SSH port forwarding, frequently referred to as SSH tunneling, is an incredibly powerful yet often underutilized feature of the Secure Shell protocol. It allows you to transport arbitrary TCP data over a secure, encrypted SSH connection. In a modern infrastructure environment, this capability is essential for bypassing restrictive firewalls, accessing private services within a VPC, and securing otherwise unencrypted legacy protocols.

This guide provides a comprehensive breakdown of the three primary types of SSH port forwarding—Local, Remote, and Dynamic—along with real-world implementation strategies and advanced security configurations.

The Core Concept of SSH Tunneling

At its heart, SSH tunneling creates a secure "pipe" between two machines. Traffic enters one end of the pipe on a specific port, travels through the encrypted SSH tunnel, and exits at the other end to reach its final destination. Because the traffic is encapsulated within the SSH protocol (typically on port 22), it is invisible to intermediate firewalls or deep packet inspection tools that might otherwise block the specific application protocol being used.

Why Engineers Use SSH Port Forwarding

There are three main scenarios where SSH tunneling becomes a necessity:

  1. Accessing Private Services: You have a database or a web dashboard running on a private server that does not have a public IP address.
  2. Exposing Local Development: You are developing a site on your laptop and need to show it to a client or test a webhook from a public service (like GitHub or Stripe).
  3. Privacy and Security: You are on an untrusted public Wi-Fi network and want to route all your browsing traffic through a secure home or office server to prevent snooping.

Local Port Forwarding (The -L Flag)

Local port forwarding is the most common form of SSH tunneling. It allows you to forward a port from your local client machine to a remote server. When you connect to the local port, the SSH client forwards the connection to the SSH server, which then connects to the specified destination host and port.

The Syntax and Logic

The basic syntax for local port forwarding is: