SSH & Keys

SSH Tunnel Builder

Port Forwarding

SSH Tunnel Configuration

Configure your SSH tunnel parameters to generate the command. Fill in the required fields and customize advanced options as needed.
Forward a local port to a remote host through SSH server

Tool features

Build SSH tunnel commands with advanced configuration options
4 features

All three directions

Local (-L), remote (-R) and dynamic (-D) forwarding from one form

Correct port syntax

Gets the local:host:remote ordering right, which is the usual thing to fumble

Copy-ready command

Produces a command you can paste straight into a terminal

Advanced options

Compression, keepalives, bind address and identity file

What SSH port forwarding is & how it works

Carrying ordinary TCP inside an encrypted SSH session

SSH port forwarding — tunnelling — carries an ordinary TCP connection inside an SSH session. Because the SSH connection is already authenticated and encrypted, anything routed through it inherits both. It is how you reach a database that only listens on localhost, or a service on a private network with no public address, without opening a firewall port.

There are three directions. -L (local) opens a port on your machine that emerges on the server's side of the network. -R (remote) does the reverse, exposing something on your machine to the server. -D (dynamic) turns the session into a SOCKS proxy that can reach anything the server can. This tool assembles the exact command for whichever you pick.

-L local
e.g. -L 5432:localhost:5432 — your port 5432 reaches the database as the server sees it.
-R remote
e.g. -R 8080:localhost:3000 — the server's port 8080 reaches your local dev server.
-D dynamic
e.g. -D 1080 — a SOCKS5 proxy on your machine, routing through the server.
-N and -f
-N runs no remote command (tunnel only); -f drops it to the background.

How to use this tool

Build an SSH tunnel command in five steps
1
Pick a tunnel type
Choose Local to reach something through the server, Remote to expose something of yours to it, or Dynamic for a general SOCKS proxy.
2
Enter the SSH connection details
The SSH host and username are required. Add a non-standard Port and a private key path if the server needs them.
3
Set the ports
Local and remote tunnels need a local port, a remote host and a remote port. Dynamic tunnels need only the SOCKS port to listen on.
4
Add options if you need them
Compression helps on slow links; keepalives stop idle tunnels being dropped by a firewall. A bind address controls who else can use the forwarded port.
5
Copy and run the command
Paste it into a terminal. The tunnel stays up as long as the SSH session does — add -f -N to background it, or put the forward in ~/.ssh/config to make it permanent.

Related tools

Keep debugging with tools from the same suite
3 tools
SSH Key Generator
Generate SSH key pairs (RSA, ECDSA, Ed25519) for secure server authentication
SSH Config Builder
Visual SSH configuration file builder for multiple hosts with advanced options
Port Checker
Check if specific ports are open on a server or IP address with connection testing

Frequently asked questions

Common questions about SSH port forwarding
8 Q&A

Local (-L) opens a port on your machine that connects out through the server — the usual way to reach an internal database. Remote (-R) opens a port on the server that connects back to your machine, useful for demoing a local dev server. Dynamic (-D) creates a SOCKS5 proxy on your machine that routes any traffic through the server.

A local tunnel. ssh -L 5432:localhost:5432 user@server means "connect to port 5432 on my machine and you reach port 5432 as the server sees it" — so localhost in that command refers to the server, not you. Then point your client at localhost:5432.

By default sshd binds remote forwards to the loopback interface, so only the server can use them. To expose the port more widely, the server needs GatewayPorts yes (or clientspecified) in /etc/ssh/sshd_config. That is a server-side setting — you cannot enable it from the client.

Idle connections get culled by NAT and firewalls. Set ServerAliveInterval 60 so the client sends a keepalive every minute, and consider a supervisor such as autossh for tunnels that must survive network changes and reconnect on their own.

-N tells SSH not to run a remote command — you want the tunnel, not a shell. -f pushes SSH into the background once authentication finishes. Together, ssh -f -N -L ... is the standard way to start a tunnel without tying up a terminal window.

Put the forward in ~/.ssh/config under the host block — LocalForward 5432 localhost:5432 — and it opens automatically whenever you connect to that alias. For a tunnel that must always be up, run it under a process supervisor such as systemd or autossh.

It can be. A forwarded port is a hole through your normal network boundaries, and binding one to 0.0.0.0 instead of localhost makes it reachable by anyone who can reach that interface. Bind to localhost unless you specifically intend to share it, and remember that server operators can disable forwarding entirely with AllowTcpForwarding no.

No. The command is assembled in your browser and never transmitted. Nothing you type here — hostname, username, key path — leaves the page, and no connection is made from this tool.