Skip to content

Run Claude Code / Codex on a Remote Server via SSH Proxy

Created on May 19, 2026 , last updated on May 20, 2026  •  0 views

2026   ·   tools   hpc   ssh

HPC clusters can’t reach openai.com or claude.ai, and without sudo we can’t install a VPN on the cluster. The workaround: tunnel your local proxy (e.g. Clash) to the remote server over SSH with RemoteForward, so Claude Code and Codex can phone home with no firewall changes on either side.

Prerequisites

Item Details
Local proxy Running on your local machine (e.g. Clash); note the port (default: 7890)
VS Code + Remote SSH Connected to the remote server — see the VS Code Remote SSH Guide if not yet set up
Claude Code / Codex Installed on the remote server — see Install Claude Code & Codex on ITSC Cluster

1. Add RemoteForward to Your SSH Config

Open ~/.ssh/config on your local machine.

Add RemoteForward 7890 127.0.0.1:7890 to every Host block you connect to:

Host chpc-login
    HostName chpc-login.itsc.cuhk.edu.hk
    User YOUR_COMPUTING_ID
    IdentityFile ~/.ssh/id_ed25519
    IdentitiesOnly yes
    ControlMaster auto
    ControlPersist 10m
    RemoteForward 7890 127.0.0.1:7890   # ← add this line

Host chpc-gpu0?? chpc-gpu0??.rc.cuhk.edu.hk
    HostName %h.rc.cuhk.edu.hk
    User YOUR_COMPUTING_ID
    IdentityFile ~/.ssh/id_ed25519
    IdentitiesOnly yes
    ProxyJump chpc-login
    RemoteForward 7890 127.0.0.1:7890   # ← add this line

Host chpc-cn??? chpc-cn???.rc.cuhk.edu.hk
    HostName %h.rc.cuhk.edu.hk
    User YOUR_COMPUTING_ID
    IdentityFile ~/.ssh/id_ed25519
    IdentitiesOnly yes
    ProxyJump chpc-login
    RemoteForward 7890 127.0.0.1:7890   # ← add this line

Note: 7890 must match your local proxy’s mixed port. In Clash, check Settings → Mixed Port.

RemoteForward makes port 7890 on the remote machine forward traffic back to 127.0.0.1:7890 on your laptop. Combined with ProxyJump, the forward propagates through the jump chain, so compute nodes get the proxy too.

2. Export Proxy Variables on the Remote Server

For bash or zsh, append to ~/.bashrc / ~/.zshrc:

export HTTP_PROXY="http://127.0.0.1:7890"
export HTTPS_PROXY="http://127.0.0.1:7890"
export ALL_PROXY="socks5://127.0.0.1:7890"

Reload the config (source ~/.bashrc, etc.) or open a fresh terminal.

3. Verify

Reconnect to the server via VS Code Remote SSH, then run:

curl -x http://127.0.0.1:7890 https://api.anthropic.com
# or, for Codex:
curl -x http://127.0.0.1:7890 https://api.openai.com

Any response — even an HTTP error body — means the tunnel is alive. Claude Code and Codex can now reach the internet.

Alternative: Codex-Specific .env (If Shell Variables Fail)

If Codex still can’t reach the API after setting shell variables (e.g. when launched from an IDE plugin or non-interactive context), create ~/.codex/.env:

tee ~/.codex/.env <<'EOF'
http_proxy="http://127.0.0.1:7890"
https_proxy="http://127.0.0.1:7890"
all_proxy="socks5://127.0.0.1:7890"
EOF
chmod 600 ~/.codex/.env

This file is loaded automatically when Codex starts — independent of your shell environment.

Format rules:

  • One variable per line, values in double quotes
  • Do not use export
  • Do not omit the quotes

This approach is process-level rather than session-level, so it won’t pollute other tools (curl, apt, etc.) in the same shell.

FAQ

Question Answer
Connection refused on port 7890 Check that your local proxy is running and the port matches. Also confirm RemoteForward is under the correct Host block.
bind: Address already in use warning Another SSH session already forwarded 7890 to this host. Disconnect the stale session (or pick a different port) and reconnect.
Proxy variables set but tools still fail Reload your shell config or open a new terminal — the variables only take effect in new shells.
Using a different port Replace every 7890 with your actual proxy port in both the SSH config and the shell config.