What is SSH local port forwarding, and when is it used?
ssh -L local_port:target_host:target_port user@server opens a port on your machine and tunnels traffic through the SSH server to the target. It lets you reach a service, such as a private database, that is only accessible from the server's network.
Explain it simply
A tunnel works like a private lane that starts on your laptop and ends inside the office network. Anything you drop in your end comes out at the other.
Say a PostgreSQL database at 10.0.0.5:5432 accepts connections only from the office server, bastion.example.com. You run:
ssh -L 5433:10.0.0.5:5432 amit@bastion.example.com
Now connecting your tool to localhost:5433 sends traffic encrypted to the bastion, which forwards it to 10.0.0.5:5432. The format is -L local_port:target_host:target_port, where target_host is resolved from the server's side.
Useful extras: -N means no remote command, -f runs it in the background. The reverse, -R, exposes a port on the server that leads back to your machine, and -D creates a SOCKS proxy.
By default the local end listens only on 127.0.0.1, which is the safe choice.
Example
ssh -N -f -L 5433:10.0.0.5:5432 amit@bastion.example.com
psql -h localhost -p 5433 -U app mydbWhat to say in the interview
"-L local:host:port creates a local listener that forwards through the SSH server to a target reachable from that server. I use it to reach private databases through a bastion without opening them to the internet. -N and -f keep it as a background tunnel."
Common mistakes
- Thinking the target host is resolved on your laptop; it is resolved on the server.