Port forwarding

Port forwarding lets you route network traffic between your Android device and an SSH server. You can use it to access services that are not directly reachable, or to expose a local service to the server.

Two directions

The app asks: Where should the listening port be opened?

On this device - Access a remote service locally

A port opens on your phone. Any traffic sent to that port is tunnelled through the SSH connection to a service that the server can reach.

Example: You run a database on a private network behind the server. Set up a rule so that port 5432 on your phone forwards to the database's internal IP and port 5432. Your local apps can then connect to localhost:5432 and reach the remote database.

Fields you fill in:

• Local Port - the port opened on your device.
• Target Host - the address the server can see (e.g. an internal IP or hostname).
• Target Port - the port on the target host.

On the SSH server - Expose a local service remotely

A port opens on the server. Any traffic arriving there is forwarded back through the SSH tunnel to a service running on your phone.

Example: You run a web server on your phone on port 8080. Set up a rule so that port 8080 on the server forwards to localhost:8080 on your device. Users on the server's network can then access your web server by connecting to the server's IP on port 8080.

Fields you fill in:

• Server Port - the port opened on the server.
• Target Host - the address of the service on your device (usually localhost or 127.0.0.1).
• Target Port - the port of the local service to expose.

Creating a rule

1. Open the session you want to forward through.
2. Choose Manage Tunnels from the tab's menu.
3. Tap Add Tunnel.
4. Choose where the port should be opened: On this device or On the SSH server.
5. Fill in the fields. The Route preview updates as you type.
6. Give the rule a Name so you can recognise it later.
7. Tap Save.

Managing tunnels

Rules appear in Manage Tunnels. There are two lists:

• Profile Rules - saved on the machine's profile. They start automatically when you connect. To change them, edit the profile, not the tunnel list.
• Ad-hoc Tunnels - created for the current session only. You can delete them here.

Whether a tunnel is running is the switch on its row. Two states say more than that: Starting... while it is coming up, and Error with the reason underneath if it could not.

Switching a tunnel off stops the forwarding but keeps the rule - it stays in the list, idle, ready to be switched back on. That is deliberate: switching off is not deleting.

To remove an ad-hoc tunnel, tap the trash icon. Profile rules cannot be deleted from here.