
            "username": "username2",
            "password": "password2",
            "supportedProtocols": ["TCP"]
        }
    ]
}

Combining ProxiFyre with SSH lets selected TCP connections use an encrypted SSH tunnel. The example below selects a browser and RDP client; it does not route every packet those applications or Windows may send.

Here’s a step-by-step guide to achieve that:

Install an SSH client: On Windows, install PuTTY or use the optional in-box OpenSSH client available from Windows 10 build 1809 onward. You also need an SSH server you trust with TCP forwarding enabled.
Create an SSH Tunnel: To do this with PuTTY, open the program and fill in the following details:
- In the ‘Host Name (or IP address)’ field, input your server’s IP address. Ensure the Port is set to 22 (the default for SSH). In the ‘Connection type’ section, select SSH.
Then, on the left-hand side menu, navigate to Connection > SSH > Tunnels. Here, you’ll create your SOCKS tunnel:
- In the ‘Source port’ field, input a port number (make sure it’s a free port on your local machine, something like 8080). In the ‘Destination’ field, select the ‘Dynamic’ option (this sets up a SOCKS5 tunnel). Click ‘Add’ to add the tunnel.
Go back to the main ‘Session’ tab, and click ‘Open’ to open the connection and create the tunnel.
Create ProxiFyre configuration file: Configure ProxiFyre to send selected TCP connections from Chrome and mstsc through the local SOCKS listener.

{
    "logLevel": "None",
    "proxies": [
        {
            "appNames": ["chrome", "mstsc"],
            "socks5ProxyEndpoint": "127.0.0.1:8080",
            "supportedProtocols": ["TCP"]
        }
    ]
}

In this JSON object:

appNames: This is an array that contains the names of the applications you want to direct through the SSH tunnel. In your case, this is Google Chrome (“chrome”) and the RDP client (“mstsc”).
socks5ProxyEndpoint: This is the local address and port number of your SSH tunnel. In your case, this is 127.0.0.1:8080, which corresponds to the local loopback address and the port number you’ve chosen.

Save app-config.json beside the ProxiFyre executable and start the SSH tunnel before ProxiFyre. Check that the selected TCP connections reach their destinations through the server. With supportedProtocols set to TCP, this example does not cover UDP, including QUIC and RDP’s UDP transport; DNS may also take a separate path. Do not infer complete application isolation from a successful browser IP check.

The SSH transport protects traffic between your machine and the SSH server. That server can observe destinations and any application data that is not independently encrypted, so use one you trust. This setup does not guarantee anonymity.

Chrome can also use explicit proxy settings, but many Windows applications cannot. ProxiFyre is useful for selecting those applications without changing each one’s settings. This 2023 example uses named applications; later ProxiFyre releases added a catch-all rule and process exclusions, with their own routing and DNS limitations.

Architecturally, ProxiFyre consists of three main projects:

ndisapi.lib: An adapted project of the Windows Packet Filter static library.
socksify: A .NET C++/CLI class library implementing the functionality of a local SOCKS5 router.
ProxiFyre: A simple console .NET application for Windows that uses the functionality provided by the .NET C++/CLI class library socksify.

Detailed usage instructions, including build requirements, can be found in the repository README.

I hope this application will be useful to someone in the current challenging circumstances.