This guide shows how to run apt and apt-get through a SOCKS5 proxy created with an SSH tunnel on Ubuntu 24.04. This is useful when the local server has restricted Internet access but can reach another Linux host with external connectivity.
Open an SSH SOCKS Proxy
Create a local SOCKS proxy on TCP port 1080 through a remote SSH server:
root@kvm-hyp:~# ssh -D 1080 -N -f root@192.0.2.100
The authenticity of host '192.0.2.100 (192.0.2.100)' can't be established.
ED25519 key fingerprint is SHA256:cL2VUAxRdNwadP5T6ry7fSQMsamgmkxoQdgfAEqTCyA.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '192.0.2.100' (ED25519) to the list of known hosts.
root@192.0.2.100's password:
The SSH options used are:
- -D 1080 - creates a local dynamic SOCKS proxy on port 1080
- -N - does not execute a remote shell command
- -f - moves the SSH process to the background after authentication
By default, the SOCKS listener is available locally. The SSH server at 192.0.2.100 becomes the exit point for the proxied connections.
Check the SSH SOCKS Proxy
Verify that SSH is listening on TCP port 1080:
root@kvm-hyp:~# ss -ltpn | grep 1080
LISTEN 0 128 127.0.0.1:1080 0.0.0.0:* users:(("ssh",pid=596497,fd=5))
LISTEN 0 128
The important part is the listener on 127.0.0.1:1080. This confirms that the local SOCKS proxy is running.
Create a dedicated APT proxy configuration file:
root@kvm-hyp:~# cat /etc/apt/apt.conf.d/99socksproxy
Acquire::http::Proxy "socks5h://127.0.0.1:1080/";
Acquire::https::Proxy "socks5h://127.0.0.1:1080/";
The socks5h scheme is important because hostname resolution is performed through the SOCKS proxy instead of relying on local DNS resolution.
Run apt-get Through the SOCKS Proxy
Run apt-get normally. APT will automatically use the proxy defined in /etc/apt/apt.conf.d/99socksproxy:
root@kvm:~# apt-get update
Get:1 http://security.ubuntu.com/ubuntu noble-security InRelease [126 kB]
Get:2 http://security.ubuntu.com/ubuntu noble-security/main amd64 Packages [1,217 kB]
Get:3 http://security.ubuntu.com/ubuntu noble-security/main Translation-en [202 kB]
Get:4 http://security.ubuntu.com/ubuntu noble-security/main amd64 Components [21.6 kB]
Get:5 http://security.ubuntu.com/ubuntu noble-security/main amd64 c-n-f Metadata [8,748 B]
Get:6 http://security.ubuntu.com/ubuntu noble-security/restricted amd64 Packages [1,978 kB]
Get:7 http://security.ubuntu.com/ubuntu noble-security/restricted Translation-en [450 kB]
Get:8 http://security.ubuntu.com/ubuntu noble-security/restricted amd64 Components [212 B]
Get:9 http://security.ubuntu.com/ubuntu noble-security/restricted amd64 c-n-f Metadata [520 B]
Get:10 http://security.ubuntu.com/ubuntu noble-security/universe amd64 Packages [884 kB]
Get:11 http://security.ubuntu.com/ubuntu noble-security/universe Translation-en [196 kB]
Get:12 http://security.ubuntu.com/ubuntu noble-security/universe amd64 Components [52.2 kB]
Get:13 http://security.ubuntu.com/ubuntu noble-security/universe amd64 c-n-f Metadata [18.1 kB]
Get:14 http://security.ubuntu.com/ubuntu noble-security/multiverse amd64 Packages [28.0 kB]
Get:15 http://security.ubuntu.com/ubuntu noble-security/multiverse Translation-en [5,844 B]
Get:16 http://security.ubuntu.com/ubuntu noble-security/multiverse amd64 Components [212 B]
Get:17 http://security.ubuntu.com/ubuntu noble-security/multiverse amd64 c-n-f Metadata [384 B]
