SSH Tunneling and Port Forwarding: The Complete Masterclass

SSH tunnels let you access remote services securely without exposing them to the internet. Whether you need to reach a database behind a firewall or create a SOCKS proxy, SSH tunneling is an essential skill for every sysadmin.

Local Port Forwarding (-L)

Access a remote service through your local machine.

# Access remote PostgreSQL (port 5432) via localhost:5433
ssh -L 5433:localhost:5432 user@dbserver

# Access internal web app through jump host
ssh -L 8080:internal-app:80 user@bastion

# Then connect: psql -h localhost -p 5433
# Or browse: http://localhost:8080

Remote Port Forwarding (-R)

Expose your local service to a remote server.

# Make local dev server accessible on remote port 8080
ssh -R 8080:localhost:3000 user@remote-server

# Anyone accessing remote-server:8080 reaches your localhost:3000

Dynamic SOCKS Proxy (-D)

# Create SOCKS5 proxy on localhost:1080
ssh -D 1080 user@proxy-server

# Configure browser/apps to use SOCKS5 proxy: localhost:1080
# All traffic routed through the SSH tunnel

Jump Hosts / ProxyJump

# ProxyJump (SSH 7.3+)
ssh -J user@bastion user@internal-server

# Chain multiple jumps
ssh -J bastion1,bastion2 user@target

# In ~/.ssh/config
Host internal-*
    ProxyJump bastion
    User admin

Host bastion
    HostName bastion.example.com
    User jump-user
    IdentityFile ~/.ssh/bastion_key

Persistent Tunnels with autossh

# Install
sudo apt install autossh

# Persistent tunnel (auto-reconnect)
autossh -M 0 -f -N -L 5433:localhost:5432 user@dbserver

# As a systemd service
# /etc/systemd/system/ssh-tunnel.service
[Unit]
Description=SSH Tunnel to Database
After=network.target

[Service]
User=tunnel-user
ExecStart=/usr/bin/autossh -M 0 -N -L 5433:localhost:5432 user@dbserver
Restart=always
RestartSec=10

[Install]
WantedBy=multi-user.target

SSH Multiplexing (Speed)

# ~/.ssh/config
Host *
    ControlMaster auto
    ControlPath ~/.ssh/sockets/%r@%h-%p
    ControlPersist 600

# First connection establishes socket
# Subsequent connections reuse it (instant connect)

SSH tunnels are one of the most powerful tools in a sysadmin's arsenal. They provide encrypted access to services without VPNs, firewall changes, or exposing ports to the internet. Master the three tunnel types and you can securely access anything from anywhere.