Port Forwarding

SSH Bridge supports three types of SSH port forwarding (tunneling): local forwarding, remote forwarding, and dynamic SOCKS forwarding. The Host field is the SSH server used to carry the tunnel. The other fields describe which side listens and where traffic is sent.

Local Forwarding

Local forwarding opens a port on your computer and sends traffic through the selected SSH host to a service reachable from that host.

Type:        Local Forward
Host:        N8N (203.0.113.10)
Local Port:  9005
Remote Host: 127.0.0.1
Remote Port: 9000

This means:

your computer localhost:9005 → N8N server 127.0.0.1:9000

The value 127.0.0.1 in Remote Host means localhost from the N8N server's point of view, not your computer.

Equivalent SSH command:

ssh -L 9005:127.0.0.1:9000 [email protected]

How to test after starting the rule:

1. Make sure the service is running on the N8N server at 127.0.0.1:9000.
2. On your computer, open http://localhost:9005 or run curl http://127.0.0.1:9005.
3. If the tunnel is active, you should see the service from N8N:9000.

Remote Forwarding

Remote forwarding works in the opposite direction. It opens a listening port on the SSH host and forwards incoming traffic back to a service on your computer.

Type:         Remote Forward
Host:         N8N (203.0.113.10)
Local Port:   5172
Remote Port:  9010
Bind Address: 172.20.0.1

This means:

N8N server 172.20.0.1:9010 → your computer localhost:5172

Equivalent SSH command:

ssh -R 172.20.0.1:9010:127.0.0.1:5172 [email protected]

Use this when you want a service running on your computer, such as a local Next.js app on port 5172, to be reachable from the remote server side.

Remote Forwarding with Docker and Nginx Proxy Manager

If Nginx Proxy Manager (NPM) runs inside Docker, 127.0.0.1 inside NPM means the NPM container itself. It does not mean the N8N host machine. For NPM to reach a remote forward listener on the host, bind the remote forward to the Docker network gateway IP.

Find the Docker network used by NPM:

docker ps --format 'table {{.Names}}	{{.Networks}}'

Then inspect that network. For example:

docker network inspect nginx-proxy-manager_default | grep -E 'Subnet|Gateway'

Example result:

Subnet:  172.20.0.0/16
Gateway: 172.20.0.1

Use the gateway as the SSH Bridge Bind Address and as the NPM upstream host:

• SSH Bridge Bind Address: 172.20.0.1
• SSH Bridge Remote Port: 9010
• NPM Forward Hostname / IP: 172.20.0.1
• NPM Forward Port: 9010

Domain Names:          rf.example.com
Scheme:                http
Forward Hostname / IP: 172.20.0.1
Forward Port:          9010
Access List:           Publicly Accessible

In this setup, NPM receives public traffic for rf.example.com, forwards it to 172.20.0.1:9010 on the Docker host, and the SSH remote forward sends that traffic back to your computer's local service on localhost:5172.

If UFW is enabled, allow the Docker network to connect to the remote-forward port:

sudo ufw allow from 172.20.0.0/16 to any port 9010 proto tcp
sudo ufw reload

Verify the listener on the N8N server:

ss -tlnp | grep 9010

Correct output should show the Docker gateway address:

LISTEN ... 172.20.0.1:9010 ... sshd

If it shows 127.0.0.1:9010, Docker/NPM cannot reach it by using the gateway IP. If it shows another gateway such as 172.17.0.1:9010, make NPM, UFW, and SSH Bridge use the same Docker network gateway.

Dynamic (SOCKS Proxy)

Dynamic forwarding creates a local SOCKS5 proxy on your computer. Applications that use this proxy send their traffic through the selected SSH host. The destination website or service sees the connection coming from the SSH host side.

Type:       Dynamic (SOCKS)
Host:       N8N (203.0.113.10)
SOCKS Port: 9020

This means:

your computer 127.0.0.1:9020 SOCKS proxy → N8N server → destination website or service

For example, this command opens https://example.com through the SOCKS proxy:

curl -x socks5h://127.0.0.1:9020 https://example.com

The traffic path is:

curl on your computer → 127.0.0.1:9020 → SSH tunnel through N8N → https://example.com

The 127.0.0.1:9020 address is only the local SOCKS proxy on your computer. The final website is still https://example.com, but it is reached from the N8N server side.

Use socks5h instead of socks5 when you want DNS lookups to happen through the tunnel too.

How to test after starting the rule:

1. Confirm SSH Bridge is listening locally: lsof -nP -iTCP:9020 -sTCP:LISTEN
2. Check the exit IP: curl -x socks5h://127.0.0.1:9020 https://ifconfig.me
3. The returned IP should be the N8N server public IP, not your computer's public IP.

You can also configure a browser to use SOCKS5 host 127.0.0.1 and port 9020. Then browsing traffic goes through the SSH host.

Creating a Rule

1. Go to Port Forwarding in the sidebar
2. Click Add Rule
3. Select the type (Local, Remote, or Dynamic)
4. Choose the SSH host to tunnel through
5. Configure the ports and addresses
6. Click Create

Starting and Stopping

Click the play/stop button next to any rule, or double-click to toggle. Active tunnels show a green status dot.