I'm trying to map local ports in order to redirect traffic to proxy server. I got instruction containing this command:

ssh -A -t -l root -L :8888:

From SSH manual:


Enables forwarding of the authentication agent connection. This can also be specified on a per-host basis in a configuration file.

Agent forwarding should be enabled with caution. Users with the ability to bypass file permissions on the remote host (for the agent’s UNIX-domain socket) can access the local agent through the forwarded connection. An attacker cannot obtain key material from the agent, however they can perform operations on the keys that enable them to authenticate using the identities loaded into the agent.


Force pseudo-terminal allocation


Specifies that connections to the given TCP port or Unix socket on the local (client) host are to be forwarded to the given host and port, or Unix socket, on the remote side.

Despite reading this I don't understand how it really works and what are implications of typing this in terminal. Can someone explain this in simple terms?


I thought I had a graphic illustration on -L :9990: somewhere and I did!

Difference between <code>example.com</code> and <code>localhost</code> on the remote side.

The diagram visualizes a situation, where the -L [ bind_address:]port:host:hostport is used to access resource on remote side. Now, you can connect to port 9990 on your SSH client computer as if you were connecting to example.com:9999 from the SSH server. Destination could be anything. I didn't want to use your 8888 on both sides to avoid confusion; it can be a different port.

A picture is worth a thousand words; half of the 2000 words in How to Use SSH Tunneling

  • 1
    It really does. I used to read that article as well; and it was confusing as hell the first time before I find some graphical illustrations like the one above. – Alex Lo Apr 19 '18 at 11:37

I think SSH.com has a pretty simple and well-written explanation about SSH tunneling / forwarding.

In case of the -t flag, here is another good read; and here is the one for the -A flag.

A picture might explain the situation better (-D = Dynamic Forwarding):

SSH Forwarding Graph

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.