Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
SSH port forwarding turns an encrypted SSH session into a controlled path for TCP connections. Use -L when your laptop should reach a service through the VPS, -R when a VPS-side process should reach a service on your laptop, and -D when an application needs a SOCKS proxy that can reach multiple destinations through the VPS.
Start with loopback addresses such as 127.0.0.1 or ::1. A loopback listener is reachable only on the machine where SSH creates it. Exposing a forwarded port to other hosts requires an intentional bind address, compatible OpenSSH server policy, and any required VPS firewall or security-group rule.
What SSH port forwarding does
An SSH tunnel carries ordinary TCP streams inside an authenticated, encrypted SSH connection. The forwarding option determines where a listening socket is created and which side opens the final connection to the destination service.
With local forwarding, the SSH client listens on your computer. When an application connects to that local port, SSH sends the stream to the VPS, and the VPS-side SSH process connects to the destination host and port. With remote forwarding, sshd listens on the VPS; a connection arriving there travels through SSH, and your client opens the destination connection. Dynamic forwarding is different: the client listens as a SOCKS4/SOCKS5 proxy and opens a destination selected by each SOCKS request through the SSH server.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
The tunnel itself does not publish a service automatically. It creates a listener only while the SSH session is running, and normal network controls still apply on the VPS and on the destination host.
Prerequisites and a safe starting point
- A Linux, macOS, Windows OpenSSH client or another SSH client that supports the requested forwarding mode.
- An SSH account on the VPS, the VPS hostname or address, and a working key or password authentication method.
- Network reachability from the side that will open the destination connection. For
-Land-R, the destination hostname is interpreted from the appropriate SSH side, not necessarily from your laptop. - Permission to create the listener port. Choose an unused unprivileged port such as 8080, 9000, 1080 or 15432.
- Administrative access to the VPS if you need to change
sshdforwarding policy or listener exposure.
Use -N for a tunnel-only session. It tells SSH not to run a remote shell command, making the purpose of the connection clear and avoiding an unnecessary interactive process.
Choose the forwarding mode
| Mode | Command pattern | Listener | Where the destination connection opens | Destinations | Typical use |
|---|---|---|---|---|---|
Local (-L) |
ssh -N -L [bind:]local_port:host:host_port user@vps |
SSH client | VPS or another host reachable from the VPS | One fixed host and port per forwarding rule | Reach a private database, web console or internal API through the VPS |
Remote (-R) |
ssh -N -R [bind:]remote_port:host:host_port user@vps |
SSH server | SSH client side | One fixed host and port per forwarding rule | Let a VPS-side process reach a service running on your laptop |
Dynamic (-D) |
ssh -N -D [bind:]socks_port user@vps |
SSH client | Selected for each SOCKS request through the VPS side | Many TCP destinations chosen by the SOCKS-aware application | Use the VPS as an application-level SOCKS proxy |
The bracketed bind value is the local address on the side where the listener is created. Omitting it can result in a wildcard bind depending on the client and platform; specify an address explicitly when exposure matters.
Local forwarding with -L
Basic pattern
The form is:
ssh -N -L 127.0.0.1:8080:127.0.0.1:8000 user@vps
SSH listens on 127.0.0.1:8080 on your computer. A request sent there crosses the tunnel, and the VPS tries to connect to 127.0.0.1:8000 from the VPS itself. This is useful when a development server, administrative page or other service is bound to the VPS loopback interface.
Reach a private host behind the VPS
The destination does not have to be the VPS itself. For example:
ssh -N -L 127.0.0.1:15432:10.20.0.15:5432 user@vps
Connect your local database client to 127.0.0.1:15432. The VPS opens a connection to 10.20.0.15:5432, which might be reachable only on the VPS’s private network. Your database client never needs a route to 10.20.0.15.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Step-by-step
- Identify the service address and port as seen from the VPS. Test that the VPS can reach it using an appropriate client or diagnostic command.
- Pick an unused local port. Use a different local port if the service’s standard port is already occupied on your computer.
- Run
ssh -N -L 127.0.0.1:local_port:destination_host:destination_port user@vps, replacing the placeholders. - Leave that SSH process connected. Configure your local application to use
127.0.0.1:local_port. - Verify the application connection. For an HTTP service, for example, request
http://127.0.0.1:8080when 8080 is the chosen local port.
