2026 SSH via corporate HTTP CONNECT proxies to a rented ProxyMac Mac mini

Security teams increasingly ship laptops where only TCP 443 (and occasionally 80) can reach the public Internet without a ticket—yet your ProxyMac Mac mini in Hong Kong, Japan, Korea, Singapore, or the United States still listens on TCP 22 for SSH. The missing piece is rarely “ProxyMac broke SSH”; it is that your browser traffic rides an HTTP CONNECT tunnel through a forward proxy while raw ssh never learned that contract. This article explains who actually needs CONNECT versus a full-tunnel VPN, compares four transport modes in a matrix with numeric expectations (30–120s proxy auth timeouts, 512KB–8MB/s shaped SCP ceilings on some DLP paths), gives a copy-paste ProxyCommand stanza using nc from OpenBSD netcat on macOS, warns about TLS MITM appliances that rewrite host keys, walks an eight-step escalation from PAC discovery to packet evidence, and shows how to compose the pattern with jump hosts, zero-trust routing, and TCP keepalive tuning so sessions stay alive once CONNECT succeeds.

Pair with help center bootstrap docs and pick a region on pricing before you burn a week proving the proxy instead of the workload.

When only HTTPS may leave the office but your mini still speaks SSH

Enterprises converge on explicit forward proxies because they need URL categorization, malware scanning, and data-loss prevention on every egress byte. That policy is rational—and it collides with developers who still want git push, rsync, and ssh -L into a dedicated build host. The symptom pattern is repetitive: ssh -vvv stalls at Connecting to ... port 22 while curl https://example.com succeeds instantly because the browser picked up HTTPS_PROXY automatically but your shell did not.

• Split-tunnel VPN may expose port 22 only when the tunnel is “full”—document the mode your IT actually ships.
• WPAD can point laptops at different proxies per SSID; hotel Wi-Fi is not your office PAC.
• SOCKS5 proxies advertised in browser-only extensions do not automatically apply to Terminal unless you export variables consistently.

Transport matrix: direct SSH, CONNECT, VPN full tunnel, VPN split

Mode	Who opens TCP 22	Typical latency add	Failure smell
Direct from trusted home ISP	Laptop → mini	0ms proxy tax	CGNAT idle timers—see keepalive guide
HTTP CONNECT through explicit proxy	Proxy → mini	3–15ms per hop	HTTP 407 auth loops
VPN full tunnel	VPN concentrator → Internet	8–40ms	Policy routes still bypass mini region
VPN split + corporate proxy	Laptop → proxy → mini	sum of both	SCP slower than interactive shell

ProxyCommand recipe on macOS using nc -X connect

Apple ships OpenBSD nc with -X connect for classic HTTP CONNECT. Replace placeholders with the host:port your IT documents—never guess from a screenshot.

Host proxymac-jp-via-proxy HostName jp-node.proxymac.com User youruser ProxyCommand nc -X connect -x corporate-proxy.corp.local:8080 %h %p ServerAliveInterval 30 ServerAliveCountMax 4

If your proxy demands Basic credentials, prefer a helper that can supply them without embedding passwords in world-readable files—many teams wrap corkscrew-style helpers in a small signed binary instead of plaintext in ~/.ssh/config.

TLS inspection, PAC files, and the “works in Chrome” illusion

When a TLS inspection appliance terminates outbound TLS, it may still allow CONNECT tunnels to arbitrary ports—but it can also block non-443 CONNECT unless you file an exception. If IT only allows CONNECT :443, you cannot reach :22 through that path; you must request 22 allow-listed to the mini’s public hostname or move SSH behind 443/tcp on a controlled endpoint (not covered by default ProxyMac images—treat that as custom engineering).

Eight-step runbook before you blame the mini’s region

1. Dump PAC from System Settings → Network → Details → Proxies (macOS 15) and archive the URL.
2. Test CONNECT with nc -vz -X connect -x proxy:port mini-host 22.
3. Compare RTT with and without VPN using ping only if ICMP is permitted—otherwise use ssh -G to print resolved config.
4. Layer keepalives per TCP keepalive article so proxies do not recycle idle CONNECT.
5. Validate MTU using PMTUD guide when bulk copy stalls mid-file.
6. Try jump host if a bastion already has clean 22—see bastion guide.
7. Mirror config in Git with redacted proxy hostnames for audit.
8. Escalate with pcaps only after steps 1–6 are reproducible twice in one day.

Stacking ProxyCommand with ProxyJump without circular hops

Many teams place a tiny bastion in a DMZ that already has outbound 22 while laptops remain locked down. Use ProxyJump bastion for the first hop and reserve ProxyCommand for the laptop-to-proxy leg, or invert when the bastion itself must dial through CONNECT—draw the ASCII diagram in your runbook so on-call engineers do not flip the nesting during incidents. The jump host article shows label naming patterns that survive Match exec blocks.

FAQ

Does setting HTTPS_PROXY fix ssh? Not by itself—OpenSSH reads its own directives; export variables only help tools that honor them.

Why does GitHub SSH still work but ProxyMac not? Different hostnames may hit different proxy policy buckets—compare categorization labels in the proxy admin UI.

Can OpenClaw daemons inherit CONNECT settings? LaunchAgents need explicit EnvironmentVariables; shell exports in ~/.zprofile do not apply—mirror the guidance in OpenClaw troubleshooting.

Why ProxyMac Mac mini stays the right destination behind enterprise proxies

Apple Silicon M4 minis in HK / JP / KR / SG / US give you a single long-lived hostname to whitelist on the proxy appliance instead of juggling ephemeral cloud VMs whose names rotate after autoscale events. Once CONNECT and host keys are stable, attach automation agents, Xcode builds, or compliance scanners to the same metal your security team already approved. Use regional pricing to justify a second mini for DR, and keep VNC handy for TCC prompts that SSH alone cannot satisfy.