SSH Local Tunnels

LocalForwards

Bind a local port on SSH client

When connection to port is received:
Tunnel (encapsulate) connection over the encrypted SSH connection
Destination can be any machine reachable by the SSH server

Applications (on SSH client machine/network) point at the client machine, not the destination