`-g` was new to me. I believe I have done something similar by providing an explicit bind address to -L, like this: ssh -L 0.0.0.0:2222:10.0.0.1:22 host I thi

`-g` was new to me. I believe I have done something similar by providing an explicit bind address to -L, like this: ssh -L 0.0.0.0:2222:10.0.0.1:22 host I think this will bind to 0.0.0.0:2222 (allowing remote hosts to connect) and forward all traffic to that port to 10.0.0.1:22 (from the server's perspective). The biggest gap in this collection of tricks (IMO) is SSH certificate support.