SSH tunneling

Tunnels you save once instead of retyping at 2am

Every forward you have ever set up is a command you typed, lost, and reconstructed from memory a month later. Here they are rows on the host: local, remote and dynamic, toggled without dropping the session, with a live count of what is flowing through each one.

Download Tempest See pricing

Windows, macOS, Linux, Android, iOS & Web.

A Tempest workspace with tunnelled services and sessions side by side

The three forwards

Local, remote, dynamic — as fields, not flags

The same three things ssh does with -L, -R and -D, with the arguments in labelled boxes so the order cannot be wrong.

Local: reach a database or dashboard that only the bastion can see, on a port on your own machine.
Remote: expose something running on your laptop to the remote network, for the webhook that has to call back.
Dynamic: a SOCKS5 proxy on a local port, so a browser or a tool routes through the remote network entirely. Port forwarding guide
Each one is a saved rule on the host with live connection counts, switchable without reconnecting the session.

Getting there

Bastions, proxies, and the networks in between

A tunnel is only as good as the path to the host, and that path is rarely direct.

Jump-host chains saved on the host — as many hops as your network insists on, configured once. Jump host guide
HTTP proxy, SOCKS proxy or a custom ProxyCommand per host, for the corporate egress path.
Forwards run through the whole chain: the rule is anchored to the final host, the bytes come back through every hop.
Connection multiplexing so the second and third session to the same host open instantly. Multiplexing docs

Zero trust

The platforms that replaced the bastion

Teleport, Cloudflare Access, AWS SSM, GCP IAP and Tailscale each have their own front door, and each of them still terminates in an SSH session.

Presets for the common ones, so the ProxyCommand incantation is not yours to maintain. Zero-trust access guide
Short-lived certificates and exec-credential helpers work as they do on the command line.
The tunnel rules sit on top unchanged — the access path is a detail of how the session opens.
Tempest connecting through a zero-trust access platform on desktop and mobile

Everywhere

The same tunnels on the phone

A forward saved on the desktop is a forward on mobile, because the host document is the same document.

Android and iOS run the same saved forwards, so a remote dashboard opens in the phone's browser.
Hosts and rules sync zero-knowledge encrypted between devices. How E2EE works
Mosh keeps the session — and its tunnels — alive across network changes. Mosh guide

Frequently asked questions

What is the difference between local, remote and dynamic forwarding?
Local brings a remote service to a port on your machine. Remote does the opposite, publishing one of your local services on the remote host. Dynamic turns the SSH session into a SOCKS5 proxy so anything that can use a proxy routes through the remote network. Port forwarding guide
Can I turn a tunnel off without disconnecting?
Yes. Forwards are toggled individually from the host's port forwarding view, with counters showing how many connections are open through each.
Do forwards work through a jump host?
Yes. The rule belongs to the final host in the chain, and the traffic returns through every hop transparently.
Is port forwarding a paid feature?
Port forwarding is part of Pro. The free plan covers SSH, Mosh, SFTP, FTP, S3 and WebDAV.
Can I tunnel a database client through this?
That is the most common use: a local forward to the database port, then point DBeaver, psql or TablePlus at localhost. The rule stays saved for next time.

Keep exploring

SSH key management SSH client for Linux SSH client for Mac Free SSH client Kubernetes terminal

Set the tunnel up once. Use it for years.

Download Tempest Read the docs