root

Jun 11 2026

---

What Is SSH Port Forwarding?

SSH port forwarding (also called SSH tunneling) lets you route network traffic through an encrypted SSH connection. This is useful for:

• Accessing services on a remote server that aren't exposed to the internet
• Bypassing firewalls or restrictive networks
• Securing unencrypted protocols (like HTTP or database connections) over a safe channel

There are three types of SSH port forwarding:

Type	Direction	Use Case
Local (-L)	Local → Remote	Access a remote service from your machine
Remote (-R)	Remote → Local	Expose a local service to a remote server
Dynamic (-D)	Local → Any	Use SSH as a SOCKS proxy

---

Local Forwarding -L — Access a remote service locally

Scenario: A database on port 5432 is firewalled, but SSH is open.

ssh -L 5433:localhost:5432 [email protected]

• 5433 — port on your machine
• localhost:5432 — the target on the remote side
• While the session is open, connect locally: psql -h localhost -p 5433
  Run it in the background with no shell:

ssh -N -f -L 5433:localhost:5432 [email protected]

---

Remote Forwarding -R — Expose a local service on a remote server

Scenario: Share your local dev server with someone on a remote machine.

ssh -R 8080:localhost:3000 [email protected]

Anyone on my-server.com can now reach your local port 3000 via localhost:8080.

To make it publicly accessible, set GatewayPorts yes in the server's sshd_config.

---

Dynamic Forwarding -D — SOCKS proxy

Scenario: Route all browser traffic through a remote server.

ssh -D 1080 [email protected]

Then point your browser to SOCKS5 proxy 127.0.0.1:1080. Verify it works:

curl --socks5 127.0.0.1:1080 https://ifconfig.me
# returns the server's IP, not yours

---

Applies to OpenSSH on Linux, macOS, and Windows (WSL/PowerShell).

---