In Putty, there are three tunneling options:

enter image description here

Can someone explain what is the difference between them?

5 Answers 5


From the puTTY documentation, specifically, 4.23 The Tunnels Panel section:

Set one of the ‘Local’ or ‘Remote’ radio buttons, depending on whether you want to forward a local port to a remote destination (‘Local’) or forward a remote port to a local destination (‘Remote’). Alternatively, select ‘Dynamic’ if you want PuTTY to provide a local SOCKS 4/4A/5 proxy on a local port (note that this proxy only supports TCP connections; the SSH protocol does not support forwarding UDP).

  • Local -- Forward local port to remote host.
  • Remote -- Forward remote port to local host.
  • Dynamic -- Act as a SOCKS proxy. This requires special support from the software that connects to it, however the destination address is obtained dynamically at runtime rather than being fixed in advance.
  • What is the benefit of using SOCKS5? May 23, 2011 at 17:29
  • @LanceBaynes: Benefits? As when compared to what? I'm not sure I understand what you're asking.
    – jscott
    May 23, 2011 at 18:13
  • sry, against the Local/Remote May 23, 2011 at 18:19
  • @lanceBaynes: The configuration of the resources you are accessing will determine which of the three options you need to use. This isn't a case of one option being "better" than the others.
    – jscott
    May 23, 2011 at 18:29
  • 7
    I'd definitely give this an upvote if this answer gave me a better clue of what Dynamic means. "SOCKS 4/4A/5 proxy" doesn't mean anything to me. Although I'm sure I could Google it. Does "Dynamic" perhaps forward in both directions?? Oct 28, 2015 at 1:11

The answer from jscott is correct, however after reading it, it was still not completely clear to me when should I use local and when remote. So I researched further, and I have found the answer here:

Use local if you have a service running on a machine that can be reached from the remote machine, and you want to access it directly from the local machine. After setting up the tunneling you will be able to access the service using your local host IP (

Use remote if you have a service that can be reached from the local machine, and you need to make it available to the remote machine. It opens the listening socket on the machine you have used SSH to log into.

Dynamic is like local, but on the client side it behaves like a SOCKS proxy. Use it if you need to connect with a software that expects SOCKS forwarding.

  • 3
    Specifically, remote opens the listening socket on the machine you have used SSH to log into. May 24, 2013 at 10:46
  • @FalconMomot Exactly. I have added your remark to the answer to make it clearer.
    – lbalazscs
    May 24, 2013 at 14:59
  • A decade later and this is still the clearest description of how this works that I can find anywhere. Thank you!
    – TheRotag
    Apr 17 at 20:24

I have drawn some sketches

The machine, where the ssh tunnel command is typed (or in your case: Putty with tunneling is started) is called »your host«.

ssh tunnel starting from local

ssh tunnel starting from remote

static (options -L local and -R remote)

  1. local: -L Specifies that the given port on the local (client) host is to be forwarded to the given host and port on the remote side.

ssh -L sourcePort:forwardToHost:onPort connectToHost means: connect with ssh to connectToHost, and forward all connection attempts to the local sourcePort to port onPort on the machine called forwardToHost, which can be reached from the connectToHost machine.

  1. remote: -R Specifies that the given port on the remote (server) host is to be forwarded to the given host and port on the local side.

ssh -R sourcePort:forwardToHost:onPort connectToHost means: connect with ssh to connectToHost, and forward all connection attempts to the remote sourcePort to port onPort on the machine called forwardToHost, which can be reached from your local machine.

dynamic (option -D)

-D is like -L (local) but instead of fowarding to one and only one specific remotehost and port, SSH acts as a SOCKS proxy to the remotehost. Your program using the tunnel needs to support socks proxies. Or you need to help it with some tricks (see examples below).

What does a Socks proxy do? It accepts all your requests and forwards it dynamically to the remote hosts and ports, that the original program wanted it to (see examples below).

Usage examples of -D (dynamic / socks)

If you want to tunnel your browser traffic (with Firefox for example), you do not only want to access ONE website (remotehost and port), but surf freely in the www. So you need a dynamic tunnel, a socks proxy.

On your computer (your host) you do:

ssh -D 5000 remotehost   # or the equivalent option "dynamic" with putty

Firefox traffic tunnelled

For this you can edit your Firefox configuration, so that your browser uses your socks proxy. Type in the Firefox address bar:


Now edit the following values:

network.proxy.socks             string localhost
network.proxy.socks_port        integer 5000
network.proxy.socks_remote_dns  boolean true
network.proxy.type              integer 1   (0 ist default)
media.peerconnection.enabled    boolean false (true ist default)

You can now surf in the internet without anybody at the strange place knowing what you do.

more general: use tsocks application with a file /etc/tsocks.conf

Contents of the config file:

local =   # no proxy for local network
server = localhost    # proxy-server (your host)
server_type = 5       # socks5
server_port = 5000

You can now start program with tsocks in front of it, so that it uses the socks proxy.

tsocks thunderbird
tsocks mplayer -playlist http://bassdrive.com/bassdrive.m3u


Easy to use with curl:

ALL_PROXY="socks5h://localhost:5000" curl http://blabbla.abc

or just

curl --proxy socks5h://localhost:5000 http://blabbla.abc

combine ALL_PROXY and tsocks

wget needs tsocks, because wget doesn’t support proxies. If you do both, you are safe (mostly): The script will use tsocks or ALL_PROXY variable:

ALL_PROXY="socks5h://localhost:5000" tsocks script

for youtube-dl

youtube-dl --proxy socks5:// http://blaaaa.bla

To set it up with Putty (local forward example)

Start Putty and enter your usual connection settings (Hostname or IP address) In the tree on the left side, navigate to

Connection → SSH → Tunnels

and create a new local tunnel with the source port 123 and the destination localhost:456.

Do not forget to click on Add.

Then navigate back to session and click Save to keep your settings for the next time. Now you can use the saved connection to log in to your server and after you successfully log in, every time you connect to port 123 on your host you will actually connect to port 456 on the server.

create forward tunnel with putty

  • 3
    I generally hate new answers to old established posts but this is absolutely excellent. Feb 12, 2021 at 18:29

Local / Remote chooses whether you're connecting to a local port or a remote port (your own pc or another pc)

Dynamic is for a SOCKS proxy

See 4.19.2 Port forwarding http://the.earth.li/~sgtatham/putty/0.54/htmldoc/Chapter4.html


a local server is, well, local

typically it means a local server is connected on your LAN (local area network) and a remote server is not on you lan but connected over your WAN (wide area network) remote could be next door or the next continent or it could be in the same room, simply on separate network.

  • Welcome to ServerFault. Unfortunately your answer does not contribute or add to the discussion, especially for a question which was answered last year. Check out any open questions and see if you can help there instead. Oct 17, 2012 at 21:22
  • This isn't really relevant in context. You wouldn't set this according to the location of the server on the network, but rather whether you want to access the tunnel from the local machine (on which putty is running) or the remote machine (on which sshd is running). May 24, 2013 at 10:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .