Most "I need a VPN" conversations end with the same answer: you already have one. If you can SSH to the box, you have an encrypted pipe to it — you just need to push a port through. Three flags cover nearly everything I do.

Forward a port to yourself with -L

The dashboard on the server listens on localhost, or the database port is firewalled. Bring it to your laptop:

ssh -N -L 8080:127.0.0.1:8080 deploy@vps

Now http://localhost:8080 is the remote service, encrypted end to end, and nothing new is exposed to the internet. -N just means "no shell, tunnel only".

Same trick when the service sits on a third machine that only the server can see:

ssh -N -L 8443:192.168.1.10:443 deploy@vps

Punch the reverse way with -R

Your home box is behind NAT and you want to reach it from the VPS. The home box can reach the VPS, so it opens the tunnel backwards:

# from home
ssh -N -R 2222:127.0.0.1:22 user@vps

Then ssh -p 2222 me@127.0.0.1 from the VPS lands at home. Keep it alive with ServerAliveInterval 30, and remember: this is a door into your network, so make sure the VPS side only listens on loopback (GatewayPorts no).

Jump through a bastion with -J

Target behind a jump host? Chain it in one command:

ssh -N -L 8080:internal-db:5432 -J bastion.example.com user@target

The bastion only ever sees an SSH session, and your laptop talks straight to the database.

A poor man's VPN for the coffee shop with -D

ssh -N -D 1080 user@vps

Point your browser at SOCKS5 localhost:1080 and your traffic is encrypted until it reaches the VPS. Handy on networks you do not trust; not a privacy product, just a tunnel.

Make the tunnel survive

# ~/.ssh/config
Host vps
    HostName 203.0.113.10
    User deploy
    ServerAliveInterval 30
    ServerAliveCountMax 3
    ExitOnForwardFailure yes

Run it with autossh -M 0 -N -L 8080:127.0.0.1:8080 vps or a systemd unit with Restart=always. Manual ssh -f dies the first time the Wi-Fi blinks.

For one box, one port, one admin, a VPN product is just another thing to maintain. SSH tunnels are already there. Start with -L, keep -R and -J for the awkward network cases, and you will stop reaching for VPN software entirely.