SSH forwarding and tunnel direction

Mechanism

SSH forwarding carries connections through an authenticated SSH channel. Local forwarding exposes a listener on the client side and connects from the server side; remote forwarding reverses the listener placement. SOCKS forwarding selects destinations dynamically. Routing success depends on listener binding, server policy, and reachability from the connecting side.

Practical method

Draw the listener, SSH endpoints, and final destination before configuring a tunnel. Bind local listeners to loopback when only your client needs them. Verify the destination from the correct side, then test the forwarded protocol with a harmless request.

ssh -N -L 127.0.0.1:8080:internal.lab:80 lab-gateway
# Destination resolution and connection occur on the gateway side.

Interpreting evidence

A working TCP tunnel does not automatically forward DNS or every application dependency. Confirm the application request reaches the intended final service.

Pitfalls and limits

Remote-listener binding depends on server configuration. A tunnel can accidentally expose an internal service if bound broadly. Application redirects may send the client outside the tunnel.