RemoteForwards

RemoteForward Mechanism:
SSH client logs into server.

SSH daemon binds a local port on server.

When connection to remote port is received:
Tunnel (encapsulate) connection over the encrypted SSH connection.
Destination can be any machine reachable by the SSH client.

Applications (on SSH server machine/network) point at the server machine, not the destination.