I am experimenting a bit with ssh port forwarding and I stumbled upon a confusing thing. It seems to me that the following commands are doing the same thing:ssh -NfL 192.168.121.215:2222:vm2.local:22 vm2.localssh -NfL 192.168.121.215:2223:localhost:22 vm2.localssh -NfL 192.168.121.215:2224:vm2.local:22 localhostConnecting to pots 2222, 2223 and 2224 from pc brings me all to vm2.local.$ ss -antp # on vm1.local (192.168.121.215)State      Recv-Q Send-Q        Local Address:Port          Peer Address:Port LISTEN     0      128         192.168.121.215:2222                     *:*      users:((ssh,10170,4))LISTEN     0      128         192.168.121.215:2223                     *:*      users:((ssh,10178,4))LISTEN     0      128         192.168.121.215:2224                     *:*      users:((ssh,10225,4))LISTEN     0      128                       *:22                       *:*      users:((sshd,836,3))...What is the difference between the above commands? Is the tunnel created somewhat different? The first command is correct according to man pages, the second is from some website and the last is error I made that turned out working too.
SSH local port forwarding
ssh;port forwarding
There IS difference, even though it does not matter in your case. I am not good in drawing, so I will try to describe it with words:ssh -NfL 192.168.121.215:2222:vm2.local:22 vm2.localThis makes encrypted connection between your host and vm2.local and the port is forwarded through this secure channel, because every end (local and remote) binds its local IP address.ssh -NfL 192.168.121.215:2223:localhost:22 vm2.localThis is the same like above, but you don't bind address of public network interface, but the local one (127.0.0.1). For ssh port, there is no difference (it listens on both of them), but it matters for services listening only on localhost (for example mysql).ssh -NfL 192.168.121.215:2224:vm2.local:22 localhostThis one is connecting to your local host securely (basically no security effect) and then binds remote host directly, so everything you write to the port 2224 is send directly between the machines unencrypted (no problem here for SSH connections, but it would matter for different type of traffic).ConclusionYou should learn to use the second case, but when the forwarded port is not needed to be accessible from outside, you should always bind localhost on local side, like this:ssh -NfL localhost:2223:localhost:22 vm2.localwhere the localhost is default, so you can boil it down to ssh -NfL 2223:localhost:22 vm2.local