Port forwarding is the practice of redirecting traffic that arrives at one port to another port or destination. In SSH, it lets a client, server, or gateway relay network connections through an encrypted session instead of exposing the target service directly.
This matters in security because forwarding can support safe administration, temporary access, and segmented network design, but it can also create hidden paths if it is not approved and monitored. Attackers may abuse forwarded ports to reach internal services, bypass perimeter controls, or keep access to a foothold without opening a public service. Defenders should track who can create forwards, which ports are used, where traffic ends up, and whether the tunnel is time-limited and logged.