Port forwarding secures connections by tunneling local or remote ports through SSH. Useful for accessing services behind firewalls or across untrusted networks.

Local forward: traffic from your localhost goes through SSH to a service on the remote side.

$ ssh -L 8000:localhost:3000 user@host

Now localhost:8000 connects through host to its localhost:3000. Useful for accessing a database or web service on a remote server.

Bind to all interfaces (less secure):

$ ssh -L 0.0.0.0:8000:localhost:3000 user@host

Remote forward: traffic from the remote host comes back through SSH to your machine.

$ ssh -R 8000:localhost:3000 user@host

Now host:8000 connects back through SSH to your localhost:3000. Useful for exposing a local service to a remote network.

SOCKS proxy: use SSH as a proxy for all traffic.

$ ssh -D 8000 user@host

Clients can configure localhost:8000 as a SOCKS5 proxy. Browser, curl, or other apps route traffic through the tunnel.

Persist tunnels in ~/.ssh/config:

Host work
    HostName work.example.com
    LocalForward 8000 localhost:3000
    RemoteForward 8000 localhost:3000

Common options:

-L [bind_address:]port:remote_host:remote_port
-R [bind_address:]port:local_host:local_port
-D [bind_address:]port
-N             don't execute commands (just forward)
-f             run in background

Keep tunnel alive in background: ssh -NfL 8000:localhost:3000 user@host