SSH Port Forwarding: Reaching Private Databases with -L, Exposing Internal Services with -R, and SOCKS Proxies with -D

# Syntax
ssh -L [local_ip:]local_port:destination_host:destination_port server

# Connect to PostgreSQL on the server from your local machine
ssh -L 15432:localhost:5432 deploy@prod-server.example.com
# Then locally: psql -h localhost -p 15432 -U admin

# Access Redis behind a firewall
ssh -L 16379:10.0.1.5:6379 deploy@bastion.example.com
# redis-cli -h localhost -p 16379

# Multiple ports at once
ssh -L 15432:localhost:5432     -L 16379:localhost:6379     -L 18080:localhost:8080     deploy@prod-server.example.com

# Keep the tunnel without a shell (-N)
ssh -N -L 15432:localhost:5432 deploy@prod-server.example.com

# Run in the background (-f -N)
ssh -f -N -L 15432:localhost:5432 deploy@prod-server.example.com

# Syntax
ssh -R [remote_ip:]remote_port:destination_host:destination_port server

# Expose local port 3000 as port 8080 on the server
ssh -R 8080:localhost:3000 user@public-server.example.com
# Now public-server.example.com:8080 reaches localhost:3000 on your machine

# Required on the server in /etc/ssh/sshd_config
# GatewayPorts yes    # Allow the remote port to be reached from outside

# Start a SOCKS5 proxy (local port 1080)
ssh -D 1080 user@server.example.com

# Or in the background
ssh -f -N -D 1080 user@server.example.com

# Use the SOCKS5 proxy with curl
curl --socks5 localhost:1080 https://example.com

# Browser settings:
# Firefox → Settings → Network → SOCKS5 proxy localhost:1080

# Open DB tunnels automatically on connect
Host prod-with-tunnel
    HostName prod-server.example.com
    User deploy
    LocalForward 15432 localhost:5432
    LocalForward 16379 localhost:6379

# Tunnel via a jump host
Host internal-via-bastion
    HostName 10.0.1.50
    User ubuntu
    ProxyJump bastion
    LocalForward 18080 localhost:8080

# After configuring, connect and open tunnels in one step
ssh prod-with-tunnel

# List running SSH tunnels
ps aux | grep "ssh -"
# Or
ss -tlnp | grep ssh

# Stop the tunnel on a specific port
pkill -f "ssh -N -L 15432"

# Auto-reconnect tunnels with autossh
sudo apt install -y autossh
autossh -M 0 -f -N -L 15432:localhost:5432 deploy@prod-server.example.com