I am trying to understand the difference between "local port forwarding" and "dynamic port forwarding".

In the ssh command for "local port forwarding", is it always required to specify the destination host?

Does "dynamic" in "dynamic port forwarding" mean that, in the ssh command for "dynamic port forwarding", there is no need to specify the destination host? if yes, when is the destination specified?

up vote 12 down vote accepted

Yes, you have to specify a destination IP and port when using local forwarding. From man ssh:

 -L [bind_address:]port:host:hostport
         Specifies that the given port on the local (client) host is to be
         forwarded to the given host and port on the remote side.

Clearly, only the bind address is optional.

No, you can't specify a destination host or port when using dynamic forwarding. In dynamic forwarding, SSH acts as a SOCKS proxy. Again from the manpage (emphasis mine):


 -D [bind_address:]port
         Specifies a local “dynamic” application-level port forwarding.
         This works by allocating a socket to listen to port on the local
         side, optionally bound to the specified bind_address.  Whenever a
         connection is made to this port, the connection is forwarded over
         the secure channel, and the application protocol is then used to
         determine where to connect to from the remote machine.  Currently
         the SOCKS4 and SOCKS5 protocols are supported, and ssh will act
         as a SOCKS server.

With -L, SSH makes no attempt to understand the traffic. It just sends everything it receives on the local port to the target port - you determine the target port at the time the connection is made. With -D, SSH acts as a proxy server, and therefore can handle connections from multiple ports (for example, a browser configured to use it as a SOCKS proxy can then access HTTP, HTTPS, FTP, etc. over the same connection). And like with other proxy servers, it will use the traffic to determine the destination.

  • Thanks, muru! I wonder why is dynamic forwarding is called a proxy, while local forwarding isn't? By definition, is the ssh server, ssh client or both in local forwarding a proxy (server)? unix.stackexchange.com/a/234184/674 – Tim Oct 7 '15 at 16:53
  • 1
    @Tim a proxy server understands what the protocol that it is proxying. With port forwarding, SSH makes no attempt to understand what protocol is coming its way, but with -D, it has to, in order to understand where to send the data. – muru Oct 7 '15 at 16:58
  • Thanks. I searched in some textbooks of computer networks (e.g. Tanenbaum's) for definition for a proxy (server) as clear as yours, but wasn't satisfied. Do you have some books to recommend for learning concepts? – Tim Oct 7 '15 at 17:01
  • In dynamic port forwarding, which is the proxy server, the ssh client, ssh server or both? – Tim Oct 7 '15 at 17:03
  • @Tim Tanenbaum's was the only book I studied from. The rest comes from using things. – muru Oct 7 '15 at 17:03

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.