{"id":5095,"date":"2026-08-30T06:11:16","date_gmt":"2026-08-29T21:11:16","guid":{"rendered":"https:\/\/donguri3.net\/server-tech\/ssh-port-forward-types-2\/"},"modified":"2026-08-30T06:11:17","modified_gmt":"2026-08-29T21:11:17","slug":"ssh-port-forward-types","status":"publish","type":"post","link":"https:\/\/donguri3.net\/en\/server-tech\/linux-server-network\/ssh-port-forward-types\/","title":{"rendered":"Comprehensive Guide to SSH Port Forwarding: Differences and Use Cases for Local, Remote, Dynamic, and Multi-hop ProxyJump"},"content":{"rendered":"<p>In our previous article, we covered multi-hop SSH port forwarding using <code>ProxyJump<\/code> (<a href=\"https:\/\/donguri3.net\/compare-tips\/ssh-multi-hop-port-forwarding\/\">Multi-hop Port Forwarding with SSH<\/a>). This feature is extremely useful when you want to access a deep internal network via a bastion host.<\/p>\n<p>However, SSH port forwarding broadly falls into the following three types:<\/p>\n<ul>\n<li>Local Port Forwarding (<code>-L<\/code>)<\/li>\n<li>Remote Port Forwarding (<code>-R<\/code>)<\/li>\n<li>Dynamic Port Forwarding (<code>-D<\/code>)<\/li>\n<\/ul>\n<p>Properly understanding the mechanism and use cases of each helps greatly with troubleshooting and enables more flexible network configurations.<\/p>\n<p>In this article, we will organize these types of SSH port forwarding and introduce application examples incorporating ProxyJump.<\/p>\n<hr \/>\n<h3>1. Local Port Forwarding (<code>-L<\/code>)<\/h3>\n<h4>Overview<\/h4>\n<p>Opens a port on your local machine and forwards access to it, via the SSH destination machine, to yet another host and port.<\/p>\n<h4>Syntax<\/h4>\n<pre class=\"brush: plain; title: ; notranslate\" title=\"\">ssh -L [Local Port]:[Destination Host]:[Destination Port] user@relay-server<\/pre>\n<h4>Example<\/h4>\n<pre class=\"brush: plain; title: ; notranslate\" title=\"\">ssh -L 8080:localhost:80 user@remote<\/pre>\n<p>\u2192 Accessing <code>localhost:8080<\/code> locally reaches <code>localhost:80<\/code> on the remote side.<\/p>\n<h4>Use Cases<\/h4>\n<ul>\n<li>Accessing web services on an internal corporate network from the outside<\/li>\n<li>Connecting to remote databases (MySQL, PostgreSQL, etc.)<\/li>\n<\/ul>\n<hr \/>\n<h3>2. Remote Port Forwarding (<code>-R<\/code>)<\/h3>\n<h4>Overview<\/h4>\n<p>Opens a port on the SSH destination machine and forwards access to it to your local machine.<\/p>\n<h4>Syntax<\/h4>\n<pre class=\"brush: plain; title: ; notranslate\" title=\"\">ssh -R [Remote Port]:[Destination Host]:[Destination Port] user@server<\/pre>\n<h4>Example<\/h4>\n<pre class=\"brush: plain; title: ; notranslate\" title=\"\">ssh -R 9090:localhost:3000 user@vps<\/pre>\n<p>\u2192 Accessing <code>localhost:9090<\/code> on the VPS reaches <code>localhost:3000<\/code> locally.<\/p>\n<h4>Use Cases<\/h4>\n<ul>\n<li>Exposing a local PC behind NAT or a firewall to the outside world<\/li>\n<li>External remote debugging or file sharing<\/li>\n<\/ul>\n<h4>Points to Note<\/h4>\n<ul>\n<li>May require <code>GatewayPorts yes<\/code> in <code>sshd_config<\/code><\/li>\n<li>Exposing services externally carries security risks and requires adequate safeguards<\/li>\n<\/ul>\n<hr \/>\n<h3>3. Dynamic Port Forwarding (<code>-D<\/code>)<\/h3>\n<h4>Overview<\/h4>\n<p>Functions as a SOCKS proxy, allowing the client to dynamically determine the destination of the port forwarding.<\/p>\n<h4>Syntax<\/h4>\n<pre class=\"brush: plain; title: ; notranslate\" title=\"\">ssh -D [Local Port] user@server<\/pre>\n<h4>Example<\/h4>\n<pre class=\"brush: plain; title: ; notranslate\" title=\"\">ssh -D 1080 user@remote<\/pre>\n<p>\u2192 Launches a SOCKS5 proxy locally.