Short answer

The SSH outbound forwards traffic through an SSH server, useful when you already have an SSH jump host or private-network path. In real use, trust the provider subscription first and then verify whether the selected client core supports this exact type.

What It Means

In Clash/Mihomo configuration, ssh identifies the outbound type used by the node, policy or group. The same display name in a GUI can hide different transport fields, so the YAML or subscription output is more reliable than the node nickname.

Common Fields

type: ssh
server / port
username
password
private-key
private-key-passphrase
host-key

When to Use It

You already have an SSH server or jump host.
Some rule-matched traffic should be forwarded through SSH.
The provider or self-hosted environment uses key authentication.

Support Checks Checks

Skipping host-key verification reduces security.
Private keys and passphrases are sensitive.
An SSH login being available does not guarantee good forwarding quality.

Minimal Shape

proxies:
- name: "ssh-out"
  type: ssh
  server: server.example.com
  port: 22
  username: user
  private-key: /path/to/key

Compatibility Notes

Client support changes with the bundled core. A maintained Mihomo-based client usually supports more modern node types than historical Clash clients, but mobile clients and iOS alternatives still vary by app and release.

If a subscription contains this type but the client filters it out, switch to a compatible client, ask the provider for a compatible subscription format, or use a converter only when you understand what fields are being changed.

Official Reference

SSH in Mihomo docs

SSH Protocol