Hit:18 http://archive.ubuntu.com/ubuntu noble InRelease
Get:19 http://archive.ubuntu.com/ubuntu noble-updates InRelease [126 kB]
Get:20 http://archive.ubuntu.com/ubuntu noble-backports InRelease [126 kB]
Get:21 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 Packages [1,498 kB]
Get:22 http://archive.ubuntu.com/ubuntu noble-updates/main Translation-en [288 kB]
Get:23 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 Components [175 kB]
Get:24 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 c-n-f Metadata [15.3 kB]
Get:25 http://archive.ubuntu.com/ubuntu noble-updates/restricted amd64 Packages [2,084 kB]
Get:26 http://archive.ubuntu.com/ubuntu noble-updates/restricted Translation-en [471 kB]
Get:27 http://archive.ubuntu.com/ubuntu noble-updates/restricted amd64 Components [212 B]
Get:28 http://archive.ubuntu.com/ubuntu noble-updates/restricted amd64 c-n-f Metadata [544 B]
Get:29 http://archive.ubuntu.com/ubuntu noble-updates/universe amd64 Packages [1,490 kB]
Get:30 http://archive.ubuntu.com/ubuntu noble-updates/universe Translation-en [301 kB]
Get:31 http://archive.ubuntu.com/ubuntu noble-updates/universe amd64 Components [377 kB]
Get:32 http://archive.ubuntu.com/ubuntu noble-updates/universe amd64 c-n-f Metadata [31.2 kB]
Get:33 http://archive.ubuntu.com/ubuntu noble-updates/multiverse amd64 Packages [32.0 kB]
Get:34 http://archive.ubuntu.com/ubuntu noble-updates/multiverse Translation-en [6,116 B]
Get:35 http://archive.ubuntu.com/ubuntu noble-updates/multiverse amd64 Components [940 B]
Get:36 http://archive.ubuntu.com/ubuntu noble-updates/multiverse amd64 c-n-f Metadata [488 B]
Get:37 http://archive.ubuntu.com/ubuntu noble-backports/main amd64 Packages [40.4 kB]
Get:38 http://archive.ubuntu.com/ubuntu noble-backports/main Translation-en [9,208 B]
Get:39 http://archive.ubuntu.com/ubuntu noble-backports/main amd64 Components [7,148 B]
Get:40 http://archive.ubuntu.com/ubuntu noble-backports/main amd64 c-n-f Metadata [368 B]
Get:41 http://archive.ubuntu.com/ubuntu noble-backports/restricted amd64 Components [216 B]
Get:42 http://archive.ubuntu.com/ubuntu noble-backports/universe amd64 Packages [28.9 kB]
Get:43 http://archive.ubuntu.com/ubuntu noble-backports/universe Translation-en [17.5 kB]
Get:44 http://archive.ubuntu.com/ubuntu noble-backports/universe amd64 Components [11.0 kB]
Get:45 http://archive.ubuntu.com/ubuntu noble-backports/universe amd64 c-n-f Metadata [1,444 B]
Get:46 http://archive.ubuntu.com/ubuntu noble-backports/multiverse amd64 Components [212 B]
Fetched 12.3 MB in 5s (2,305 kB/s)
Reading package lists... Done
The successful repository downloads confirm that APT can reach the Ubuntu repositories through the SSH SOCKS tunnel.
Use the Proxy with Normal APT Commands
Once the proxy configuration is enabled, normal APT commands use the SOCKS tunnel automatically:
apt update
apt upgrade
apt install PACKAGE_NAME
apt-get update
Disable the APT SOCKS Proxy
To return APT to direct Internet access, remove the proxy configuration file:
rm /etc/apt/apt.conf.d/99socksproxy
APT will use the normal direct network connection on the next command.
Stop the SSH SOCKS Proxy
Find the SSH process that owns the local SOCKS listener:
Then stop the corresponding SSH PID:
Useful Commands
ssh -D 1080 -N -f root@192.0.2.100
ss -ltpn | grep 1080
cat /etc/apt/apt.conf.d/99socksproxy
apt-get update
rm /etc/apt/apt.conf.d/99socksproxy