SSH Tunnel Protocol
SSH Tunnel Protocol
Route your traffic through an encrypted secure-shell tunnel — one of the most universally permitted protocols on earth. With Obfuscated SSH (OSSH), it slips past deep packet inspection where dedicated VPN protocols get blocked.
What Is the SSH Tunnel?
SSH (Secure Shell) is the protocol that administrators use to manage servers securely all over the world. Because legitimate SSH traffic is expected on virtually every network, it is one of the last protocols a censor can afford to block outright. OrbVPN turns that ubiquity into a privacy advantage.
When you select SSH Tunnel, OrbVPN establishes an encrypted SSH session to the server, exposes it to your device as a local SOCKS5 proxy, and bridges that proxy into the system VPN tunnel with tun2socks. The result is a full-device VPN that travels inside an ordinary-looking SSH connection.
Where SSH Tunnel shines
SSH Tunnel is your fallback when everything else is blocked. On networks that fingerprint and drop WireGuard, VLESS, and even HTTPS tunnels, an SSH or Obfuscated SSH connection often still gets through.
Why SSH Tunnel?
Universally Allowed
SSH traffic is normal on almost every network — corporate, university, and home alike. It blends in where purpose-built VPN protocols stand out.
Obfuscated SSH (OSSH)
OSSH scrambles the SSH handshake into random-looking bytes, removing the signature that DPI systems look for. To an observer, there is nothing identifiable to block.
Proven Cryptography
Built on the battle-hardened SSH protocol with modern key exchange, then wrapped in OrbVPN's obfuscation layers for stealth.
Works Everywhere OrbVPN Does
The SSH Tunnel is available across iOS, Android, macOS, Windows, Linux, Android TV, and FireTV.
The Four SSH Transports
SSH Tunnel ships with four transports. Pick the one that survives your network — or let Smart Connect choose automatically.
Direct SSH — Default
A standard SSH connection straight to the server. Simple, fast, and widely permitted. The right choice on open or lightly filtered networks.
Obfuscated SSH (OSSH)
Transforms the SSH handshake into random-looking data using a ChaCha20 stream cipher with an Argon2id-derived key. Defeats signature-based deep packet inspection.
OSSH over WebSocket
Carries obfuscated SSH inside a WebSocket stream, so it passes through networks that only permit HTTP and HTTPS traffic.
OSSH over CDN (Cloudflare)
Fronts obfuscated SSH through Cloudflare's CDN. Maximum stealth — a censor cannot block it without blocking the millions of websites that share the same CDN.
How OSSH stays invisible
Standard SSH begins with a recognizable version banner and handshake. Obfuscated SSH replaces that opening with a key derived through Argon2id and a ChaCha20 cipher, so the first bytes on the wire look like pure randomness. Once the secure session is established, SSH's own encryption takes over. There is no fixed pattern for a firewall to match.
How It Connects
Authenticate
OrbVPN authenticates with the server over HTTPS and receives your SSH configuration — connection details, host key, the OSSH keyword for obfuscated modes, and an allocated client IP.
Establish the Tunnel
The SSH session is brought up using your selected transport — directly, obfuscated, over WebSocket, or through Cloudflare CDN — and exposed locally as a SOCKS5 proxy.
Bridge to the Device
tun2socks bridges the SOCKS5 proxy into the system VPN interface, so every app on your device is routed through the tunnel — not just your browser.
Verify Traffic
Smart Connect can then confirm that real traffic flows through the tunnel and that your public IP has actually changed before declaring the connection successful.
Restricted-region routing
In censored regions such as Iran and China, OrbVPN intelligently orders its control-channel connections — trying the Cloudflare-fronted path first where direct ports are dropped — so the SSH Tunnel comes up quickly instead of stalling on a blocked port.
When to Use SSH Tunnel
Everything Else Is Blocked
When WireGuard, VLESS, and OrbConnect are all detected on a hostile network, an SSH or OSSH tunnel is the resilient last resort that often still connects.
SSH-Friendly Networks
Many corporate and university networks explicitly allow SSH for legitimate administration. The SSH Tunnel rides that allowance straight through the firewall.
National Firewalls
Obfuscated SSH removes the signature that the Great Firewall, Iran's filtering, and Russia's TSPU look for — making it a strong option in the most censored regions.
Active Probing Environments
OSSH's random-looking handshake gives active-probing censorship systems nothing to fingerprint, helping your connection survive where plain tunnels are torn down.
Considerations
A single SSH tunnel is TCP-based, so it shares TCP's latency profile and is typically slower than WireGuard's UDP path on open networks. Its strength is reach, not raw speed: when nothing else gets through, an SSH or OSSH tunnel frequently does. If you are unsure which protocol and transport to use, let Auto (Smart Connect) decide — it will reach for SSH and OSSH automatically when faster protocols are being blocked.
When the Network Says No, SSH Says Yes
OrbVPN's SSH Tunnel — with Obfuscated SSH over WebSocket and Cloudflare CDN — keeps you connected on the networks that block everything else. Download OrbVPN and break through.