I am experimenting a bit with ssh port forwarding and I stumbled upon a confusing thing. It seems to me that the following commands are doing the same thing:

ssh -NfL vm2.local
ssh -NfL vm2.local
ssh -NfL localhost

Connecting to pots 2222, 2223 and 2224 from pc brings me all to vm2.local.

$ ss -antp # on vm1.local (
State      Recv-Q Send-Q        Local Address:Port          Peer Address:Port 
LISTEN     0      128                     *:*      users:(("ssh",10170,4))
LISTEN     0      128                     *:*      users:(("ssh",10178,4))
LISTEN     0      128                     *:*      users:(("ssh",10225,4))
LISTEN     0      128                       *:22                       *:*      users:(("sshd",836,3))

What is the difference between the above commands? Is the tunnel created somewhat different? The first command is correct according to man pages, the second is from some website and the last is error I made that turned out working too.

  • Are vm2.local and localhost the same machine?
    – cutrightjm
    Dec 5, 2015 at 3:30
  • Have you tried directly using the IP address instead of the hostname? @ekaj may be right.
    – Aloha
    Dec 5, 2015 at 6:54
  • vm2.local and localhost being the same, those are indeed, the same exact command, you'll connect local port 2222 to 2224 to 22 on localhost.
    – Archemar
    Dec 5, 2015 at 8:46
  • see my more complete answer on port forwarding : unix.stackexchange.com/questions/237904/…
    – Archemar
    Dec 5, 2015 at 8:47
  • @ekaj The vm1.local and vm2.local are virtual machines on the network. HOST:, vm1.local:, vm2.local Dec 5, 2015 at 10:52

1 Answer 1


There IS difference, even though it does not matter in your case. I am not good in drawing, so I will try to describe it with words:

  1. ssh -NfL vm2.local

    This makes encrypted connection between your host and vm2.local and the port is forwarded through this secure channel, because every end (local and remote) binds its local IP address.

  2. ssh -NfL vm2.local

    This is the same like above, but you don't bind address of public network interface, but the local one ( For ssh port, there is no difference (it listens on both of them), but it matters for services listening only on localhost (for example mysql).

  3. ssh -NfL localhost

    This one is connecting to your local host securely (basically no security effect) and then binds remote host directly, so everything you write to the port 2224 is send directly between the machines unencrypted (no problem here for SSH connections, but it would matter for different type of traffic).


You should learn to use the second case, but when the forwarded port is not needed to be accessible from outside, you should always bind localhost on local side, like this:

ssh -NfL localhost:2223:localhost:22 vm2.local

where the localhost is default, so you can boil it down to

ssh -NfL 2223:localhost:22 vm2.local
  • So if I get it right it means ssh -NfL <to_what_addres_to_bind_on_local_machine>:<local_machine_port>:<to_what_addres_to_bind_on_remote_machine>:<remote_machine_port> <remote_machine>. Dec 5, 2015 at 11:00
  • exactly. This is also in manual page, but in more complicated way.
    – Jakuje
    Dec 5, 2015 at 11:01
  • Now whole universe makes sense again! :) Thank you :) Dec 5, 2015 at 11:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .