An SSH tunnel lets you reach a service that isn’t exposed to the internet — a database, an admin dashboard, an internal API — by routing the traffic through a server you can already SSH into. Bifrost sets this up per connection, so you don’t have to remember ssh -L flags or edit ~/.ssh/config.
Three kinds of forwarding
- Local (the common one) — open a port on your Mac that tunnels to a host/port reachable from the server. Example: reach a PostgreSQL that only listens on the server’s private network by pointing your local DB client at
127.0.0.1. - Remote — open a port on the server that tunnels back to a service on your Mac (or your side of the network). Useful to expose something running locally to the remote host.
- Dynamic (SOCKS5) — turn the server into a SOCKS5 proxy on a local port, so a browser or app configured to use it routes its traffic through the server.
1. Create an SSH Tunnel connection
SSH tunnels are their own connection type in Bifrost. Create a new connection, choose SSH Tunnel, and give it the server’s host and SSH credentials — the same auth as a normal SSH connection. Then add one or more rules, each set to local, remote or dynamic:
- Local — a local port on your Mac plus the destination host and port as seen from the server (e.g.
127.0.0.1:5432). - Remote — a remote port on the server plus the destination back on your side.
- Dynamic — just a local port; that’s your SOCKS5 proxy.
A single tunnel connection can carry several rules at once — a database, an admin UI and a SOCKS proxy, all from one server.
2. Bring the tunnel up
Open the connection: Bifrost establishes the SSH session and activates every rule, each with its own status indicator. Then point your app at the local end — for a local rule to a database, connect your DB client to 127.0.0.1:<local port> as if the database were on your machine. Bifrost binds local ports to 127.0.0.1, so they’re reachable only from your Mac.
A quick example
To reach a PostgreSQL bound to 127.0.0.1:5432 on the server:
- Type: local
- Local port:
5432 - Destination:
127.0.0.1:5432
Then connect your DB tool to localhost:5432 — the traffic rides the encrypted SSH channel to the server and out to Postgres.
Troubleshooting
“Address already in use.”
Something on your Mac is already using that local port. Pick a different local port (e.g. 15432 instead of 5432).
Tunnel is up but the service doesn’t answer.
The destination is evaluated from the server’s point of view. Make sure the server itself can reach that host and port (nc -z <host> <port> over SSH), and that the service is actually listening there.
Kubernetes instead of SSH? For clusters, use pod/service port-forward from the Kubernetes view — it’s the Kubernetes-native equivalent.
Still stuck? Get in touch — include the exact error text Bifrost shows.