A reverse tunnel is an outbound connection created by a device inside a network so that traffic from an external operator can be carried back through that connection. Unlike a traditional inbound remote-access session, the compromised host initiates the link itself, which often helps it pass firewalls and NAT devices that block unsolicited connections.
In cyber security, reverse tunnels matter because they turn an endpoint into a relay or pivot point. Attackers use them for command-and-control, remote shell access, port forwarding, and reaching internal services that are not directly exposed to the internet. Defenders look for long-lived outbound sessions, unusual destination hosts, encrypted tunnels from user workstations, and command-line tools or scripts that establish proxying behavior. A reverse tunnel is not always malicious, but in an incident it often signals that a system is being used to hide operator traffic and extend access deeper into the environment.