Skip to main content

Documentation Index

Fetch the complete documentation index at: https://www.rumus.ai/docs/llms.txt

Use this file to discover all available pages before exploring further.

When your network requires a proxy to reach SSH targets — corporate networks, restricted environments, or just a SOCKS tunnel you’ve set up locally — Rumus can route the connection through it. Proxy is configured per host, not globally.

​
Supported proxy protocols

ProtocolWhen to use
HTTPA standard HTTP CONNECT proxy
HTTPSThe same, over TLS
SOCKS5A SOCKS5 proxy — common for local tunnels (e.g. ssh -D 1080) and many privacy tools
All three support optional username / password authentication.

​
Add a proxy to a host

1

Open the host editor

Settings → Vaults → Hosts → [your host] → switch to the Proxy tab inside Advanced.
2

Enable proxy

Toggle Enable Proxy on. The protocol, host, and port fields appear.
3

Pick a protocol

HTTP, HTTPS, or SOCKS5. Match whatever your proxy actually is — picking the wrong one is the #1 cause of mysterious “connection refused” errors.
4

Fill in proxy host and port

The address and port of the proxy itself, not the SSH target.
5

(Optional) Auth

If the proxy requires authentication, fill in the Proxy Username and Proxy Password fields. Both are stored encrypted in the vault along with the rest of the host.
6

Save and test

Save the host and connect. If anything’s off, the failure usually shows up in the connection error.

​
Per-host, not global

Rumus deliberately does not have a global proxy setting. Each host carries its own. The reason: most users have hosts that need a proxy and hosts that don’t, often inside the same session, and a global setting would force everything through one path. If many hosts share a proxy:
  • Set it on each — it’s a few seconds per host, and you only do it once.
  • Or treat the proxy itself as a bastion: configure a SOCKS5 tunnel to a jump host you do have direct access to, and set that as the proxy on every internal host.

​
How proxy interacts with jump chains

If a host has both a proxy and a jump chain:
  • The proxy is used for the first hop only — your machine reaching the first jump host.
  • Subsequent hops (jump → jump → target) ride the bastion’s network, not your machine’s proxy.
If a bastion needs its own proxy to reach the next hop, configure that proxy on the bastion’s own host record.

​
Common gotchas

An HTTPS proxy speaks TLS to the proxy server itself. An HTTP CONNECT proxy does not. Picking HTTPS when the proxy is plain HTTP (or vice versa) gives confusing TLS errors. Confirm with whoever runs the proxy.
A common pattern: ssh -D 1080 user@bastion opens a SOCKS5 tunnel on localhost:1080. Set the host’s proxy to SOCKS5 / 127.0.0.1 / 1080 to route through that tunnel.
Some proxies don’t allow the client to resolve the target’s hostname themselves and require the proxy to do it. In practice that’s transparent in Rumus, but corporate proxies sometimes block lookups for hosts not on an allowlist — if the SSH target doesn’t resolve through the proxy, the proxy admin needs to add it.
Avoid special characters that need URL-encoding in the password field — Rumus handles them correctly, but if you’ve copied a password from somewhere that pre-encoded it (%40 instead of @), the proxy will reject it.
Proxy gotcha we didn’t cover? Ask in the Rumus community.

​
Next steps

SSH host management

Where every host’s per-host options live.

Jump hosts

Combine proxy + jump chain to reach deeply private networks.