Port Forwarding
Port forwarding rules are saved per server and tunnel TCP traffic over an SSH connection to that server. PocketCmd supports local, remote and dynamic (SOCKS5) rules. Manage them in the Port forwards section of the server sheet (Manage rules opens the full list), or from a running session’s Session settings sheet under Port forwardings.
Forwarding works on SSH, Mosh and Eternal Terminal servers. The tunnel always runs over SSH with the server’s saved credentials: on a Mosh or ET server it uses a separate SSH connection, which does not roam with the terminal session and has to reconnect after a network change. Telnet servers have no port forwarding; their server sheet shows Needs SSH.
Rule types
Section titled “Rule types”| Type | Listens on | Connects to | OpenSSH equivalent |
|---|---|---|---|
| Local | A port on this device | A host and port as seen from the server | ssh -L 8080:localhost:80 |
| Remote | A port on the server | A host and port as seen from this device | ssh -R 9000:localhost:3000 |
| Dynamic | A port on this device, as a SOCKS5 proxy | Any destination, resolved by the server | ssh -D 1080 |
Local and dynamic rules listen on localhost on the device, so only apps on the same device can use them. For a remote rule, the server decides which address it binds; with OpenSSH’s default GatewayPorts no, that is the server’s loopback interface.
Create a rule
Section titled “Create a rule”Tap Add rule in the server sheet, or the + button on the Port Forwarding screen (Create your first rule when the list is empty). In New Forwarding Rule, choose Local, Remote or Dynamic and fill in the fields.
| Field | Local | Remote | Dynamic |
|---|---|---|---|
| Label (optional) | Yes | Yes | Yes |
| Local port | Port the device listens on | Port on the device side to connect to | n/a |
| SOCKS port | n/a | n/a | Port the proxy listens on |
| Remote port | Port to reach, as seen from the server | Port the server listens on | n/a |
| Remote host | Host to reach, as seen from the server | n/a | n/a |
| Local target host | n/a | Host the device connects to, for example localhost or a machine on your LAN |
n/a |
Ports must be between 1 and 65535. Quick presets fill the remote port for common services: HTTP (8080), HTTPS (443), MySQL (3306), Postgres (5432), and Redis (6379). Tap Add Rule to save.
A rule without a label is listed by its endpoints, for example L:8080 → localhost:80, R:9000 → localhost:3000, or D:1080 (SOCKS5).
Example: a database behind the firewall
Section titled “Example: a database behind the firewall”A local rule with Local port 5432, Remote host localhost and Remote port 5432 lets a database client on the device connect to localhost:5432 and reach PostgreSQL on the server.
To open a web app on the server, forward a local port to it and load http://localhost:<port> in the browser preview.
Dynamic rules (SOCKS5)
Section titled “Dynamic rules (SOCKS5)”A dynamic rule runs a SOCKS5 proxy on the device. Point an app’s proxy setting at localhost and the rule’s port, and each connection it opens is tunneled through the server. Host names are sent to the server and resolved there, so names on the server’s internal network work.
The proxy accepts SOCKS5 without authentication and supports TCP CONNECT with IPv4, IPv6 and host-name destinations. UDP and BIND are not supported.
Start, stop, edit and delete
Section titled “Start, stop, edit and delete”- Start and stop. The switch on each rule starts or stops its tunnel immediately. Turning a rule on when no session to the server is open connects to the server for the tunnel. The banner at the top of the list says whether a session is connected.
- Automatic start. Rules that are switched on start by themselves when you open an SSH session to the server.
- Edit. Tap a rule, or long-press it and choose Edit.
- Delete. Swipe a rule to the left, or long-press it and choose Delete. PocketCmd asks for confirmation and closes a running tunnel before it removes the rule.
A green, pulsing dot marks a rule that is switched on. Each rule also shows a diagram of its path between Device, the SSH tunnel, Server and the destination.
If a tunnel cannot start, PocketCmd reports that the local port may be in use or that the connection dropped. A local port can be held by only one rule or app at a time.
Forwarding through jump hosts
Section titled “Forwarding through jump hosts”On a server that uses a jump chain, forwards apply to the target server. localhost in a local rule means the target, not a hop.
Agent forwarding
Section titled “Agent forwarding”Agent forwarding lets commands on the server sign in to other machines with keys stored in PocketCmd. The private keys stay on your device; the server only receives signatures.
Turn on Forward SSH agent in a server’s settings under Advanced. It is available for SSH servers only. Mosh, ET and Telnet sessions have no SSH channel to carry the agent.
- Keys to offer. By default the agent offers the server’s own connection key. Select other keys from your library to offer those instead.
- Confirm each use. When on, every signature request shows “Allow SSH key use?”. Choosing Deny, or not answering within a minute, refuses the request.
A server group can turn agent forwarding on for all of its servers. A member server can override it locally.