Access a Remote Server Port from Your Local Machine

A database or internal admin tool on a remote server is often deliberately bound to 127.0.0.1 only, for security — it's not reachable from outside the server at all, by design. SSH port forwarding lets you reach it anyway, without ever opening it up on the network.

The command

ssh -L 5433:127.0.0.1:5432 youruser@your-server.com

Breaking down -L 5433:127.0.0.1:5432:

• 5433 — the port on your own machine that you'll connect to
• 127.0.0.1:5432 — the address, as seen from the remote server, of the service you actually want (here, Postgres on its default port)

While this SSH session stays open, connecting to localhost:5433 on your own laptop transparently tunnels through the SSH connection to 127.0.0.1:5432 on the server — exactly as if the database were running locally.

psql -h 127.0.0.1 -p 5433 -U dbuser -d mydatabase

Why the local port is often different from the remote one

Using 5433 locally instead of 5432 avoids a conflict if you also have a local Postgres instance already running on the default 5432 — you can tunnel to as many remote databases as you want, each mapped to its own free local port, without them colliding.

Keeping the tunnel open in the background

ssh -f -N -L 5433:127.0.0.1:5432 youruser@your-server.com

-N means "don't run a remote command, just forward the port" — useful when you only want the tunnel, not an interactive shell. -f backgrounds the process after connecting. To close it later, find and kill the process:

ps aux | grep "5433:127.0.0.1:5432"
kill <pid>

The same trick works for any internal service

This isn't Postgres-specific — the exact same pattern reaches an internal Redis instance, a MySQL server, an admin dashboard bound to localhost, or any other service that's intentionally not exposed on the public network. Only the two port numbers change.