How to Create an SSH Tunnel on Windows, Linux and macOS

SSH tunnels let you send traffic through an encrypted SSH connection instead of exposing a service directly to the network. They are useful when you need to reach a database, internal dashboard, remote desktop service, development server, or SOCKS proxy through a trusted SSH host.

This guide compares practical SSH tunneling options across Windows, Linux, and macOS. It includes command-line tools, free desktop clients, commercial terminal tools, and SmartTerminal. The goal is unbiased: choose the smallest tool that solves your workflow, then move to a broader workspace only when repeated server work makes that worthwhile.

What an SSH tunnel actually does

An SSH tunnel forwards traffic through an SSH session. You still authenticate to an SSH server, but instead of only getting a shell, your client also opens one or more forwarded ports. Applications connect to those ports as if they were local, and SSH carries the traffic across the encrypted session.

There are three common forms: local forwarding, remote forwarding, and dynamic forwarding. Local forwarding is the usual choice for reaching a private database or dashboard. Remote forwarding is useful when a remote environment needs to reach something on your side. Dynamic forwarding creates a SOCKS proxy for flexible per-application routing.

Command-line examples

A simple local tunnel to a PostgreSQL service can look like this:

ssh -L 15432:127.0.0.1:5432 user@example.com

This listens on your machine at 127.0.0.1:15432. Traffic sent there travels through example.com and reaches 127.0.0.1:5432 from the server side.

A dynamic SOCKS tunnel is shorter:

ssh -D 1080 user@example.com

After that, configure your browser or tool to use SOCKS5 at 127.0.0.1:1080. This is useful for testing internal web services through a jump host.

For a remote tunnel, the pattern is:

ssh -R 18080:127.0.0.1:8080 user@example.com

That can expose a local development server to the remote side, assuming the SSH server allows remote forwarding.

OpenSSH

OpenSSH is the baseline SSH implementation for many Linux and macOS systems, and it is also available on Windows through Microsoft-supported OpenSSH components. It is free, scriptable, easy to automate, and ideal when you are comfortable with terminal commands or SSH config files. Its weakness is discoverability: it will not show a visual list of active tunnels unless you build that workflow around it.

PuTTY

PuTTY is a long-standing free SSH client, especially familiar to Windows administrators. It can save sessions and configure local, remote, and dynamic SSH forwarding from a GUI. PuTTY is a good fit for simple Windows tunnel setups, but its interface feels older than modern connection managers and it does not try to be a full operations workspace.

MobaXterm

MobaXterm is a Windows-focused remote computing toolbox with SSH, SFTP browser, X server features, remote protocols, macros, plugins, and tunnel management. Its free Home Edition is useful for many individual workflows, while the Professional Edition removes limits and adds business-oriented options. It is strong when you want one Windows app for several remote access tasks, but it is not a native Linux/macOS desktop workflow.

mRemoteNG

mRemoteNG is a free and open-source tabbed remote connection manager for Windows. It supports multiple connection types, including SSH, RDP, VNC, and web protocols, which makes it useful if SSH is only one part of your remote access work. It is more about organizing connections than providing a deep terminal, SFTP, AI, or tunnel-specific experience.

Termius

Termius is a polished SSH client built around saved hosts, sync, snippets, SFTP, port forwarding, and team features depending on plan. It is attractive when you move between multiple devices and want a consistent SSH client experience. The tradeoff is that some of the stronger sync and team features are paid, so it is worth checking the current Termius pricing before standardizing on it.

SecureCRT

SecureCRT is a commercial terminal emulator for Windows, macOS, and Linux with a long history in professional environments. It is a serious option when you need stable terminal behavior, session management, scripting, support, and enterprise-style expectations. It is usually more than a casual user needs, and pricing should be reviewed on the official VanDyke pricing page.

Royal TS / Royal TSX

Royal TS and Royal TSX are part of the Royal Apps remote management family. They are useful when SSH is one protocol among many, alongside RDP, VNC, S/FTP, credentials, gateways, and shared connection documents. Royal TS is a better fit for teams or administrators managing varied remote access estates than for someone who only needs an occasional SSH tunnel. Check the current Royal Apps pricing pages for platform-specific licensing.

SmartTerminal

SmartTerminal is a multi-platform SSH desktop workspace for Windows, Linux, and macOS. It includes SSH sessions, tunnel profiles, SCP/SFTP workflows, proxy settings, LLM profiles, and an AI assistant close to the active terminal context. It should not replace OpenSSH or PuTTY for one quick tunnel, but it is worth considering when your daily workflow involves repeated server sessions, file movement, tunnel setup, and command assistance across more than one operating system.

Quick comparison

Security notes before you rely on tunnels

SSH tunnels are powerful because they can reduce direct network exposure, but they can also bypass boundaries people expect. Bind local ports to 127.0.0.1 unless you intentionally need LAN access. Prefer SSH keys over passwords. Use passphrases or an agent. Keep private keys out of shared folders. Avoid forwarding databases or dashboards to public interfaces. Document long-running tunnels so another administrator knows why the port is open.

For production, also check server-side SSH settings such as AllowTcpForwarding, GatewayPorts, user restrictions, firewall rules, and logging. A tunnel should be treated like a privileged access path, not a casual shortcut.

Bottom line

If you like the command line, start with OpenSSH. If you are on Windows and want a familiar free GUI, PuTTY is still relevant. If you want a richer Windows toolbox, MobaXterm is strong. If you manage many remote protocols, mRemoteNG or Royal TS may fit better. If cross-device sync matters, look at Termius. If you need a mature commercial terminal, SecureCRT remains a serious option.

SmartTerminal belongs in the comparison for users who want a multi-platform SSH workspace with AI assistance, file transfer, proxy settings, and tunnel profiles in one application. The unbiased answer is simple: use the smallest tool that solves the job, and move to a broader workspace only when your SSH workflow becomes frequent enough to justify it.