SSH Remote port mapping

SSH port forwarding (tunneling) is one of the most powerful utilities in a systems administrator's toolkit. It allows you to securely traverse firewalls, access private network services, and expose internal ports without modifying router configurations or setting up full VPNs.

---

Common Flag Breakdown

When creating background tunnels, these flags are commonly combined to keep the session silent, secure, and persistent:

• -f: Requests SSH to go to the background just before command execution (prompts for credentials if needed, then detaches).
• -N: Do not execute a remote command (useful when only forwarding ports).
• -C: Enables gzip compression of all data transferred over the tunnel.
• -g: Allows remote hosts on your local network to connect to local forwarded ports (binds to 0.0.0.0 instead of 127.0.0.1).
• -p <port>: Specifies the remote SSH server daemon port if it differs from the default port 22.

---

1. Local Port Forwarding (-L)

Local forwarding opens a listening port on your client machine and routes incoming traffic through the SSH tunnel to a destination reachable from the remote SSH server.

ssh -C -f -N -g -L [local_bind_port]:[target_destination_ip]:[target_port] user@ssh_jump_host

Practical Scenario: Accessing an internal web dashboard (10.3.32.26:80) located behind an edge gateway (192.168.190.115):

ssh -f -N -l root -L 8500:10.3.32.26:80 192.168.190.115

Visiting http://localhost:8500 in your local browser will now tunnel directly to 10.3.32.26:80.

---

2. Remote (Reverse) Port Forwarding (-R)

Remote forwarding opens a listening port on the remote SSH server and directs all incoming connections back to a designated port accessible from your local system. This allows you to expose a local service to an external server.

ssh -C -f -N -g -R [remote_listen_port]:[target_destination_ip]:[target_port] user@remote_server

Practical Scenario: Forwarding traffic received on remote server 174.139.9.66:8080 directly into your local machine's HTTP service on port 80:

ssh -C -f -N -g -R 8080:127.0.0.1:80 master@174.139.9.66

(Note: For remote clients to connect to the remote port, ensure GatewayPorts yes is set in the remote server's /etc/ssh/sshd_config.)

---

3. Dynamic Application Forwarding / SOCKS5 Proxy (-D)

Instead of mapping a single port, dynamic forwarding allocates a local port acting as a SOCKS4/SOCKS5 proxy. Traffic sent through this proxy is automatically routed dynamically depending on the protocol and requested destination host.

ssh -C -f -N -D 1080 user@proxy_jump_host

Configure your web browser or system network settings to use SOCKS proxy 127.0.0.1:1080 to route all browsing traffic through the remote host securely.

---

Comparison Summary

Forwarding Mode	Flag	Where the Listening Port Lives	Primary Use Case
Local	-L	Client / Local Host	Accessing remote private servers or internal DBs
Remote (Reverse)	-R	Remote SSH Server	Exposing local development services to the internet
Dynamic	-D	Client / Local Host	Full-traffic SOCKS5 proxy via remote jump host