Tunnel remote services with ssh -L local forwarding
Forward a local port through SSH to a service on the remote machine — reach dev servers and databases behind firewalls without exposing them.
Run `ssh -L 8080:localhost:3000 user@server`, then open http://localhost:8080 to reach port 3000 on the server.
01Command
Command
$ ssh -L 8080:localhost:3000 user@server02What it does
The syntax `ssh -L LOCAL:HOST:REMOTE user@server` means: when traffic hits my local port, send it through the SSH connection, and from the server connect to HOST:REMOTE. Because that last hop is made from the server, you can target services that only listen on the server's loopback — `localhost:5432` reaches a PostgreSQL bound to 127.0.0.1. Add `-N` if you don't want a shell, and `-f` to send the tunnel to the background.
03Risk
!Warning: Adding `-g` or binding to 0.0.0.0 exposes the tunnel to your whole local network — keep the default localhost bind unless you know you need more.
04Undo
✓No undo needed — this command does not change persistent state.
05Sources
- ssh(1) — -L local port forwardingEvidence: Documents -L [bind_address:]port:host:hostport for local forwarding through the SSH connection.
Last verified: 2026-09-17 · Category: Network