Give every forwarded port a visible beginning and end.
Local, remote and dynamic forwarding solve different route problems. A useful map records the listener, bind scope, SSH carrier, destination and owner together.
Forwarding comparison
Pattern
Listener
Planning question
Local
Operator side
Who can reach the local bind address?
Remote
Server side
What server policy permits the listener?
Dynamic
Local SOCKS proxy
Which applications and names travel through it?
Review before enabling
Record the service owner and approved use case.
Choose the narrowest practical bind address and access window.
Check name resolution at the system that makes the destination connection.
Define observable success and safe rollback before pilot use.