SSH Remote Tunnels RemoteForwards Bind a local port on SSH server When connection to port is received: Tunnel (encapsulate) connection over the encrypted SSH connection Destination can be any machine reachable by the SSH client Applications (on SSH server machine/network) point at the server machine, not the destination