Local forwarding is an SSH port-forwarding mode that maps a port on the client machine to a service reachable through the SSH server. In practice, a user connects to a local port, and SSH carries that traffic securely to a remote or internal destination. This makes a protected service look local to the application without exposing it directly to the network.
In cyber security, local forwarding matters because it can reduce attack surface for administration and testing, but it also creates a controlled path around normal network boundaries. Defenders use it to reach databases, management consoles, or lab systems without opening inbound firewall rules. Attackers may abuse the same feature after compromising an SSH account, using the tunnel to pivot into internal services, scan hidden ports, or access tools that are not publicly reachable. For that reason, local forwarding should be logged, time-limited, and tied to approved access.