What Is an SSH Tunnel? Local, Remote and Dynamic Port Forwarding
SSH port forwarding carries selected TCP connections through an encrypted SSH channel. Local, remote and dynamic forwarding use that channel in different directions.
What is SSH port forwarding?
Port forwarding listens on one side and carries incoming TCP connections through the SSH session to another host and port. SSH protects the transport, but the authorization and security of the destination application still matter.
It can provide controlled access to a database or management panel that is not public, reach an internal service temporarily or create a SOCKS proxy for selected applications.
Local, remote and dynamic forwarding compared
| Type | Listening side | Traffic destination | OpenSSH option |
|---|---|---|---|
| Local | Client | Host and port reachable from the server side | -L |
| Remote | SSH server | Host and port reachable from the client side | -R |
| Dynamic | Client | Chosen by each application SOCKS request | -D |
How does local port forwarding work?
Local forwarding opens a port on the client. Connections to it travel to the SSH server, which then connects to the specified destination host and port.
In this example, a browser or tool connects to localhost:8080. The SSH server reaches a web service available to it at 127.0.0.1:80.
ssh -N -L 127.0.0.1:8080:127.0.0.1:80 user@ssh-serverHow does remote port forwarding work?
Remote forwarding creates a listening port on the SSH server and carries connections back to a destination reachable from the client. It can expose a temporary development service to a controlled remote system.
The remote listening address and outside accessibility depend on the server GatewayPorts policy. Binding broadly can unintentionally expose a local service to the internet.
ssh -N -R 127.0.0.1:9000:127.0.0.1:3000 user@ssh-serverDynamic forwarding and a SOCKS proxy
Dynamic forwarding creates a SOCKS proxy on the client. A SOCKS-aware application chooses the destination host and port for each connection, and the SSH server makes those outgoing connections.
This is not a full VPN and only appropriately configured application traffic uses it. Where DNS is resolved depends on the application and proxy settings.
ssh -N -D 127.0.0.1:1080 user@ssh-serverSSH tunnel security checklist
Keep the listener on 127.0.0.1 unless deliberate sharing is required.
Open a tunnel only to the required service and port.
Use controls such as AllowTcpForwarding, PermitOpen and GatewayPorts to restrict accounts.
A tunnel does not replace the password or access policy of the destination database or panel.
End the SSH session and listener when the work is complete.
Using 0.0.0.0 or * can make a port reachable by other devices. Do so only deliberately and with matching firewall rules.
Put the guide into practice.
Review the related Varkuna product or open its detailed user guide.