SSH port forwarding and tunnels: Wardterm documentation

The three kinds

Local: a port on your device leads to a place the server can reach. Example: the database of a server, at localhost:5432 on your Mac.
```
ssh -L 127.0.0.1:5432:localhost:5432 deploy@db.example.com
```
Remote: a port on the server leads to your device. Example: show a site running on your Mac at port 3000 to the server, on its port 8080.
```
ssh -R 8080:localhost:3000 deploy@203.0.113.10
```
Dynamic (SOCKS): a SOCKS proxy on your device that sends traffic out from the server. Set your browser to use it.
```
ssh -D 1080 deploy@203.0.113.10
```

On Mac, open Tunnels and choose New tunnel. On iPhone and iPad, choose + in the Connections tab, then Start a tunnel, then +.
The guide asks three things: what the tunnel does, through which server, and which ports. Choose Skip, fill in the form if you know the values.
In the form, Direction is the kind of tunnel, Listen on is the address and port that receive the traffic, and Destination is where it goes. Keep 127.0.0.1 in Listen on: with another address, the form warns that other devices on your network can use the tunnel.
Turn on Open it now to start it at once, and choose Create. In the form, choose Save.

Tunnels in an ssh config file come in with the import.

Choose Start or Stop on a tunnel. Its status is Open, Opening, Failed or Closed.
The menu of a tunnel has Start or Stop, Edit, Duplicate and Delete.
On iPhone and iPad, a tunnel stays open while the app is open, and in the background while a session is open: see Keep sessions alive.

Port 5432 on 127.0.0.1 is already in use: another program uses that port on your device. Choose another port, or find the program:
```
lsof -nP -iTCP:5432 -sTCP:LISTEN
```
Not allowed to listen on port 80 on 127.0.0.1: choose a port above 1024.
The server refused to listen on 0.0.0.0:8080: the port is in use on the server, or the server does not allow forwarding. On the server, in /etc/ssh/sshd_config:
```
AllowTcpForwarding yes
GatewayPorts clientspecified
```
GatewayPorts is needed only for a remote tunnel that other machines reach.
The server could not connect to the destination: check the destination address and port from the server.