SSH tunnel command builder for Mac

Build a local SSH port-forwarding command for PostgreSQL, MySQL, Redis or a private web app. Set the SSH endpoint and the service address separately, then copy the command into your Mac's local Terminal. The generator requires no account and does not send form values to a server, store them or open a connection.

This tool is maintained by Nexus Shell, a native Mac SSH workspace. It generates commands for the system OpenSSH client. You do not need Nexus Shell to use the command.

A complete example without the builder

Suppose a PostgreSQL service listens on port 5432 on the same host that accepts your SSH login. This opens an IPv4 loopback listener on your Mac at port 15432:

ssh -N -T -o ExitOnForwardFailure=yes -o ServerAliveInterval=30 -L '127.0.0.1:15432:127.0.0.1:5432' -p 22 '[email protected]'

Replace the example SSH endpoint locally and verify its host key. Keep the Terminal window open. In your database client choose host 127.0.0.1 and port 15432, and use your normal database login. Press Control-C in the tunnel's Terminal window when finished.

Which address belongs to which machine?

• Local port: a listener on your Mac. Pick an unused port; the builder uses ports above 1023 so it does not require sudo.
• SSH server: the endpoint your Mac can reach, using its SSH port and account. A configured SSH alias can supply the identity; enter the alias's SSH port explicitly in the form.
• Service host: resolved and reached from the SSH server. Here 127.0.0.1 means that server, not your Mac. For a separate database host, use an address reachable from the SSH server, such as db.internal.
• Service port: the port where the destination service listens. Changing the local port does not change the service's port.

The listener binds to 127.0.0.1 so it is not intentionally exposed on your LAN. Other local processes can still use it. SSH protects the path to the SSH server; when the service is on another host, the onward connection needs its own protection, such as database TLS. SSH authentication does not replace database authentication.

Verify the service, not just the open tunnel

The SSH process may stay quiet while forwarding. ExitOnForwardFailure catches failures to set up forwarding, but it does not prove that the SSH server can reach the destination service. Connect with the database client and perform your normal read-only connection check before relying on the tunnel.

For a web app, open its expected HTTP or HTTPS address at 127.0.0.1 and the chosen local port. Hostname routing and TLS certificates may still require the service's normal hostname configuration; do not disable certificate checks to hide a mismatch.

Common failures

Address already in use

The local port is occupied. Choose another local port in the builder and update your client to match. Do not terminate an unknown process just to free the port.

Administratively prohibited

The SSH account or server policy does not allow this forwarding destination. Ask the server administrator to check the permitted access; changing the local command cannot grant that permission.

Connection refused after the client connects

Check the service host and port from the SSH server's perspective. A working SSH login alone does not establish that the database is listening or reachable.

MySQL tries a local socket

Use a TCP connection to 127.0.0.1 and the forwarded port. Some MySQL clients treat localhost as a Unix socket connection, which bypasses the TCP tunnel.

Keep server maintenance beside your database client

Use your database client for queries and this OpenSSH command for forwarding. Nexus Shell can complement that workflow with saved SSH connections, terminal sessions, SFTP and Docker inspection. Run the generated tunnel in a local Terminal, not inside a remote Nexus Shell session; this page does not configure a tunnel manager in the app.

For a configuration change, follow the remote file editing guide. For a container issue, use the remote Docker inspection workflow. Nexus Shell requires Apple Silicon and macOS 14.2 or later. Free use is personal and non-commercial; SFTP and other Pro features retain their licensing requirements.

References and verification

The builder validates syntax and generates a command; it cannot verify your host key, access policy, credentials or network. No connection to a customer server is made by this page.

• OpenSSH command reference: local forwarding, no-command mode and address binding.
• PostgreSQL SSH tunnels: database connectivity and the boundary of tunnel encryption.
• MySQL connection methods: TCP and Unix socket selection.