How to Route One Command Through a Stable Proxy

If only one test command needs a stable public IP, route that command through a SOCKS proxy instead of sending all device traffic through a VPN.

This keeps normal browsing and development traffic on the usual connection while giving selected requests a predictable exit point.

Why it happens

A VPN route for one server IP does not always affect requests to a domain name. If the domain sits behind a reverse proxy or content delivery network, DNS points to an edge server rather than the origin server.

The practical fix is a per-command proxy. A SOCKS proxy carries only the traffic that explicitly uses it.

Set up a temporary SOCKS proxy

1. Open a tunnel through a trusted remote host:

   ssh -D 1080 -N USER@TRUSTED_HOST

   The -D option opens a local SOCKS port. The -N option creates the tunnel without running a remote command.

2. Send one request through the proxy:

   curl --proxy socks5h://127.0.0.1:1080 -I https://example.com/test-path

3. Compare the public exit IP with and without the proxy using a trusted IP-check endpoint.

4. If an external firewall needs an allow rule, allow only the remote host’s stable public IP and restrict the rule to the required hostname or path.

Why socks5h matters

The final h tells the proxy to resolve the hostname. This helps ensure that both DNS resolution and the connection follow the proxy path.

HTTPS still works normally. The proxy carries the encrypted connection, while certificate validation still checks the requested hostname.

Common mistakes

• Cause: Routing only the origin IP while the hostname points to an edge network. Fix: Proxy the request by hostname.

• Cause: Using a full-tunnel VPN for a single test. Fix: Use a per-command proxy.

• Cause: Using socks5 when remote DNS resolution is required. Fix: Use socks5h.

• Cause: Creating a broad allow rule. Fix: Limit it to the stable exit IP and the smallest useful request scope.

Bind the SOCKS listener to loopback

An explicit example is ssh -D 127.0.0.1:1080 -N -o ExitOnForwardFailure=yes [email protected]. Keep the session open while testing and close it afterwards. The proxy uses the remote host’s network path, but a stable exit address still depends on that host’s routing and provider configuration.

A per-command SOCKS proxy is a simple way to get a stable test IP without changing the route for the whole device. The next action is to test one harmless request through the proxy and confirm that its exit IP changes.

Reference: curl proxy options.