http://sukamuzgxigntu7issqf3y5bfsskwg5zzrzbuqjaxxmhkfoxbgiy77qd.onion/tech_posts/ssh_holyness.html
By default, ssh binds to the loopback address. If you want, for any
reason, bind the forwarded port to another address, prefix the local
port with the address, like this: $ ssh -L 0.0.0.0:4040:127.0.0.1:4040 server.tld To forward a port, it must go to the another server, creating a
tunnel, if you created this forwarding rule with a firewall rule or
another software like socat or netcat, the traffic will be
unencrypted.