SSH tunnels: local, remote and dynamic (SOCKS) port forwarding

An SSH tunnel carries other traffic inside an encrypted SSH connection. It lets you reach services that are not open to the internet, such as MySQL bound to 127.0.0.1, without opening firewall ports. It is the quickest secure way to get temporary access.

Before you start

• SSH access to the server, ideally with keys (set up SSH keys).
• OpenSSH on your computer (built into Windows 10/11, macOS and Linux) or PuTTY.
• Shortcuts are easier with an SSH config file.

Local forwarding: reach a remote private service

Forward a port on your computer to a port the server can reach. Example: MySQL listening only on the server's localhost:

ssh -N -L 3307:127.0.0.1:3306 user@203.0.113.25

Now point your database client at 127.0.0.1:3307. -N means "no shell, just the tunnel". The middle address is resolved from the server, so you can also reach another machine on its private network: -L 8080:10.0.0.5:80.

Remote forwarding: share a local service through the server

Make a port on the server forward back to your computer, for example to show a local development site:

ssh -N -R 8080:127.0.0.1:3000 user@203.0.113.25

Port 8080 on the server now reaches port 3000 on your machine. By default it listens only on the server's localhost; to expose it publicly set GatewayPorts clientspecified in sshd_config and use -R 0.0.0.0:8080:127.0.0.1:3000.

Dynamic forwarding: a SOCKS proxy

ssh -N -D 1080 user@203.0.113.25

Set your browser's SOCKS5 proxy to 127.0.0.1:1080 (in Firefox: Settings → Network Settings → Manual proxy, and tick Proxy DNS when using SOCKS v5). Browsing now exits from your server's IP, handy for testing geo-specific content or reaching an admin panel restricted to the server IP.

Using PuTTY on Windows

1. Open PuTTY, enter the host, then go to Connection → SSH → Tunnels.
2. Enter a Source port (e.g. 3307) and Destination (127.0.0.1:3306), choose Local (or Dynamic for SOCKS), click Add.
3. Open the session and log in. The tunnel lives as long as the window.

Keep a tunnel alive

ssh -N -o ServerAliveInterval=30 -o ExitOnForwardFailure=yes -L 3307:127.0.0.1:3306 user@203.0.113.25

For a permanent tunnel use autossh or a systemd service, or switch to a VPN (WireGuard on a VPS).

Troubleshooting

• "bind: Address already in use": the local port is taken; pick another.
• "administratively prohibited": AllowTcpForwarding no is set on the server. Shared hosting accounts often do not allow forwarding.
• Connection refused through the tunnel: the target service is not listening on the address you gave, as seen from the server.

Next steps

• Tunnel RDP through SSH
• Proxy vs VPN explained
• Disable root SSH login