> ## Documentation Index
> Fetch the complete documentation index at: https://www.rumus.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Proxy settings

> Connect through HTTP, HTTPS, or SOCKS5 proxies — configured per host.

When your network requires a proxy to reach SSH targets — corporate networks, restricted environments, or just a SOCKS tunnel you've set up locally — Rumus can route the connection through it. Proxy is configured **per host**, not globally.

## Supported proxy protocols

| Protocol   | When to use                                                                           |
| ---------- | ------------------------------------------------------------------------------------- |
| **HTTP**   | A standard HTTP CONNECT proxy                                                         |
| **HTTPS**  | The same, over TLS                                                                    |
| **SOCKS5** | A SOCKS5 proxy — common for local tunnels (e.g. `ssh -D 1080`) and many privacy tools |

All three support optional username / password authentication.

## Add a proxy to a host

<Steps>
  <Step title="Open the host editor">
    **Settings → Vaults → Hosts → \[your host]** → switch to the **Proxy** tab inside Advanced.
  </Step>

  <Step title="Enable proxy">
    Toggle **Enable Proxy** on. The protocol, host, and port fields appear.
  </Step>

  <Step title="Pick a protocol">
    HTTP, HTTPS, or SOCKS5. Match whatever your proxy actually is — picking the wrong one is the #1 cause of mysterious "connection refused" errors.
  </Step>

  <Step title="Fill in proxy host and port">
    The address and port of the proxy itself, not the SSH target.
  </Step>

  <Step title="(Optional) Auth">
    If the proxy requires authentication, fill in the **Proxy Username** and **Proxy Password** fields. Both are stored encrypted in the [vault](/docs/account/vault) along with the rest of the host.
  </Step>

  <Step title="Save and test">
    Save the host and connect. If anything's off, the failure usually shows up in the connection error.
  </Step>
</Steps>

## Per-host, not global

Rumus deliberately does not have a global proxy setting. Each host carries its own. The reason: most users have hosts that need a proxy and hosts that don't, often inside the same session, and a global setting would force everything through one path.

If many hosts share a proxy:

* Set it on each — it's a few seconds per host, and you only do it once.
* Or treat the proxy itself as a bastion: configure a SOCKS5 tunnel to a jump host you do have direct access to, and set that as the proxy on every internal host.

## How proxy interacts with jump chains

If a host has both a proxy and a [jump chain](/docs/remote/jump-hosts):

* The proxy is used for the **first hop only** — your machine reaching the first jump host.
* Subsequent hops (jump → jump → target) ride the bastion's network, not your machine's proxy.

If a bastion needs *its own* proxy to reach the next hop, configure that proxy on the bastion's own host record.

## Common gotchas

<AccordionGroup>
  <Accordion title="HTTP vs HTTPS proxy mix-up">
    An HTTPS proxy speaks TLS to the proxy server itself. An HTTP CONNECT proxy does not. Picking HTTPS when the proxy is plain HTTP (or vice versa) gives confusing TLS errors. Confirm with whoever runs the proxy.
  </Accordion>

  <Accordion title="SOCKS5 with a local tunnel">
    A common pattern: `ssh -D 1080 user@bastion` opens a SOCKS5 tunnel on `localhost:1080`. Set the host's proxy to **SOCKS5 / 127.0.0.1 / 1080** to route through that tunnel.
  </Accordion>

  <Accordion title="Proxy needs DNS resolution of the SSH target">
    Some proxies don't allow the client to resolve the target's hostname themselves and require the proxy to do it. In practice that's transparent in Rumus, but corporate proxies sometimes block lookups for hosts not on an allowlist — if the SSH target doesn't resolve through the proxy, the proxy admin needs to add it.
  </Accordion>

  <Accordion title="Authentication string formatting">
    Avoid special characters that need URL-encoding in the password field — Rumus handles them correctly, but if you've copied a password from somewhere that pre-encoded it (`%40` instead of `@`), the proxy will reject it.
  </Accordion>
</AccordionGroup>

<Note>
  Proxy gotcha we didn't cover? Ask in the [Rumus community](https://www.rumus.ai/community).
</Note>

## Next steps

<CardGroup cols={2}>
  <Card title="SSH host management" icon="server" href="/docs/remote/hosts">
    Where every host's per-host options live.
  </Card>

  <Card title="Jump hosts" icon="link" href="/docs/remote/jump-hosts">
    Combine proxy + jump chain to reach deeply private networks.
  </Card>
</CardGroup>