NixSCP

NixSCP › Docs › Tunnels

SSH tunnel manager for Linux and Windows

Saved local port forwards for your SFTP and SCP sites, in Commands › Tunnels.

Tunnels › Manage Tunnels... is a small SSH tunnel manager built into NixSCP: saved local port forwards for your SFTP and SCP sites, started and stopped with one click. A tunnel listens on a port of your computer and forwards each connection through the site's SSH connection to a host and port as seen from the server, like ssh -L. Typical uses: a database, an admin panel or an API that only listens on the server or its private network. Free, on Linux and Windows.

Add a tunnel

  1. Save the SFTP or SCP site first; tunnels use its SSH connection and stored credentials.
  2. Open Tunnels › Manage Tunnels... and click Add....
  3. Choose the Site, give the tunnel a Name (unique within the site), the Local port (1024 to 65535) and the target host and port as seen from the server. localhost is the server itself.

Example: local port 5433 to localhost:5432 makes the server's PostgreSQL available as 127.0.0.1:5433:

psql -h 127.0.0.1 -p 5433 -U app appdb

Start, stop and status

  • Start opens a separate SSH connection for the tunnel (with the usual host key check) and starts listening; Stop closes it.
  • The list shows each tunnel's status (Connecting..., Running, Stopped, Failed with the reason) and how many connections are open through it.
  • Tunnels listen on 127.0.0.1 only, so other computers on your network cannot use them.
  • A started tunnel keeps running when you close the window, until you stop it or NixSCP exits. Tunnels do not start automatically.
  • The Tunnels menu of the main window lists every saved tunnel: click one to start it, click a running (checked) one to stop it, or use Stop All Tunnels.
  • While tunnels run, the status bar of the main window shows ⇄ 2 tunnels running; hover it for the list with ports and open connections, click it to manage them.
  • When the server refuses forwarding (for example AllowTcpForwarding no) or nothing listens on the target, the tunnel stays up and its status shows the server's answer.

Saved with the site

Tunnels are stored with the site in the WinSCP-format nixscp.ini, so they travel with exports, encrypted cloud sync and, for team sites, with the team.

Tunnels for AI agents

With Open tunnels allowed in the site's Agent Access settings, a program can open a tunnel through NixSCP without getting the site's credentials:

nixscp --tunnel db1 5433:localhost:5432    # any forward
nixscp --tunnel db1 postgres               # a saved tunnel, by name

The tunnel stays open until the command ends (Ctrl+C). Local ports below 1024 are refused, and the request follows the site's approval setting and is logged.

Questions or problems? See the FAQ, open an issue on GitHub or write to hello@codewizdev.com.