SSH Port Forwarding from Your iPhone: A Practical Guide

SSH port forwarding (also called SSH tunneling) lets you access remote services through an encrypted SSH connection. It's one of the most useful features of SSH, and now you can do it from your iPhone with ProSSH.

What is port forwarding?

When you set up a local port forward, you're telling SSH: "Listen on a port on my device, and forward any traffic through the SSH connection to a specific host and port on the other side."

Your iPhone (port 5432) → SSH tunnel → Remote server → PostgreSQL (port 5432)

Your iPhone thinks it's connecting to localhost:5432, but the traffic actually goes through the SSH tunnel to the database server. The connection is fully encrypted.

Why you'd use it

Access a database behind a firewall

Your PostgreSQL or MySQL server isn't exposed to the internet (as it shouldn't be). But you need to run a quick query. Set up a tunnel through your SSH jump host and connect your database client to localhost.

Rule: Local port 5432 → Remote host db.internal → Remote port 5432

Reach a web app on a private network

Your staging environment or admin panel is only accessible from within the VPN. Forward port 8080 through SSH and open it in your browser.

Rule: Local port 8080 → Remote host staging.internal → Remote port 80

Secure traffic over untrusted networks

You're at a coffee shop and need to access an HTTP service. Tunnel the traffic through SSH so it's encrypted over the untrusted WiFi.

How to set it up in ProSSH

1. Open the host you want to tunnel through
2. Go to Port Forwarding
3. Tap + to add a new rule
4. Configure the rule:
5. Local Port — the port on your iPhone (e.g., 5432)
6. Remote Host — where traffic should go after the SSH server (e.g., db.internal or localhost if the service runs on the SSH server itself)
7. Remote Port — the port on the remote host (e.g., 5432)
8. Tap Connect

The tunnel stays active as long as the SSH connection is open. You can monitor active sessions and disconnect when done.

Tips

Use localhost as the remote host when the service runs on the SSH server itself. For example, if PostgreSQL is running on the same machine you're SSHing into, the remote host is localhost.

Use an internal hostname when the service is on a different machine. The SSH server will resolve the hostname from its own network, so db.internal works even though your phone can't resolve that name.

Saved rules persist. You don't need to reconfigure tunnels every time. Just tap connect on a saved rule.

Multiple tunnels at once. You can have several port forwarding rules active simultaneously through the same SSH connection.

Common port numbers

Get ProSSH

Port forwarding is available in ProSSH for €14.99 on the App Store. One-time purchase, no subscriptions.