SSH Tunnel: VPN & SOCKS5 proxy

SSH Tunnel is the easiest way to tunnel your traffic through your own SSH server on iPhone, iPad, and Mac.

Version 3.0 is a complete native rewrite with a new VPN engine: route ALL device traffic through your server, keep it running in the background, and reconnect automatically. The old foreground-only limitation is gone.

TWO ENGINES

• VPN engine: system-wide tunnel built on Apple's Network Extension. Works in the background, survives restarts, and restores itself after reboots and network changes (On Demand).
• Proxy engine: a local SOCKS5 proxy with a PAC file for browsers, third-party apps, or sharing the tunnel with other devices on your Wi-Fi. Run several tunnels at once.

FEATURES

• Dynamic port forwarding (SOCKS5 proxy), like "ssh -D"
• Local port forwarding, like "ssh -L 80:intra.example.com:80 gw.example.com"
• Password, private key, and keyboard-interactive (2FA/OTP) authentication
• Keys: ed25519, ECDSA, RSA (rsa-sha2), OpenSSH and PuTTY .ppk formats, import from file
• Modern ciphers and OpenSSH 8.8+ compatibility
• Host key fingerprint verification
• In-app browser that uses the tunnel (iOS)
• Proxy Auto-Configuration (PAC) URL with custom PAC rules
• Live transfer statistics and connection logs
• Connection export & import
• Passcode & Face ID protection
• Idle disconnect timer
• Native menu bar app on macOS, included with your purchase
• Dark mode. No ads, no subscriptions, no accounts.

YOUR SERVER, YOUR DATA

SSH Tunnel connects only to a server YOU provide. There are no accounts and no servers we operate: your traffic flows directly between your device and your own SSH server. We never see, collect, or sell any of it.

You need your own SSH server to use this application.

Support: [email protected]

Jump hosts. Reach servers behind a bastion through another saved connection.

• Pick any saved connection as the jump host; chains of up to three hops.
• Every hop keeps its own login: password, key or verification code.
• Works with both engines, Proxy and VPN.
• Host key checks and errors name the hop they come from.
• Deleting a connection warns which others use it as a jump host.
• The in-app browser opens plain http:// pages again.
• A VPN connection whose host key changed no longer leaves the device without internet.