Remote forwarding is an SSH port-forwarding mode that makes a service on the client side reachable from the remote SSH server side. In practice, the SSH session opens a listening port on the server and relays incoming connections back through the encrypted tunnel to a local service on the client. This is often used for approved administration, testing, or temporary access to an internal app, database, or management interface.
In cyber security, remote forwarding matters because it changes who can reach a service and from where. Defenders use it to provide controlled access without publishing a service directly to the network, but attackers can also abuse it for pivoting, hidden command-and-control, or data exposure from behind a firewall. That is why remote forwarding should be limited by policy, logged, time-bound, and tied to a clear need. Monitoring SSH options and unusual listening ports helps spot unauthorized tunnels early.