SSH Tunnels & Port Forwarding — FAQ
A tunnel lets traffic travel through your SSH connection, so you can reach a service that would
otherwise be unreachable — a database behind a firewall, a web interface on a home server, or
the whole internet from your server’s network. Lobishell supports the three standard SSH
forwarding types, the same ones as ssh -L, ssh -R and ssh -D.
Which one do I need?
| Type | Direction | Use it when… | SSH equivalent |
|---|---|---|---|
| Local Forward | Phone → Server | You want to reach one specific service that the server can see but your phone cannot. | ssh -L |
| Remote Forward | Server → Phone | You want people on the server’s side to reach a service running on your phone. | ssh -R |
| Dynamic (SOCKS) | Phone → Server | You want any app to route anywhere through the server, not just one fixed address. | ssh -D |
address you enter is resolved by the SSH server, not by your phone. So
localhost in that field means “the server itself”, and a private address like192.168.1.50 means “whatever that address is on the server’s network”.Setting one up
Where do I create a port forward?
Open the connection you want to tunnel through, then add the forward under its
Port Forwarding section. Each forward belongs to one connection
and gets a name of your choosing so you can tell them apart in the tunnel list.
Turn on Auto-start if the forward should come up automatically
whenever that connection is established.
Port forwarding rules are included in sync and export, so they travel to your other devices
along with the connections themselves.
Local Forward (ssh -L)
Opens a port on your phone. Anything that connects to it comes out at the far
end, at an address the server can reach.
127.0.0.1:8080 ──────▶ (tunnel) ──────▶ remote host : remote port
▲
└── your browser / app connects here
What do I enter?
| Field | Meaning | Example |
|---|---|---|
| Local port | The port opened on your phone | 8080 |
| Remote host | Target address, as seen by the server | localhost |
| Remote port | Target port on that host | 80 |
With the values above, opening http://127.0.0.1:8080 on your phone shows the web
server running on the SSH server itself.
Typical examples
| Goal | Local port | Remote host | Remote port |
|---|---|---|---|
| Web interface on the server | 8080 |
localhost |
80 |
| PostgreSQL on the server | 5432 |
localhost |
5432 |
| Router admin page on the server’s LAN | 8081 |
192.168.1.1 |
80 |
| A second machine behind the server | 3000 |
10.0.0.5 |
3000 |
Can other devices on my Wi-Fi use my Local Forward?
No. A local forward always listens on 127.0.0.1, which means it is reachable only
from the phone itself. This is deliberate: the underlying forwarding path offers no way to
authenticate individual clients, so a listener exposed to the network would be open to
everyone on it.
If you need something reachable from other devices, use a Dynamic (SOCKS)
forward instead — that one has an explicit LAN option and optional
username/password authentication to go with it.
Remote Forward (ssh -R)
The mirror image: opens a port on the SSH server that forwards back to your
phone. Use it to expose something running locally to the server’s side of the connection.
:8080 ◀────────────────────────── 127.0.0.1:local port
▲
└── someone on the server connects here
What do I enter?
| Field | Meaning | Example |
|---|---|---|
| Remote port | The port opened on the SSH server | 8080 |
| Local port | The port on your phone that traffic is delivered to | 8080 |
Traffic arriving on the server’s port 8080 is delivered to
localhost:8080 on your phone — so something has to actually be listening there,
otherwise connections simply fail.
own
127.0.0.1 only, so other machines cannot reach it — even though theforward itself started without error. Making it reachable from outside is a
server-side setting:
GatewayPorts yes (orGatewayPorts clientspecified) in the server’s sshd_config. There is noswitch in the app that can override this.
Dynamic / SOCKS (ssh -D)
Instead of one fixed target, this opens a SOCKS5 proxy on your phone. Any app
pointed at that proxy can reach anything the server can reach, deciding the destination
per connection.
SOCKS5 :1080 ──────▶ (tunnel) ──────▶ any host : any port
▲
└── browser / app configured to use this proxy
What do I enter?
Only a local port — the port the SOCKS proxy listens on. 1080 is
the conventional choice. There is no target address, because choosing the target is the
client’s job with this type.
Then point your app at it: SOCKS5 proxy, host 127.0.0.1, that port.
LAN Access — what does it do, and is it safe?
By default the proxy listens on 127.0.0.1, so only the phone itself can use it.
Turning on LAN Access makes it listen on all interfaces, so
other devices on the same network can route through your phone as well — a laptop browsing
through your server’s connection, for example.
traffic through your server via your phone, with no authentication whatsoever. Always fill in
the Authentication username and password when you enable it —
this is the one setting in the tunnel screens that can genuinely be misused against you.
What is the Authentication section for?
It enables standard SOCKS5 username/password authentication (RFC 1929). If set, clients must
supply those credentials before the proxy will carry their traffic. Leave it empty and the
proxy accepts anyone who can reach it — which is fine while it is bound to
127.0.0.1, and not fine once LAN Access is on.
Common questions
“Could not start forward” — what went wrong?
The two frequent causes:
- The port is already in use. Another app on the phone — or another forward
of yours — already holds it. Port8080is a particularly common collision.
Pick a different local port. - The port is privileged. Ports below
1024cannot be opened by a
normal Android app. Use something above that, e.g.8080instead of80.
Does the tunnel stay up when I leave the app?
Yes, as long as the underlying SSH connection stays open — the session keeps running in the
background. If the connection drops, its forwards go down with it, since every tunnel is
carried inside that one SSH connection.
Enable Auto-start so the forward comes back up on reconnect.
How many port forwards can I have?
In the free version, up to 10. Pro removes the limit. There is no restriction
on which types you use, or on how many you run at the same time.
Is “Route through SOCKS5 proxy” in the connection settings the same thing?
No — it points the other way, and it is easy to mix up:
- Dynamic forward creates a SOCKS proxy out of an SSH connection you
already have. - Route through SOCKS5 proxy makes a connection use a SOCKS5 proxy
that already exists, as an alternative to a jump host.
They combine: one connection can open a dynamic forward, and a second connection can then be
routed through it. Note that routing through a SOCKS5 proxy and using a jump host are mutually
exclusive — enabling one disables the other.
Quick way to remember the three
- Local — “bring something here.” One target, chosen by you.
- Remote — “put something of mine over there.” One target, chosen by you.
- Dynamic — “let anything go through.” Target chosen per connection by the app using it.