RemoteForward & DynamicForward

RemoteForward — expose a local service to the remote

The mirror image of LocalForward. -R remote-port:host:port opens a port on the remote machine that tunnels back to a target reachable from your machine. Use case: your dev server is running locally, and you want a colleague (on the remote machine) to reach it without you exposing it to the public internet.

DynamicForward — a SOCKS proxy through SSH

-D local-port opens a SOCKS proxy on your local port. Anything that uses that proxy — your browser, curl with --socks5-hostname, system-wide proxy settings — gets tunneled through the SSH connection and exits to the wider network from the SSH server's vantage point. This is essentially a quick-and-dirty VPN that requires no extra software.

The three forwards in one table

Type	Flag	Direction	Use case
Local	`-L`	local → remote	Reach a remote service privately from your laptop
Remote	`-R`	remote → local	Expose a local service to a remote host
Dynamic	`-D`	SOCKS proxy	Route arbitrary traffic through the SSH connection

Code

RemoteForward·bash

# Expose your local 3000 on the server's port 8080
ssh -R 8080:localhost:3000 server
# Now from the server, curl localhost:8080 reaches your laptop's 3000

# In ~/.ssh/config
# Host expose
#     HostName server.example.com
#     RemoteForward 8080 localhost:3000

DynamicForward (SOCKS)·bash

# Open a SOCKS5 proxy on local port 1080, no shell
ssh -NfD 1080 server

# Use it from curl
curl --socks5-hostname localhost:1080 http://internal-only.example.com

# Configure your browser: SOCKS host=localhost, port=1080
# All browser traffic now exits from `server`'s network

Exercise

Open a SOCKS proxy: ssh -NfD 1080 your-host. Run curl --socks5-hostname localhost:1080 https://ifconfig.me and confirm the public IP returned matches your remote host's public IP, not your laptop's. That's the whole VPN trick — exit traffic from elsewhere. Kill the proxy with pkill -f 'ssh -NfD 1080' when done.