Files, tunnels, and jumps
Create local and remote tunnels
Map listening and destination endpoints for local and remote port forwarding before opening them.
9 minute lesson
A local-only database port becomes available on 127.0.0.1 of the operator machine without making the database public. That contrast gives us something useful to test instead of a rule to memorize.
Local forwarding exposes a remote-side destination to a local listener; remote forwarding exposes a client-side destination from the server side. The useful target is not encyclopedic coverage. Make one deliberate choice, observe its consequences, and know which requirement would make you revise it.
The happy path can hide a bad design: you can copy a forwarding flag without drawing which interface listens on which machine and still get one successful demo. Push past the demo. write all four endpoints, bind narrowly, disable an unnecessary remote command, and test who can actually connect, then test the condition most likely to prove the choice wrong.
The module is moving toward one outcome: Use SSH as a controlled transport for commands, files, and connections while understanding each new exposure. Save the before-and-after evidence now; it will make the final project review much more honest.
Build a local tunnel to a private test service and prove it is unavailable from another machine. Save the evidence, then explain which requirement would force you to choose a different design.
Lesson completed