Comment by armon

That is correct! The local proxy has a listening socket and handles all the authentication, encapsulation, and forwarding transparently.