SysTutorials

Setting Up a SOCKS5 Proxy on iOS via SSH Tunnel

· Eric Ma

iOS doesn’t expose SOCKS proxy settings in the Settings UI, but it supports Proxy Auto-Config (PAC) files natively. This lets you route iOS traffic through an SSH tunnel on a Linux/Unix host without installing a VPN app.

Prerequisites

Set Up the SSH SOCKS Tunnel

First, create a SOCKS5 proxy on your Linux/Unix host. For local testing on the same network:

ssh -D 0.0.0.0:1080 -f -C -q -N user@remote-host

This opens port 1080 on all interfaces. The flags mean:

For better security, use the server’s GatewayPorts SSH option instead of binding to 0.0.0.0, or restrict to specific IPs with firewall rules.

If your iOS device and Linux host are on different networks, tunnel through a jump host or use -L for local port forwarding and expose that locally.

Create a PAC File

Proxy Auto-Config is JavaScript that tells clients which proxy to use. Create proxy.pac:

function FindProxyForURL(url, host) {
    return "SOCKS5 proxy-host:1080";
}

Replace proxy-host with the actual IP or hostname of your Linux box.

For selective routing (only certain domains through the proxy):

function FindProxyForURL(url, host) {
    var proxy = "SOCKS5 proxy-host:1080";
    var direct = "DIRECT";

    // Route internal domains through proxy
    if (host.indexOf("internal.example.com") !== -1 ||
        host.indexOf("api.internal") !== -1) {
        return proxy;
    }

    // Skip private networks
    if (host.match(/^(10\.|192\.168\.|172\.1[6-9]\.|172\.2[0-9]\.|172\.3[01]\.)/)) {
        return direct;
    }

    // Everything else direct
    return direct;
}

Host the PAC File

Deploy the PAC file on any web server accessible from your iOS device.

Python 3 (quick local testing):

python3 -m http.server 8000 --directory /path/to/pac/files

Nginx (production):

server {
    listen 80;
    server_name proxy.local;

    location / {
        root /var/www;
        types {
            application/x-ns-proxy-autoconfig pac;
            text/plain txt;
        }
    }
}

Node.js alternative:

npx http-server -p 8000 -c-1

Verify the PAC file is accessible at http://proxy-host:8000/proxy.pac or whatever URL you’re using.

Configure iOS WiFi to Use the PAC File

On your iOS device:

  1. Go to Settings → Wi-Fi
  2. Tap the ⓘ icon next to your connected network
  3. Scroll to HTTP Proxy
  4. Select Automatic
  5. Enter the PAC URL: http://proxy-host:8000/proxy.pac
  6. Tap Save

iOS fetches and applies the PAC immediately. The configuration applies to all traffic on that WiFi network only.

Verify the Setup

Check that traffic routes through the proxy:

From the iOS device:

From the Linux host:

From another device on the network:

curl -x socks5://proxy-host:1080 https://example.com

Troubleshooting

PAC file won’t load

Wrong MIME type errors

Proxy not actually being used

DNS leaks

IPv6 compatibility

ssh -D [::]:1080 -f -C -q -N user@remote-host

Or bind to both:

ssh -D 0.0.0.0:1080 -D [::]:1080 -f -C -q -N user@remote-host

Production Considerations

ssh -i /path/to/key -D 0.0.0.0:1080 -f -C -q -N user@remote-host
← All posts