What is SSH tunneling?

SSH tunneling (SSH port forwarding) lets you forward TCP connections through an encrypted SSH connection. You can use it to access services behind a firewall, expose a local service through a remote server, or create a SOCKS proxy for browsing through a remote network.

What is the difference between -L, -R, and -D?

-L creates a local port forward (open a port on your machine and send traffic through SSH to a destination). -R creates a remote port forward (open a port on the SSH server and send traffic back to your local machine). -D creates a dynamic forward (a local SOCKS proxy that can route traffic to many destinations through the SSH server).

How do I create an SSH tunnel to a database?

Use local port forwarding with -L. Example: ssh -N -L 127.0.0.1:5432:127.0.0.1:5432 user@server. Then connect your DB client to localhost:5432. Use a different local port if 5432 is already in use.

How do I keep an SSH tunnel alive?

Use ServerAliveInterval/ServerAliveCountMax keepalives, and consider autossh to restart the tunnel automatically if it drops. For long-running tunnels, run autossh under systemd with Restart=always.

SSH Tunnel Command Builder

Build SSH tunnels for local port forwarding (-L), remote port forwarding (-R), or a SOCKS proxy (-D). Generate a ready-to-run command (with ProxyJump, keepalive options, and autossh) plus an optional ~/.ssh/config snippet.

Presets:

SSH Connection

SSH Host *

Tip: You can enter host or user@host. For multi-hop, use ProxyJump.

Port (-p)

Leave blank for the default (22).

Identity File (-i)

ProxyJump (-J)

Comma-separated for multiple hops: user@hop1,user@hop2.

ssh_config Host Alias (optional)

When set, generates a ~/.ssh/config snippet.

Command Runner

Use autossh (auto-restart)

If enabled, command starts with autossh -M 0.

Tunnel Type

Type

Quick explanation

Open a port on your machine and forward traffic through the SSH server to a destination.

Local Forwards (-L)

Bind address

Use 127.0.0.1 to keep it local. Use 0.0.0.0 to allow LAN access.

GatewayPorts (-g)

Allow remote hosts to connect (-g)

In ssh_config this is GatewayPorts yes.

Options

-N (no remote command) -T (no TTY) -f (background) -C (compression) -v (verbose) ExitOnForwardFailure

ServerAliveInterval

Send keepalives every N seconds (0 disables).

ServerAliveCountMax

Disconnect after N missed keepalives.

Generated Command

# Fill in the form to generate an SSH tunnel command

ssh_config Snippet (Optional)

# Enter a Host alias to generate a ~/.ssh/config snippet

SSH Tunnel Command Builder

SSH Connection

Tunnel Type

Local Forwards (-L)

Remote Forwards (-R)

Dynamic Forward (-D)

Options

Generated Command

ssh_config Snippet (Optional)

Frequently Asked Questions

SSH Tunnel Command Builder

SSH Connection

Tunnel Type

Local Forwards (-L) + Add

Remote Forwards (-R) + Add

Dynamic Forward (-D)

Options

Generated Command

ssh_config Snippet (Optional)

Related Tools & Guides

SSH Tunneling Guide

SSH Key Generator

DNS Lookup

Frequently Asked Questions

Local Forwards (-L)

Remote Forwards (-R)