Local forwarding (-L), remote forwarding (-R), and SOCKS5 proxy (-D) for IPv4 addresses and domain names. Up to 10 local + 5 remote tunnels per profile (Free includes 1 local tunnel; Pro unlocks remote & SOCKS5).
-L) or Remote (-R) tunnel or set a SOCKS5 port (-D), and the tunnels open with the SSH connection, close with it, and come back after an automatic reconnection.
Local forwarding brings a remote port to your Mac, remote forwarding publishes a port of your Mac on the server, and the SOCKS5 proxy sends any app that speaks SOCKS through the server; when the app passes a host name, the server resolves it. The free version includes 1 local tunnel. Pro adds remote tunnels and the SOCKS5 proxy, and allows up to 10 local tunnels, 5 remote tunnels and a single SOCKS5 port per profile on the Mac. On iPhone and iPad, local and remote tunnels work too (remote ones with Pro, with no per-profile cap), but there is no SOCKS5 proxy.
The SSH tunnel guide sets up a first forward, the SOCKS5 guide covers the browser side, and a tunnel is also the safe way to reach RDP or VNC behind a firewall.Local forwarding (-L): reach a remote service as if it ran on your Mac
Remote forwarding (-R, Pro): publish a port of your Mac on the server
SOCKS5 proxy (-D, Pro, Mac only) for IPv4 addresses and host names, which the server resolves
Tunnels open and close with the SSH connection, and come back after an automatic reconnection
Add a local tunnel to your bastion's profile, 5432 → mydb.internal:5432, then connect TablePlus, DBeaver or psql to localhost:5432. The database never listens on a public address, and your SSH login is what lets you in.
A remote tunnel (Pro) publishes your Vite dev server, port 5173, on port 8080 of the server. OpenSSH binds it to the server's loopback unless GatewayPorts is set to yes or clientspecified in sshd_config, so either enable that or let the server's reverse proxy forward to it.
On hotel Wi-Fi, give your home server's profile a SOCKS5 port (Pro, on the Mac), say 1080, and point Firefox at localhost:1080 with its option to proxy DNS through SOCKS v5. Pages and DNS lookups leave from your home connection, encrypted up to there.
-L). Remote tunnels (-R) and the SOCKS5 proxy (-D) need Pro, a single purchase of $12.99 for the Mac, iPhone and iPad. With Pro, a profile on the Mac can hold up to 10 local and 5 remote tunnels plus one SOCKS5 port.psql only needs to reconnect to localhost.GPU-accelerated terminal
Embedded remote desktop
Built-in VNC viewer