tsocks: let's proxy

The SSH tunnel gives you a SOCKS (the tunneling article ), but ssh -D only proxies what speaks SOCKS: browsers, curl with --proxy. Programs that do not know SOCKS (apt, telnet, the MySQL client) stay direct. tsocks solves that with LD_PRELOAD.

The principle

tsocks is a shared library that intercepts network system calls (connect(), send(), recv()) via LD_PRELOAD. When a program tries to open a TCP connection, tsocks redirects it through the SOCKS proxy on its behalf. The program does not know it is going through a proxy.

The config

# /etc/tsocks.conf
server = 127.0.0.1
server_type = 5
server_port = 1080

One SOCKS server, type 5 (SOCKS v5), port 1080 (the SSH tunnel).

Usage

# One program in proxy mode
tsocks apt-get update

# An entire shell in proxy mode
tsocks bash

# Verify it works
tsocks telnet checkip.dyndns.org 80
GET / HTTP/1.0

If the telnet traverses the tunnel and the responding IP is the remote server’s, tsocks works.

What it does not do

tsocks does not proxy UDP connections (only TCP), does not proxy programs using raw sockets (Perl scripts doing socket(PF_INET, SOCK_RAW, ...)) and does not work with setuid programs (the kernel ignores LD_PRELOAD for setuid binaries, for obvious security reasons).

[edit: 2026] tsocks was replaced in practice by proxychains-ng (more features, more protocols, proxy rotation), but the LD_PRELOAD concept remains the same: intercept network system calls at the libc level. proxychains-ng gained strict mode (fail if the proxy is unreachable) and quiet mode (do not pollute stderr). tsocks earned its place in proxy-forcing history.