<\/p>\n<h4>Use Cases<\/h4>\n<ul>\n<li>Routing browser traffic through an SSH tunnel (privacy protection, bypassing geographic restrictions)<\/li>\n<li>Building a lightweight secure communication path as a VPN alternative<\/li>\n<\/ul>\n<h4>Characteristics<\/h4>\n<ul>\n<li>The destination is dynamic (DNS resolution can also be handled remotely)<\/li>\n<li>Assumes concurrent use with SOCKS-compatible applications such as browsers or curl<\/li>\n<\/ul>\n<hr \/>\n<h3>4. Multi-hop Port Forwarding and ProxyJump Applications<\/h3>\n<p>To reach a destination through multiple servers as stepping stones, use <code>ProxyJump<\/code> (or the legacy <code>-J<\/code> option).<\/p>\n<h4>Syntax Example (Local Port Forwarding + ProxyJump)<\/h4>\n<pre class=\"brush: plain; title: ; notranslate\" title=\"\">ssh -J user1@jump1,user2@jump2 -L 8080:target:80 user3@target<\/pre>\n<h4>Characteristics<\/h4>\n<ul>\n<li>Can be simplified by configuring it in <code>~\/.ssh\/config<\/code><\/li>\n<li>Flexible because SSH connections at each stage can be explicitly specified<\/li>\n<\/ul>\n<hr \/>\n<h3>5. Practical Use Cases and Summary Table<\/h3>\n<table class=\"w-fit min-w-(--thread-content-width)\">\n<thead>\n<tr>\n<th>Forwarding Type<\/th>\n<th>Main Use Case<\/th>\n<th>Key Point<\/th>\n<\/tr>\n<\/thead>\n<p>\\<\/p>\n<tbody>\n<tr>\n<td>Local (-L)<\/td>\n<td>External \u2192 Internal<\/td>\n<td>Service utilization<\/td>\n<\/tr>\n<tr>\n<td>Remote (-R)<\/td>\n<td>Internal \u2192 External<\/td>\n<td>Service exposure<\/td>\n<\/tr>\n<tr>\n<td>Dynamic (-D)<\/td>\n<td>Proxy communication<\/td>\n<td>Via SOCKS<\/td>\n<\/tr>\n<tr>\n<td>Multi-hop (-J)<\/td>\n<td>Access via relays<\/td>\n<td>Utilizing ProxyJump<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h4>Security Perspective is Also Important<\/h4>\n<ul>\n<div>Always be aware of what can be accessed via port forwarding<\/div>\n<li>Apply firewalls and authentication restrictions to exposed ports<\/li>\n<\/ul>\n<hr \/>\n<h3>Conclusion<\/h3>\n<p>SSH port forwarding may look complicated at first glance, but once you grasp the basic syntax and how to choose the right type for your purpose, it becomes an extremely powerful tool. At Nando Kobo, we actively cover these unassuming yet reliably useful technologies.<\/p>\n<p>Some people have the impression that &quot;port forwarding is dangerous,&quot; but with proper knowledge and configuration, it serves as a powerful weapon for building secure communication paths.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In our previous article, we covered multi-hop SSH port forwarding using ProxyJump (Multi-hop Port Forwarding w [&hellip;]<\/p>\n","protected":false},"author":4,"featured_media":1800,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_locale":"en_US","_original_post":"https:\/\/donguri3.net\/?p=1739","footnotes":""},"categories":[1170],"tags":[488,24,10,310,381,331],"class_list":["post-5095","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-linux-server-network","tag-ssh","tag-vpn","tag-server","tag-310","tag-381","tag-331","en-US"],"_links":{"self":[{"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/posts\/5095","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/comments?post=5095"}],"version-history":[{"count":1,"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/posts\/5095\/revisions"}],"predecessor-version":[{"id":5098,"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/posts\/5095\/revisions\/5098"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/media\/1800"}],"wp:attachment":[{"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/media?parent=5095"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/categories?post=5095"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/tags?post=5095"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}