SSH Tunnel Builder
Assemble an ssh -L, -R or -D tunnel with the right ports, identity file and keepalive options, then copy the command.
SSH Tunnel Builder
Command
Nothing is connected here — the page only writes the command. Run it yourself in a terminal.
Learn
History for this tool
The most recent data you entered in this tool, stored only in this browser.
Save what you type here, in this browser? Your work would go into this browser's local storage, so a refresh or a trip to another tool does not wipe it. You also get a short list of previous entries under the form, each one restorable with a click. Nothing is ever uploaded, and there is no account.
Being straight about the trade-off: anything kept there can be read by anyone who can use this browser profile, and by any script that later runs on this site. A tool page can hold a private key, a password or a signed token. Saving is convenient; it is not private.
About this tool
Write an ssh tunnel without memorising the -L, -R and -D shapes. Pick the direction, fill in the ports, and the page assembles the command with the keepalive and failure options most people forget. The bind address is optional, and -D hides the destination fields because a SOCKS proxy has none.Questions
- What is the difference between -L, -R and -D?
- A local forward (-L) makes a service on the far side reachable from a port on this machine. A remote forward (-R) does the opposite: it publishes a service on this machine to the far side. A dynamic forward (-D) opens a SOCKS proxy you can point a browser at.
- Why are -f and -N on by default?
- Together they put the tunnel in the background and run no remote command, which is what you usually want for a tunnel that only forwards ports. Turn them off if you also want a shell on the host.
- Does this connect for me?
- No. The page writes text only. You may enter an identity file path, but it does not read the private key or request a password. Running the copied command in your terminal performs the real connection.