I cannot think of any use case that using ssh -L is better than using ssh -D. I know that ssh -R can be really useful for some network settings, but it seems that ssh -D can do anything ssh -L can do.

But man we have this option -L baked in and it's gotta be better(or the only) solution for some cases right??

2 Answers 2


The simple answer is that not all programs speak SOCKS, which is needed to use -D. The vast majority of them either support only HTTP CONNECT proxies, or have no proxy settings at all – they expect an address & port for reaching the server directly, and nothing more.

In order to use such programs with ssh -D, you would then need an intermediate layer that would speak SOCKS on behalf of those programs whenever they want to connect somewhere.

Such layers exist, of course, but now you're adding two extra layers that cancel each other out. In many cases, where the program only needs to contact exactly one host via the tunnel, that's just needless complexity.


Local TCP Forwarding can be used to forward Unix domain sockets from remote host to your local. This is very useful when you want to connect to database, which exposes only local socket, not a TCP port and you want to access it securely. You can't do that using SOCKS proxy.


ssh ­-L /var/run/mysqld/mysqld.sock:/var/run/mysqld/mysqld.sock ­mysql-server

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.