Forward ports with tunnels
Reach a service that only the server can see, such as a database, through an encrypted SSH tunnel, or run a SOCKS5 proxy through the server.
Port forwarding carries network connections inside your SSH connection. For example, a database on the server may listen only on the server itself, on port 5432. A tunnel makes it appear on your device at localhost:5432, so your database tool can connect as if it were local.
Kinds of tunnel
| Type | What happens | Typical use |
|---|---|---|
| Local forward | Listen here, and open each connection from the server. | Reach a database or admin page that only the server can reach. |
| Remote forward | The server listens, and each connection comes back to this device. | Let the server reach a service running on your device. |
| Dynamic (SOCKS5) | A SOCKS5 proxy here; the client picks the destination. | Browse through the server's network. |
Add a tunnel
A tunnel rides on a saved host, so save the host first.
Open Settings › Tunnels, or tap the Tunnels button on the host list. Tap Add tunnel.
Name: something you will recognise, such as
Postgres on the app box.Carried by: the saved host whose SSH connection carries the tunnel.
Type: Local forward, Remote forward or Dynamic (SOCKS5).
Fill in the ports for the type you picked:
- Local forward: Local port on this device, then Destination host and Destination port as seen from the server. For a database on the server itself, use
localhostand5432. - Remote forward: Port on the server (and optionally a Bind address on the server), then the Address on this device and Port on this device that connections are handed to.
- Dynamic: the port for the SOCKS5 proxy on this device. Point a browser or a command at it.
- Local forward: Local port on this device, then Destination host and Destination port as seen from the server. For a database on the server itself, use
Save, then start the tunnel from the Tunnels list. Each running tunnel shows how many connections it carries.
Stop all stops every running tunnel. A deleted tunnel is stopped first.
Keep tunnels private
By default a tunnel listens on 127.0.0.1, so only your own device can use it. Turning on Allow other devices to use it binds it to every interface.
WARNING
A tunnel open to your network has no password of its own. Anything that can reach your device can use it to reach the other end. Leave Allow other devices to use it off unless you need it, and never on public Wi-Fi.
Ports below 1024 are privileged. Unless the app runs with administrator rights, the system refuses to listen on them, so pick a higher local port such as 8080 or 15432.
For a remote forward, a blank bind address asks the server to listen on every interface. Most servers refuse that unless GatewayPorts is turned on in their SSH settings.