SSH Tunneling and Port Forwarding Techniques

Local port forwarding (ssh -L local_port:destination_host:destination_port user@ssh_server) binds a port on your local machine. Traffic sent to that local port travels through the encrypted SSH connection to the SSH server, which then connects to the destination. Your local application talks to localhost while SSH securely delivers traffic to the remote destination.

A common use case for local port forwarding is accessing an internal database behind a firewall. With ssh -L 5432:db.internal:5432 user@bastion, your local PostgreSQL client connects to localhost:5432. The bastion host forwards this traffic to the internal database server, which is otherwise unreachable from the internet.

Remote port forwarding (ssh -R remote_port:local_host:local_port user@ssh_server) binds a port on the remote SSH server. When external clients connect to that remote port, traffic flows back through the SSH tunnel to your local machine. This allows you to expose a locally running service to the world via an internet-facing server.

Remote forwarding is particularly useful when your machine is behind NAT and cannot receive incoming connections directly. By creating a reverse tunnel to a public server, you allow external clients to reach your local service through the public server. This technique is also used by some remote access tools and IoT device management systems.

Dynamic port forwarding (ssh -D local_port user@ssh_server) creates a SOCKS5 proxy on your local machine. Any SOCKS5-capable application can route traffic through this proxy, which will appear to originate from the SSH server. This effectively routes your browsing through the remote network, useful for accessing geo-restricted resources or bypassing local network filters.

Reverse tunnels are powerful but introduce security risks. If a server allows GatewayPorts, remote forwarded ports become accessible to the public internet, not just localhost. An attacker who compromises a machine with a reverse tunnel can potentially reach internal services. Organizations should monitor for unauthorized reverse tunnels and restrict GatewayPorts in SSH configurations.

The SSH server configuration controls tunneling capabilities. AllowTcpForwarding controls whether local and remote port forwarding is permitted. AllowStreamLocalForwarding controls Unix socket forwarding. Setting these to no disables tunneling for all users; you can also restrict them per-user or per-group. Disabling unnecessary forwarding reduces the attack surface.

SSH supports creating tun network interfaces for full IP tunneling (ssh -w). This turns SSH into a lightweight VPN where entire IP packets are tunneled, not just specific TCP connections. PermitTunnel must be enabled on the server. While less efficient than dedicated VPN software, this approach requires no additional software and leverages existing SSH infrastructure.

SSH connection multiplexing (ControlMaster and ControlPath settings) reuses an existing SSH connection for new sessions. This dramatically speeds up subsequent connections to the same host, which is particularly valuable in scripted environments. Tunnels can also be kept alive across multiple SSH sessions using the shared connection.

Network administrators can detect SSH tunneling through unusual traffic patterns: long-lived TCP connections on port 22, unexpectedly high data volumes for connections that should only carry terminal traffic, or connections to known-sensitive destinations after being established. Deep packet inspection cannot see SSH content, but metadata analysis can flag suspicious tunnel behavior.

For authorized use, document all tunnels and their purposes. Use -N (no command) with tunnels to avoid opening a shell unnecessarily, and -f (background) to run them without blocking your terminal. For persistent tunnels, use AutoSSH or systemd socket activation, which automatically restarts the tunnel if the connection drops.

You want to expose your local development server (running on port 3000) to the internet through a public SSH server. Which forwarding type should you use?

SSH tunneling recap: local forwarding (-L) securely reaches internal services from your machine, remote forwarding (-R) exposes local services through a public server, dynamic forwarding (-D) creates a SOCKS5 proxy for application-level traffic routing, tun forwarding enables full IP VPN, and AllowTcpForwarding on the server controls these capabilities.