SSH Tunneling: Simple Localhost Port Forwarding

Quick one-liner: Access a server's localhost-only application from your workstation using SSH port forwarding — one command, no extra tools needed.

🤔 Why This Matters

Recently I had an application running on 127.0.0.1:8080 on a remote server. No network interface exposed it — it was only accessible from localhost on that server.

The easiest way to access it? SSH tunneling.

🚀 The Command

To tunnel a remote port to your local machine:

ssh -g -L 9999:localhost:8080 -f -N username@remoteip

Let me break down each flag:

Flag	What It Does
`-L 9999:localhost:8080`	Forward local port `9999` to `localhost:8080` on the remote server
`-g`	Allow other hosts on your network to use the tunnel (optional)
`-f`	Go to background after authentication
`-N`	Don't execute a remote command — just forward ports

This creates a tunnel: your machine's port 9999 → SSH → remote server's localhost:8080.

✅ Test It

Launch your browser and visit:

http://localhost:9999

You're now accessing the application running on the remote server's localhost — through an encrypted SSH tunnel.

🔧 Real-World Examples

Access a remote MySQL database:

ssh -L 3306:localhost:3306 -f -N dbadmin@db-server

Then connect locally:

mysql -u root -p -h 127.0.0.1 -P 3306

Access a remote Redis instance:

ssh -L 6379:localhost:6379 -f -N admin@redis-server

Access a web dashboard:

ssh -L 8080:localhost:8080 -f -N deploy@web-server

Then open http://localhost:8080 in your browser.

🧹 Clean Up

When you're done, kill the tunnel:

pkill -f "ssh.*-L.*9999"

Or skip -f and run it in the foreground. Close the terminal to kill the tunnel.

🔒 Why This Is Safer Than Opening Ports

Opening a port to 0.0.0.0 means anyone on the network can reach your service. SSH tunneling means:

The service stays bound to 127.0.0.1 on the server
Only people with SSH access can reach it
The connection is encrypted end-to-end
No firewall changes, no config edits, no restarts