Port Forwarding

Tunnel types

Local forward

Binds a port on your machine and forwards traffic to a host:port reachable from the SSH server. Use this to access services running on the remote network (databases, internal APIs, admin panels) as if they were local.

# Access a remote Postgres DB on localhost:5432# Equivalent SSH command:ssh -L 5432:localhost:5432 user@server

After creating this tunnel: open psql -h localhost -p 5432 on your machine — the connection goes through the SSH tunnel to the remote server's Postgres.

Remote forward

Binds a port on the SSH server and forwards traffic back to a host:port on your machine. Use this to expose a local dev server to the remote network.

# Expose your local dev server (port 3000) on the remote server at port 8080# Equivalent SSH command:ssh -R 8080:localhost:3000 user@server

Dynamic forward (SOCKS)

Binds a local SOCKS5 proxy and routes each client connection through the SSH session to whatever destination the client requests. Equivalent to ssh -D. Use this when you need a general-purpose proxy through the remote host (browser, curl, IDE HTTP client).

# Local SOCKS5 proxy on port 1080# Equivalent SSH command:ssh -D 1080 user@server# Test with curl:curl --proxy socks5://127.0.0.1:1080 https://example.com -I

In Zync, choose the SOCKS Proxy preset or set type to dynamic. Copy produces a socks5:// URL. IPv4, domain, and IPv6 targets are supported; UDP ASSOCIATE is not.

Creating a tunnel

With a connection open, switch to the Port Forwarding tab and click Add Tunnel. Fill in:

• Name — A label for the tunnel (e.g. "Postgres DB", "Dev Server", "SOCKS").
• Type — Local, Remote, or Dynamic (SOCKS).
• Local port — The port on your machine (listen port for local and dynamic types).
• Remote host — The target host, as resolvable from the SSH server. Use localhost to target the server itself. Not used for dynamic/SOCKS.
• Remote port — The port on the remote host. Not used for dynamic/SOCKS.
• Bind address — Where to listen locally (default 127.0.0.1).

Tunnels are saved with the connection and persist across restarts. Click Start to activate manually, or enable Auto-start tunnel when connection opens in the Add Tunnel dialog to start a tunnel whenever you connect. You can also start and stop from the global tunnel list.

Per-connection view

The Port Forwarding tab inside each connection shows all tunnels for that connection. From here you can:

• Start / stop individual tunnels
• Edit or delete tunnel configs
• Switch between grid and list layout
• See live status (active, stopped, error)
• Open the forwarded URL in your browser (for HTTP local forwards when active)
• Copy address or socks5:// URL

Global tunnel list

Click Port Forwarding in the sidebar to open the global tunnel dashboard — all tunnels across every connection in one view. From here you can:

• See all tunnels across connections with live status indicators (optional user-defined groups)
• Start / stop any tunnel without switching connection tabs
• Search and collapse groups
• Click Open in browser to launch the forwarded URL directly (when active)

Import from SSH command

Have an existing ssh -L, ssh -R, or ssh -D command? Paste it into Zync and it will parse the tunnel flags automatically:

$ssh -L 3306:db.internal:3306 -L 6379:redis.internal:6379 -D 1080 user@bastion.example.com

Zync extracts all -L, -R, and -D flags from the pasted command and creates the corresponding tunnel entries for you.

Reconnect behavior

Tunnels require an active SSH session. When the connection drops — including transport loss (Wi‑Fi change, idle timeout) — runtime forwards stop and tunnel cards update to stopped.

When you reconnect the same host, Zync automatically restarts:

• Tunnels that were active before disconnect, and
• Tunnels with Auto-start tunnel when connection opens enabled.

If a tunnel fails to restart, Zync shows an error toast with the tunnel name.

Common use cases

• Database access — Forward 5432 (Postgres), 3306 (MySQL), 27017 (MongoDB) to localhost. Connect any local DB client as if the DB were running on your machine.
• Internal web UI — Forward a remote port 8080/443 to localhost to access internal dashboards (Grafana, Kibana, Kubernetes dashboard) in your browser.
• Redis / cache — Forward port 6379 to use your local Redis tools (redis-cli, RedisInsight) against a remote instance.
• Dev server preview — Remote forward your local port 3000 to the server so teammates on the server's network can preview your local work.
• SOCKS proxy — Dynamic forward on 1080 to route browser or CLI traffic through a bastion without per-service -L rules.
• Kubernetes API — Forward 6443 to reach a private cluster API server without a VPN.

Troubleshooting

• Port already in use — Another process is already bound to the local port you chose. Zync can suggest the next free port and switch for you; stopping the tunnel reverts to the original port when applicable. You can also pick a different port manually (e.g. 15432 instead of 5432).
• Tunnel starts but connection is refused — The remote host and port may be wrong, or the target service isn't running. Test from the server: curl http://localhost:PORT or nc -zv REMOTE_HOST PORT.
• Tunnel stops when SSH disconnects — Expected: forwards stop with the session. Reconnect the host to restore active tunnels and auto-start tunnels (see Reconnect behavior above).
• Remote forward doesn't work — Some SSH servers disallow remote port binding by default. Ensure GatewayPorts yes is set in /etc/ssh/sshd_config on the server, then restart sshd.
• Can't bind to port below 1024 — Ports 1–1023 are privileged on Linux/macOS. Use a port above 1024 as the local bind port, or run Zync with appropriate permissions.
• SOCKS connection fails — Confirm the tunnel is active, you are using socks5:// (not HTTP proxy), and the bind address matches where the client connects (usually 127.0.0.1).