An SSH tunnel is an encrypted path that carries other network traffic inside an SSH session. In practice, it is a form of port forwarding: one port on a local or remote system is mapped through the secure SSH connection to a destination service, such as a database, admin panel, or internal web app. Common modes include local forwarding, remote forwarding, and dynamic forwarding, which let traffic be redirected in different directions or to multiple destinations.
SSH tunnels matter because they reduce exposure by avoiding direct publication of internal services. They are widely used for administration, testing, and temporary access. Defenders should still treat them as a privilege boundary: a tunnel can create a hidden route that bypasses normal network paths, making logging, review, and access control more important. In attacks, SSH tunneling may be used to pivot into internal networks or to move traffic through an approved SSH session. Good practice is to allow tunnels only when needed, tie them to approved users and purposes, and monitor them like any other sensitive access path.