Comprehensive Guide to SSH Port Forwarding: Differences and Use Cases for Local, Remote, Dynamic, and Multi-hop ProxyJump

2026-08-30

In our previous article, we covered multi-hop SSH port forwarding using ProxyJump (Multi-hop Port Forwarding with SSH). This feature is extremely useful when you want to access a deep internal network via a bastion host.

However, SSH port forwarding broadly falls into the following three types:

• Local Port Forwarding (-L)
• Remote Port Forwarding (-R)
• Dynamic Port Forwarding (-D)

Properly understanding the mechanism and use cases of each helps greatly with troubleshooting and enables more flexible network configurations.

In this article, we will organize these types of SSH port forwarding and introduce application examples incorporating ProxyJump.

1. Local Port Forwarding (-L)

Overview

Opens a port on your local machine and forwards access to it, via the SSH destination machine, to yet another host and port.

Syntax

ssh -L [Local Port]:[Destination Host]:[Destination Port] user@relay-server

Example

ssh -L 8080:localhost:80 user@remote

→ Accessing localhost:8080 locally reaches localhost:80 on the remote side.

Use Cases

• Accessing web services on an internal corporate network from the outside
• Connecting to remote databases (MySQL, PostgreSQL, etc.)

2. Remote Port Forwarding (-R)

Overview

Opens a port on the SSH destination machine and forwards access to it to your local machine.

Syntax

ssh -R [Remote Port]:[Destination Host]:[Destination Port] user@server

Example

ssh -R 9090:localhost:3000 user@vps

→ Accessing localhost:9090 on the VPS reaches localhost:3000 locally.

Use Cases

• Exposing a local PC behind NAT or a firewall to the outside world
• External remote debugging or file sharing

Points to Note

• May require GatewayPorts yes in sshd_config
• Exposing services externally carries security risks and requires adequate safeguards

3. Dynamic Port Forwarding (-D)

Overview

Functions as a SOCKS proxy, allowing the client to dynamically determine the destination of the port forwarding.

Syntax

ssh -D [Local Port] user@server

Example

ssh -D 1080 user@remote

→ Launches a SOCKS5 proxy locally.

Use Cases

• Routing browser traffic through an SSH tunnel (privacy protection, bypassing geographic restrictions)
• Building a lightweight secure communication path as a VPN alternative

Characteristics

• The destination is dynamic (DNS resolution can also be handled remotely)
• Assumes concurrent use with SOCKS-compatible applications such as browsers or curl

4. Multi-hop Port Forwarding and ProxyJump Applications

To reach a destination through multiple servers as stepping stones, use ProxyJump (or the legacy -J option).

Syntax Example (Local Port Forwarding + ProxyJump)

ssh -J user1@jump1,user2@jump2 -L 8080:target:80 user3@target

Characteristics

• Can be simplified by configuring it in ~/.ssh/config
• Flexible because SSH connections at each stage can be explicitly specified

5. Practical Use Cases and Summary Table

\

Security Perspective is Also Important

Always be aware of what can be accessed via port forwarding
• Apply firewalls and authentication restrictions to exposed ports

Conclusion

SSH port forwarding may look complicated at first glance, but once you grasp the basic syntax and how to choose the right type for your purpose, it becomes an extremely powerful tool. At Nando Kobo, we actively cover these unassuming yet reliably useful technologies.

Some people have the impression that "port forwarding is dangerous," but with proper knowledge and configuration, it serves as a powerful weapon for building secure communication paths.