Home / ssh-l-vs-r-vs-d

SSH -L vs -R vs -D: Which Port Forward for Localhost APIs?

Most “API on the VPS but I develop on my Mac” bugs come from picking the wrong forward direction. Use this page as a decision card.

Quick decision

• -L (local): Mac port → VPS 127.0.0.1. You want this for Docker APIs / CDP bound only on the server loopback.
• -R (remote): VPS port → Mac 127.0.0.1. Use when a server process must call a service running on your laptop.
• -D (dynamic): SOCKS proxy on your Mac. Browsing/proxy use-cases, not a fixed API port map.

Local forward example

ssh -N -L 3000:127.0.0.1:3000 user@vps

Then open http://127.0.0.1:3000 on the Mac.

Remote forward example

ssh -N -R 9000:127.0.0.1:9000 user@vps

A process on the VPS talks to 127.0.0.1:9000, which lands on your Mac.

Security note

Prefer loopback binds on the VPS. Publishing 0.0.0.0:3000 “to skip the tunnel” is how CDP and admin APIs get scanned.