Allowing another computer to use a local forward
A local forward bound to 127.0.0.1 accepts connections only from the SSH client machine. Binding it to a specific LAN address or a wildcard makes it reachable through those interfaces, but also exposes the forwarded service to every host that can reach that address. Use this only when the access is deliberate, and protect the listener with the destination service’s authentication and host-level firewall rules.
Remote forwarding with -R
Basic pattern
The form is:
ssh -N -R 127.0.0.1:9000:127.0.0.1:9000 user@vps
Here sshd creates 127.0.0.1:9000 on the VPS. When a VPS-side process connects to that port, SSH sends the stream to your computer, and your SSH client connects to 127.0.0.1:9000 locally. A web service running on your laptop can therefore be consumed by a process on the VPS without opening the laptop’s firewall to the public internet.
Step-by-step
- Confirm that the service is listening on the client side and note the address and port that the SSH client can reach.
- Choose an unused port on the VPS.
- Run
ssh -N -R 127.0.0.1:remote_port:client_destination_host:client_destination_port user@vps. - From the VPS, configure the consuming process to connect to
127.0.0.1:remote_port. - Keep the SSH session alive for as long as the remote process needs the path.
Why a remote forward may be visible only on the VPS
OpenSSH binds remote forwards to the loopback address by default. Consequently, a remote forward that works when tested on the VPS can fail from a second machine even though the tunnel is healthy. That behavior is expected for a 127.0.0.1 bind and the default GatewayPorts no policy.
Making a remote forward reachable from other hosts
To request a non-loopback listener, specify an intentional bind address, for example:
ssh -N -R 0.0.0.0:9000:127.0.0.1:9000 user@vps
This request succeeds only if the SSH server’s GatewayPorts policy permits it. It also exposes the port on all IPv4 interfaces, so a VPS firewall or security group must be configured separately if outside clients are expected to connect. Prefer a specific private interface address over 0.0.0.0 when the service should be available to only one network.
Dynamic forwarding with -D
Start a SOCKS proxy
Run:
ssh -N -D 127.0.0.1:1080 user@vps
The SSH client listens as a SOCKS4/SOCKS5 endpoint on your computer. Configure an application that supports SOCKS to use host 127.0.0.1 and port 1080. Each request can name a different TCP destination, so one dynamic tunnel can serve several hosts without a separate -L rule for each one.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
What dynamic forwarding does not do
It is not a system-wide VPN and does not automatically proxy every program. Only applications configured to use the SOCKS endpoint send traffic through it. Programs without SOCKS support need an additional, separately configured proxying layer. The forwarding options described here carry TCP streams; they do not promise transparent UDP tunneling.
Check the traffic path
For each destination, consider where name resolution and the outbound connection are performed by the SOCKS-aware application and SSH implementation. Test with an application that explicitly reports proxy use, and do not assume that a browser, package manager or command-line tool is using the tunnel merely because the SSH session is open.
Listener addresses, reachability and exposure
Loopback is the safest default
Use 127.0.0.1 for IPv4 or ::1 for IPv6 when a dashboard, database or development service is for your own use. A loopback listener is not reachable through the VPS’s network interfaces, which sharply reduces accidental exposure.
Wildcard and public binds need two controls
A wildcard bind such as 0.0.0.0 listens on every IPv4 interface. A public bind can make a forwarded service reachable from the internet if routing and firewall rules permit it. You need both an SSH policy that allows the requested bind and a VPS provider firewall or security-group rule that allows the intended source addresses. Provider-level controls are outside OpenSSH and can block or permit traffic independently.
Understand which side owns each port
- For
-L, the listener port is on the SSH client; a collision is local to that machine. - For
-R, the listener port is on the SSH server; a collision is on the VPS or another process using that bind address. - For
-D, the SOCKS listener is on the SSH client.
Control forwarding in the VPS SSH server
Forwarding policy
AllowTcpForwarding can permit all TCP forwarding, only local forwarding, only remote forwarding, or none. Use AllowTcpForwarding local when an account needs -L but must not create -R listeners; use remote for the opposite case. DisableForwarding yes broadly disables forwarding features for an account or configuration context.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Remote bind policy
GatewayPorts controls whether remote forwards may bind to non-loopback addresses. Its documented default is no, so a remote forward normally stays on the VPS loopback interface. Changing this policy increases the possible audience for every permitted remote forward; pair it with narrow account rules and firewall restrictions.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Inspect, edit and reload safely
- Inspect the effective settings using the configuration-display tool supplied by the installed OpenSSH release, commonly
sshd -T. Check the result forallowtcpforwarding,disableforwardingandgatewayports. - Edit the active
sshd_configor an included drop-in, taking account of the order in which your distribution processes included files. - Validate syntax before reloading with the installed daemon’s test mode, commonly
sshd -t. Fix every reported error before applying the change. - Keep an existing administrative SSH session open while changing access policy. Use a separate test session to confirm the new forwarding behavior before closing the working session.
