planeproxy

Restricted hotel Wi-Fi or conference networks often block TLS handshakes, making it impossible to reach the Anthropic API or use development tools. This skill provides a secure SSH tunnel to your own VPS on port 443, ensuring consistent connectivity for Claude Code when local networks are hostile.

What it does

• SSH Tunneling establishes a secure path to your own server over port 443 to bypass network filters.
• Pinned Host Keys strictly enforces server identity to prevent man-in-the-middle attacks on untrusted networks.
• Local Proxying exposes SOCKS5 and HTTP proxies on loopback addresses for application-level routing.
• System-Level Routing manages macOS network settings, DNS caches, and stealth-mode firewalling for the duration of the tunnel.
• Connectivity Diagnostics runs specialized preflight checks to detect captive portals and verify the tunnel path.
• Isolation Mode restricts traffic to specific hosts like Anthropic to minimize data leakage on public networks.

How it works

1. Diagnosis via planeproxy doctor to verify the network environment and server host key.
2. Tunnel Activation using planeproxy up to establish the SSH connection and apply macOS routing rules.
3. Command Execution by pointing tools to 127.0.0.1 proxies or using the plane wrapper for CLI tasks.
4. Teardown with planeproxy down to restore system network settings and flush DNS.

Frameworks & tools

The client is written in Go (1.26.5+) and targets macOS. The server side supports Debian and Ubuntu VPS environments using standard openssh-server and systemd.

Why this beats prompting it yourself

Generic SSH commands often fail on restricted networks that only allow HTTPS traffic. This tool automates the complex configuration of port 443 tunneling, host-key pinning, and macOS-specific network routing that a standard prompt would likely misconfigure or skip for safety reasons.

Use cases

• Code with Claude during flights or at conferences where port 22 is blocked.
• Access the Anthropic API through hotel Wi-Fi that intercepts standard TLS handshakes.
• Protect API keys from inspection on networks that attempt to install custom CA certificates.
• Enforce a strict "allow-list only" network environment for sensitive dev work.

Known limitations

Does not provide anonymity or VPN-level encryption for all traffic. System routing and firewall features are macOS only. Requires a personal VPS with a public IPv4 address.