how to configure ssh to use gluetun via socks5 or shadowsocks

[notreallyintobaseball]

Hi,

I have recently start using this project and create the following compose file to provide HTTP Proxy for my Browser:

services:
  gluetun:
    image: qmcgaw/gluetun
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    ports:
      - 8888:8888/tcp # HTTP proxy
    volumes:
      - ./data:/gluetun:Z
    environment:
      - VPN_SERVICE_PROVIDER=VpnProvider
      - VPN_TYPE=wireguard
      - WIREGUARD_PRIVATE_KEY=xyz-123
      - SERVER_COUNTRIES=SomeCountry
      - HTTPPROXY=on
      - HTTPPROXY_STEALTH=on

This configuration works just fine. Zero problems.

So I decide to try make my ssh connections go through my VPN (gluetun) as well. Quick research presented two options:

• Http Proxy

Host my_remote_server
    # ...
    ProxyCommand socat - PROXY:0.0.0.0:%h:%p,proxyport=8888

• Proxy Socks (*assuming this is Socks5?)

Host my_remote_server
    # ...
    ProxyCommand nc -v -x 0.0.0.0:1080 %h %p

For whatever reason I decided that I wanted to test the Socks option with gluetun and edited the compose file to:

services:
  gluetun:
    image: qmcgaw/gluetun
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    ports:
      - 8888:8888/tcp # HTTP proxy
      - 8388:8388/tcp # Shadowsocks
      - 8388:8388/udp # Shadowsocks
      - 1080:1080/tcp
      - 1080:1080/udp
    volumes:
      - ./data:/gluetun:Z
    environment:
      - VPN_SERVICE_PROVIDER=VpnProvider
      - VPN_TYPE=wireguard
      - WIREGUARD_PRIVATE_KEY=xyz-123
      - SERVER_COUNTRIES=SomeCountry
      - HTTPPROXY=on
      - HTTPPROXY_STEALTH=on
      - SHADOWSOCKS=on
      - SHADOWSOCKS_LOG=on
      - SOCKS5_ENABLED=on

Why I turnned on the Shadowsocks? Because I read two thing in the internet:

1. Shadowsocks have end-to-end encryption. Socks5 does not have it.
2. Shadowsocks is capable of open a Socks5 local connection to make it easier to any application to "make use Shadowsocks network" without even notice.

Here comes the First Questions:

• Is topic 2 true? If so... does the Shadowsocks from gluetun creates this Socks5 instance automatically?

So after the changes I recreated the main container and:

• http proxy still working fine in the browser

• the test curl --socks5 0.0.0.0:1080 http://ifconfig.me return error message:

*   Trying 0.0.0.0:1080...
* Host ifconfig.me:80 was resolved.
* IPv6: ....:b2bd
* IPv4: ...
* SOCKS5 connect to [...:b2bd::]:80 (locally resolved)
* cannot complete SOCKS5 connection to ifconfig.me. (1)
* closing connection #0
curl: (97) cannot complete SOCKS5 connection to ifconfig.me. (1)

the gluetun return this log

2026-07-27T16:39:17Z INFO [socks5] running socks connection: handling request: handling connect request: dial tcp [...:b2bd::]:80: connect: network is unreachable

Other questions

• What am I missing here?
• Should I just use the http based solution for ssh config to connect to my remote server?
• Do I really need the Sock5 "open" in gluetun container?

thank you for reading :)