SSH Port Forwarding

Tunnel TCP through an SSH connection. Common flags: -N (no remote command, just forward), -f (background), -g (let others use a local forward). user@host is the SSH server you connect through.

Local forward (-L) — reach a remote service locally

Bind a port on your machine that tunnels to a host reachable from the SSH server. Useful for reaching a service behind the server.

ssh -N -L 8080:target.host:80 user@sshserver
# now http://localhost:8080 hits target.host:80 through sshserver

Remote forward (-R) — expose a local service on the remote

Bind a port on the SSH server that tunnels back to a host reachable from you. This is the classic reverse tunnel / callback.

ssh -N -R 9000:localhost:3000 user@sshserver
# sshserver's localhost:9000 now reaches your localhost:3000

Dynamic forward (-D) — SOCKS proxy for pivoting

Turn the SSH connection into a SOCKS proxy; point tools at it to route arbitrary traffic through the server’s network.

ssh -N -D 1080 user@sshserver
# then: proxychains <tool>, or set SOCKS5 127.0.0.1:1080

Loopback isolation vs. exposing the forward

By default a -L forward binds only to 127.0.0.1 on your machine — other hosts can’t use it. That loopback isolation is usually what you want.

To deliberately expose it to your LAN, bind all interfaces with -g or an explicit bind address:

ssh -N -g -L 8080:target.host:80 user@sshserver      # any interface
ssh -N -L 0.0.0.0:8080:target.host:80 user@sshserver # explicit

For -R, exposing beyond the server’s loopback also needs GatewayPorts yes (or clientspecified) in the server’s sshd_config.

See also

• socat — port forwarding without SSH.
• SCP — copying files over the same SSH transport.