> ## Content Index
> Fetch the complete content index at: https://www.novea.cc/llms.txt
> Use this file to discover other available public pages before exploring further.

# SSH Tunnels: A Poor Man's VPN
- URL: https://www.novea.cc/ssh-tunnels-the-poor-mans-vpn/
- Published: 2026-09-05T17:44:42.000Z
- Updated: 2026-09-05T17:44:42.000Z
- Description: Local, reverse and jump-host forwarding: one encrypted pipe for every network you cannot reach.
- Author: Ethan Nicolas
- Tags: Linux, Networking

Most "I need a VPN" conversations end with the same answer: you already have one. If you can SSH to the box, you have an encrypted pipe to it — you just need to push a port through. Three flags cover nearly everything I do.

## Forward a port to yourself with -L

The dashboard on the server listens on localhost, or the database port is firewalled. Bring it to your laptop:

```
ssh -N -L 8080:127.0.0.1:8080 deploy@vps
```

Now `http://localhost:8080` is the remote service, encrypted end to end, and nothing new is exposed to the internet. `-N` just means "no shell, tunnel only".

Same trick when the service sits on a third machine that only the server can see:

```
ssh -N -L 8443:192.168.1.10:443 deploy@vps
```

## Punch the reverse way with -R

Your home box is behind NAT and you want to reach it from the VPS. The home box can reach the VPS, so it opens the tunnel backwards:

```
# from home
ssh -N -R 2222:127.0.0.1:22 user@vps
```

Then `ssh -p 2222 me@127.0.0.1` from the VPS lands at home. Keep it alive with `ServerAliveInterval 30`, and remember: this is a door into your network, so make sure the VPS side only listens on loopback (`GatewayPorts no`).

## Jump through a bastion with -J

Target behind a jump host? Chain it in one command:

```
ssh -N -L 8080:internal-db:5432 -J bastion.example.com user@target
```

The bastion only ever sees an SSH session, and your laptop talks straight to the database.

## A poor man's VPN for the coffee shop with -D

```
ssh -N -D 1080 user@vps
```

Point your browser at SOCKS5 `localhost:1080` and your traffic is encrypted until it reaches the VPS. Handy on networks you do not trust; not a privacy product, just a tunnel.

## Make the tunnel survive

```
# ~/.ssh/config
Host vps
    HostName 203.0.113.10
    User deploy
    ServerAliveInterval 30
    ServerAliveCountMax 3
    ExitOnForwardFailure yes
```

Run it with `autossh -M 0 -N -L 8080:127.0.0.1:8080 vps` or a systemd unit with `Restart=always`. Manual `ssh -f` dies the first time the Wi-Fi blinks.

For one box, one port, one admin, a VPN product is just another thing to maintain. SSH tunnels are already there. Start with `-L`, keep `-R` and `-J` for the awkward network cases, and you will stop reaching for VPN software entirely.