Port Forwarding

Zync manages SSH port forwards from the Port Forwarding tab and the global tunnel dashboard. It supports local forwards (ssh -L), remote forwards (ssh -R), and dynamic SOCKS proxies (ssh -D). Each tunnel uses the active SSH session for its connection.

Public URLs are different

Zync Public URLs are a separate HTTPS and WSS sharing feature. They are not SSH -L, -R, or -D tunnels. Use the Public URLs guide for public HTTPS sharing.

An SSH connection is required

Local, remote, and SOCKS forwards use an SSH transport. Save the tunnel configuration at any time, but connect its host before starting the listener.

Common uses

Goal	Tunnel type	Example
Reach a private database or internal UI	Local	PostgreSQL, MySQL, Redis, Kubernetes dashboards, or an internal web service
Make a local development service available from the SSH server	Remote	Preview a local app from a remote test environment
Send application traffic through the SSH server	Dynamic	Browser or command-line tools configured for a SOCKS5 proxy

Choose a tunnel type

Local forward

A local forward listens on your machine and sends traffic through SSH to a host and port reachable from the SSH server. This is the usual choice for reaching a private database or internal web service.

# Reach PostgreSQL on the SSH server through local port 5432
ssh -L 5432:localhost:5432 user@server

In Zync, set Type to Local, choose a local port, and enter the remote target host and port. A client such as psql -h 127.0.0.1 -p 5432 then connects through the tunnel.

Remote forward

A remote forward asks the SSH server to listen on a port and sends incoming traffic back to a host and port on your machine. Use it to expose a local development service to the remote network.

# Make local port 3000 reachable from the server at port 8080
ssh -R 8080:localhost:3000 user@server

In Zync, set Type to Remote, enter the remote listen port, and provide the local target host and port. The SSH server may require AllowTcpForwarding and, for non-loopback remote binds, GatewayPorts in sshd_config.

Dynamic forward (SOCKS)

A dynamic forward listens locally as a SOCKS5 proxy. Each client connection chooses its destination, which Zync opens through SSH.

# Start a local SOCKS5 proxy
ssh -D 1080 user@server

# Test it with curl
curl --proxy socks5://127.0.0.1:1080 https://example.com -I

Choose the SOCKS Proxy preset or Dynamic type in Zync. IPv4, domain, and IPv6 CONNECT targets are supported. UDP ASSOCIATE, BIND, and username/password authentication are not supported.

Bind address

The default bind address is 127.0.0.1. Binding a local forward or SOCKS proxy to 0.0.0.0 makes it reachable from your LAN. Choose a wider bind address only when you intentionally want that exposure.

Create a tunnel

1. Connect to the SSH host.
2. Open Port Forwarding in the connection tab, or open the global dashboard from the sidebar.
3. Select Add Tunnel.
4. Choose Local, Remote, or Dynamic, then enter the ports and target hosts required by that type.
5. Set the bind address and an optional group. Enable Auto-start tunnel when connection opens when the tunnel should start automatically.
6. Save the configuration and select Start.

Tunnel configuration is saved per connection. The global dashboard groups tunnels by SSH host and lets you search, start, stop, edit, or delete them without switching tabs. Active HTTP-style local forwards can be opened in a browser, and any active tunnel can expose a copyable address when its type supports one.

The per-connection view focuses on one host and can live beside its shell in a split. The global dashboard is better when you need to compare or control tunnels across several saved hosts.

Import an SSH command

Open the import action and paste a command containing one or more -L, -R, or -D flags. Zync creates tunnel entries for each parsed flag.

ssh -L 3306:db.internal:3306 -L 6379:redis.internal:6379 -D 1080 user@bastion.example.com

Review the imported bind addresses, names, and target hosts before starting them. Forward declarations in ~/.ssh/config are not imported by the current workflow.

Reconnect behavior

Tunnels are session-bound. When SSH disconnects or transport is lost, runtime listeners stop and the tunnel status changes to Stopped. The saved configurations remain in place.

After a successful reconnect, Zync restarts tunnels that were active before the disconnect and tunnels with auto-start enabled. A failed restart produces an error toast for that tunnel. A tunnel you intentionally stopped before disconnect remains stopped unless auto-start is enabled.

Port conflicts and server errors

If a local bind port is already in use, Zync reports the conflict and can suggest the next free port. Accept the suggested port or choose one manually. For a remote forward, the SSH server can reject a requested listen port or address; check its forwarding policy and port availability.

For a refused target, test reachability from the correct side of the tunnel. A local forward target is resolved from the SSH server, while a remote forward target is resolved from your machine. For SOCKS, verify that the client is using a SOCKS5 proxy URL and that the tunnel is active.

Sync and restore

Tunnels are part of the Vault and Sync tunnels domain. Sync stores tunnel configurations, not live status. When hosts and tunnels are restored together, Zync links a tunnel to its restored host identity. Orphan tunnel records are skipped when their host is not part of the restore set.

Related docs

• Split panes for opening Port Forwarding beside a shell.