SSH tunnels and port forwarding

In short: With SSH, arbitrary network connections can be routed encrypted through an existing SSH connection, for example to reach a service that is otherwise unreachable.

In more detail: SSH does not only protect remote access to the command line. With port forwarding it builds an encrypted tunnel through which other programs send their traffic. This is handy for using services that are only reachable in the internal network or have no encryption of their own, securely.

In Depth

Local forwarding (-L)

A port on your own computer is forwarded to a destination behind the server:

ssh -L 5433:localhost:5432 user@server

Afterwards a program on your computer reaches, at localhost:5433, the database that on the server only listens on localhost:5432. Typical case: do not expose a database or admin interface publicly to the internet but use it through a tunnel.

Remote forwarding (-R)

A port on the server is routed to your computer:

ssh -R 8080:localhost:3000 user@server

This makes the local development site (port 3000) reachable through the server on port 8080, even if your computer sits behind NAT or CGNAT, because the connection is established from inside to outside.

Dynamic forwarding (-D)

ssh -D 1080 user@server

A SOCKS proxy arises on port 1080. If you set the browser to it, all web traffic runs encrypted through the server, similar to a simple VPN.

Notes

With -N no terminal is opened, only tunnelling; -f sends the connection to the background. With a jump host (-J bastion) you reach machines that are only accessible through an intermediate server. Tunnels bypass firewall rules, so the server should allow them only for authorised users (AllowTcpForwarding in sshd_config). For permanent tunnels use autossh or a systemd service.

See also: SSH, SSH on Linux, VPN, NAT