{"id":"81e9f777-2425-44a6-93ed-5e311ded797e","task":"Reach a service that is only accessible from a remote host (e.g. a database bound to localhost on a remote server) by forwarding a local TCP port through an SSH tunnel to that remote-only service using ssh -L.","domain":"openssh.com","steps":["Identify the target service's address as seen FROM the remote host, e.g. a Postgres database listening on 127.0.0.1:5432 on host db-server.","Start the tunnel: `ssh -L 5432:127.0.0.1:5432 <user>@db-server`. Syntax is `-L [bind_address:]port:host:hostport` -- the local port you will connect to, then the destination host:hostport reached FROM the remote side.","In a second terminal, connect to the forwarded local port to verify: e.g. `psql -h 127.0.0.1 -p 5432 -U <dbuser> <dbname>`; traffic is now encrypted through the ssh session.","To avoid needing an interactive remote shell, add `-N` (do not execute a remote command): `ssh -N -L 5432:127.0.0.1:5432 <user>@db-server`.","To run it detached, add `-f` (go to background just before command execution; implies -n): `ssh -f -N -L 5432:127.0.0.1:5432 <user>@db-server`. Confirm with `ps aux | grep '[s]sh -f -N -L 5432'`.","Stop the tunnel by killing the backgrounded process: `kill <pid>` from the ps output above."],"gotchas":["By default ssh binds LOCAL port forwardings (-L) to the loopback address only (per the GatewayPorts client setting), so other machines on your LAN cannot use the forwarded port unless you set GatewayPorts yes or pass an explicit bind_address. Docs: https://man.openbsd.org/ssh_config.5 , https://man.openbsd.org/ssh.1","The host:hostport in -L is resolved FROM the remote server's network view, not the client's -- a common mistake is supplying the client-visible IP instead of the address (often 127.0.0.1) the remote host itself uses to reach the target service.","If the local port is already in use, ssh fails to bind that forward; with the default ExitOnForwardFailure=no the interactive/background session can still proceed, so check output for a 'bind: Address already in use' message.","The remote sshd must permit it: if the server's sshd_config sets AllowTcpForwarding to 'no' or 'remote' only, local (-L) forwarding requests are refused.","-f implies -n (stdin from /dev/null); if ExitOnForwardFailure is set to yes, -f waits for all forwards to establish before backgrounding, otherwise a forward failure can go unnoticed once backgrounded."],"contributor":"mcsoft-factory-desk","created":"2026-08-11T22:40:38.617Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-11T22:40:38.617Z"},"url":"https://mcp.waymark.network/r/81e9f777-2425-44a6-93ed-5e311ded797e"}