- Reload the SSH service with the service manager used by your distribution, then inspect the effective configuration again if the result is unexpected.
Restrict individual credentials
For service accounts, combine a restricted account or forced command with key options that match the intended tunnel. no-port-forwarding removes forwarding for that key. permitopen limits destinations that a client-side forward may open, while permitlisten limits addresses and ports that a remote forward may listen on. These key-level restrictions can prevent a credential from becoming a general-purpose tunnel even when the global server policy permits forwarding.
Security checklist for production tunnels
- Bind administrative interfaces and databases to loopback unless another host genuinely needs access.
- Use a dedicated SSH account or key for automation, with only the forwarding direction and destinations required.
- Apply
AllowTcpForwarding localorremoteinstead of unrestricted forwarding when the use case needs one direction. - Use
permitopenandpermitlistento constrain service accounts, and considerno-port-forwardingfor keys that should never tunnel. - Review VPS firewall and security-group rules separately from
sshd; a successful SSH login does not imply that a forwarded listener is reachable from outside. - Choose non-conflicting ports and record which side owns each listener so that incident response can find and close it quickly.
- Close the SSH session when the path is no longer needed. A forward remains available for as long as its SSH connection and server policy permit it.
Troubleshooting SSH forwarding
administratively prohibited
This normally indicates a server-side forwarding policy or an authorized-key restriction. Inspect AllowTcpForwarding and DisableForwarding, then check the key for no-port-forwarding, permitopen or permitlisten. Also verify that the requested direction matches a local or remote restriction.
bind: Address already in use
The listener port is occupied on the side where the forward is created. For -L or -D, choose another local port or stop the local process using it. For -R, choose another VPS port or identify the process already bound there. A different destination port does not fix a collision on the listener side.
Recommended Free Tools
The remote forward works on the VPS but not from another machine
Check the requested bind address first. A 127.0.0.1 listener is intentionally private to the VPS, and GatewayPorts no prevents non-loopback remote binds. If outside access is required, request a specific non-loopback bind, obtain a compatible GatewayPorts policy, and allow the source through the VPS firewall or security group.
The SOCKS tunnel is open but an application is not using it
Dynamic forwarding affects only SOCKS-aware applications configured for the exact address and port of the listener. Set the application’s SOCKS4 or SOCKS5 proxy fields explicitly and confirm that the application supports the required protocol. An unrelated program will continue to use its normal network path.
The tunnel connects but the destination service fails
Test reachability from the side that opens the destination connection. For -L, the VPS must be able to reach the destination; for -R, the client must be able to reach its destination. Check the destination service’s own bind address, authentication, host firewall and listening port. SSH can carry the stream only after that side can establish the underlying TCP connection.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
You expected UDP or a full network tunnel
These forwarding options are for TCP streams. They do not create a transparent UDP tunnel or route every packet from the operating system. Use a technology designed for network-layer or UDP transport when that is the actual requirement.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Practical designs
Private web administration through a bastion VPS
Use -L with a loopback local bind and the internal web host as the destination. The browser talks to a local port, while the VPS reaches the private web interface. No public listener is required on the internal host.
Temporary preview from a laptop to a VPS process
Use -R with a loopback VPS bind when a process on the VPS must call a development service on your laptop. The VPS process uses the remote listener, and the laptop service remains unexposed to other internet hosts.
Several TCP destinations through one client proxy
Use -D when the application can speak SOCKS and users need to select different TCP hosts during one session. Keep the SOCKS listener on client loopback unless another local machine is intentionally allowed to use it.
Limits to plan for
Forwarding is tied to the lifetime of the SSH connection. Network interruptions, logout, server restarts or policy changes remove the path. Each fixed -L or -R rule represents one listener and one destination; add separate rules when you need several fixed services. Dynamic forwarding handles multiple TCP destinations, but only through applications that support SOCKS. Treat every listener as a network service with an address, an owner, an access policy and a shutdown plan.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
