Port Forwarding

Two types of tunnels

Local forward

Binds a port on your machine and forwards traffic to a host:port reachable from the SSH server. Use this to access services running on the remote network (databases, internal APIs, admin panels) as if they were local.

# Access a remote Postgres DB on localhost:5432# Equivalent SSH command:ssh -L 5432:localhost:5432 user@server

After creating this tunnel: open psql -h localhost -p 5432 on your machine — the connection goes through the SSH tunnel to the remote server's Postgres.

Remote forward

Binds a port on the SSH server and forwards traffic back to a host:port on your machine. Use this to expose a local dev server to the remote network.

# Expose your local dev server (port 3000) on the remote server at port 8080# Equivalent SSH command:ssh -R 8080:localhost:3000 user@server

Creating a tunnel

With a connection open, switch to the Port Forwarding tab and click Add Tunnel. Fill in:

• Name — A label for the tunnel (e.g. "Postgres DB", "Dev Server").
• Type — Local or Remote forward.
• Local port — The port on your machine.
• Remote host — The target host, as resolvable from the SSH server. Use localhost to target the server itself.
• Remote port — The port on the remote host.

Tunnels are saved with the connection and persist across restarts. They are not started automatically — click Start to activate, or use the global tunnel list.

Per-connection view

The Port Forwarding tab inside each connection shows all tunnels for that connection. From here you can:

• Start / stop individual tunnels
• Edit or delete tunnel configs
• See live status (connected, stopped, error)
• Open the forwarded URL in your browser (for HTTP tunnels)

Global tunnel list

Click Port Forwarding in the sidebar to open the global tunnel dashboard — all tunnels across every connection in one view. From here you can:

• See all tunnels grouped by connection with live status indicators
• Start / stop any tunnel without switching connection tabs
• Click Open in browser to launch the forwarded URL directly

Starting a tunnel requires the connection to be active (connected). Zync will prompt you to connect first if the connection is closed.

Import from SSH command

Have an existing ssh -L or ssh -R command? Paste it into Zync and it will parse the tunnel flags automatically:

$ssh -L 3306:db.internal:3306 -L 6379:redis.internal:6379 user@bastion.example.com

Zync extracts all -L/-R pairs and creates the corresponding tunnel entries for you. The import dialog also accepts tunnels defined in ~/.ssh/config LocalForward / RemoteForward blocks.

Common use cases

• Database access — Forward 5432 (Postgres), 3306 (MySQL), 27017 (MongoDB) to localhost. Connect any local DB client as if the DB were running on your machine.
• Internal web UI — Forward a remote port 8080/443 to localhost to access internal dashboards (Grafana, Kibana, Kubernetes dashboard) in your browser.
• Redis / cache — Forward port 6379 to use your local Redis tools (redis-cli, RedisInsight) against a remote instance.
• Dev server preview — Remote forward your local port 3000 to the server so teammates on the server's network can preview your local work.
• Kubernetes API — Forward 6443 to reach a private cluster API server without a VPN.

Troubleshooting

• Port already in use — Another process is already bound to the local port you chose. Pick a different local port (e.g. 15432 instead of 5432) or stop the conflicting process first.
• Tunnel starts but connection is refused — The remote host and port may be wrong, or the target service isn't running. Test from the server: curl http://localhost:PORT or nc -zv REMOTE_HOST PORT.
• Tunnel stops when SSH disconnects — Tunnels require an active SSH connection. If the connection drops, restart the connection then restart the tunnel from the global list.
• Remote forward doesn't work — Some SSH servers disallow remote port binding by default. Ensure GatewayPorts yes is set in /etc/ssh/sshd_config on the server, then restart sshd.
• Can't bind to port below 1024 — Ports 1–1023 are privileged on Linux/macOS. Use a port above 1024 as the local bind port, or run Zync with appropriate permissions.