SSH Tunnel Command Builder
Build ssh -L, -R and -D tunnel commands through a server or a jump host, with keep-alives and the matching ~/.ssh/config block.
Free · No sign-up · Your inputs stay in your browser
Input
Build an SSH tunnel command
Output
Command
ssh
ssh -f -N -L 127.0.0.1:15432:db.internal:5432 -o ServerAliveInterval=30 -o ExitOnForwardFailure=yes [email protected]
Connections to 127.0.0.1:15432 on this machine are carried over SSH and opened from bastion.example.com to db.internal:5432.
~/.ssh/config
Host tunnel-local HostName bastion.example.com User deploy LocalForward 127.0.0.1:15432 db.internal:5432 ServerAliveInterval 30 ExitOnForwardFailure yes SessionType none
Then: ssh -f tunnel-local
Use it
psql -h 127.0.0.1 -p 15432 -U app app # or point any client at 127.0.0.1:15432
-N opens no shell, only the forward; ExitOnForwardFailure makes ssh exit instead of sitting connected when the port is already taken. Binding to 127.0.0.1 keeps the forwarded port off the network. A remote forward listens only on the server's loopback unless sshd allows GatewayPorts.
Runs in this browser. Nothing you paste is sent to a server.
About this tool
Method, assumptions, practical next steps, and limits.
Which direction
A local forward is the everyday case: a database that only listens on a private network becomes reachable at 127.0.0.1 on your laptop. A remote forward goes the other way, for showing a local dev server to a remote machine. A dynamic forward is a SOCKS proxy that routes any traffic through the server. The ssh manual documents each flag.
Make it fail loudly
By default ssh stays connected when a forward cannot bind, leaving you wondering why nothing listens. ExitOnForwardFailure=yes makes it exit instead, and ServerAliveInterval keeps NAT devices from dropping an idle tunnel. For a permanent tunnel use autossh or a systemd unit.