On the server, modify ~/.zshrc (or ~/.bashrc) to set the network proxy:
# set reverse forward port, connect to local proxy port
export http_proxy=http://127.0.0.1:<port_remote>
export https_proxy=http://127.0.0.1:<port_remote>
Modify the local SSH configuration file ~/.ssh/config, and add an entry under the corresponding Host section on the server:
RemoteForward localhost:<port_remote> localhost:<port_local>
Replace <port_remote> with the port that the user wishes to use for the proxy on the server, and <port_local> with the proxy port used by the local proxy software. This means that when establishing an SSH connection, a remote port <port_remote> is forwarded to the local port <port_local>.
The proxy software needs to enable Allow LAN option.
The reason for enabling the "Allow LAN" option is that the local proxy service needs to be able to accept connection requests initiated from the local area network (including traffic forwarded through SSH reverse proxy).
-
By default, the proxy only listens on the local loopback interface:
• When the "Allow LAN" option is turned off, Clash or other proxy services only listen on 127.0.0.1 (i.e., the local loopback interface). This means that only connections initiated from the local machine (via localhost or 127.0.0.1) can be received by the proxy service.
• In the reverse proxy scenario, the remote server forwards traffic to the local proxy port through the SSH tunnel, but these requests are not initiated directly from the local machine; they are transmitted through the local area network interface. Therefore, the local proxy service cannot accept these requests from the local area network or external interfaces, causing the proxy to fail to work properly. -
After enabling Allow LAN, the proxy can accept external requests:
• After enabling "Allow LAN," Clash will listen on 0.0.0.0, which means all network interfaces, not just 127.0.0.1. This way, the local proxy service can accept connection requests from other network interfaces, including:
• Requests from other devices within the local area network.
• Requests forwarded from the remote server through the SSH tunnel (because these requests appear to be from other devices within the local area network). -
Reverse proxy and local area network requests:
• When you use SSH reverse proxy, you are effectively opening a port (e.g., 8000) on the remote server and forwarding requests from that port to the local proxy port (e.g., 7890). These requests enter the local network from the remote server through the SSH tunnel, so for the local proxy, these requests are considered "external requests" or "local area network requests."
• If Clash does not listen on the local area network (i.e., "Allow LAN" is not enabled), it cannot accept the traffic coming through the tunnel, resulting in failed proxy requests.
Therefore, enabling "Allow LAN" is key to allowing your local proxy to handle traffic forwarded from the remote server.