Forward a port

A forwarding rule opens a tunnel through one of your hosts, like ssh -L, ssh -R or ssh -D. Rules are saved and synced like hosts; whether one is running is up to each device.

Rules are under Port forwarding in the desktop sidebar, and under Settings › Tools › Port forwarding on the phone.

Create a rule

1. Choose New rule.
2. Pick the Type:
   • Local (-L): opens a port on this device that reaches a service on the host’s side, for example a database that only listens on the server: bind 127.0.0.1:5432, destination 127.0.0.1:5432.
   • Remote (-R): opens a port on the host that reaches a service on this device, for example to let the server reach a development server running on your laptop.
   • Dynamic / SOCKS (-D): runs a SOCKS 5 proxy on this device that sends its traffic out through the host. It needs no destination.
3. Choose the Host the tunnel runs through. Its saved login is used, and its jump hosts too: a rule can go through any chain of hosts.
4. Name the rule and set the ports. The Bind address is usually 127.0.0.1, so that only this device can use the tunnel. The Destination address is seen from the host: 127.0.0.1 there means the host itself.
5. Choose Auto-start: Off (start it by hand), When the host connects, or On app launch.
6. Save (Create rule in the step-by-step form).

Each rule in the list shows the equivalent ssh command; Copy puts it on the clipboard.

Start, stop and test it

• Use the rule’s switch, or Start and Stop. The list shows Active with the number of connections, or the last error.
• Test checks a running rule from end to end: it connects through the tunnel and says whether the destination answered, closed the connection, or nothing listens on the rule’s port. For a SOCKS rule it checks that a SOCKS 5 proxy answers.
• A rule for a web service offers Open in browser.

If the host’s connection drops, a running rule waits and starts again once the host has reconnected (with Auto-reconnect on, up to 10 tries over about five minutes, and at once when the device’s network changes).

Rules that ask before they start

Some rules start only after you approve them on this device:

• a rule whose bind address is anything but 127.0.0.1 or localhost, because other devices on your network can then reach the port;
• a rule from a team vault or a vault shared with you, because someone else can change it.

The rule shows Waiting for approval. Start it to see what it opens, through which host and which trusted host keys, and approve it. The approval is kept on this device only and is asked again after any change to the rule, or to the host it goes through.

A team can also require that its forwards listen on this device only (Team policies).

On the phone

Forwards run while the app runs. With Keep sessions alive in background on (Settings › Background & keep-alive, on by default), Android keeps them going behind the Active connections notification while you use other apps. When the app itself is ended (swiped away, stopped by a battery saver, the phone restarted), its tunnels end with it.

Next

• Connect through jump hosts and proxies.
• Every field of a rule: Sessions and tools.