> For the complete documentation index, see [llms.txt](https://docs.devolutions.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devolutions.net/rdm/knowledge-base/knowledge-base-articles/entry-settings/ssh-port-forward.md).

# SSH port forward

Configure the SSH port forward entry in Remote Desktop Manager, covering port forwards, SSH settings, SSH key, proxy, gateway, and logs.

This article lists all the settings and options pertaining to the ***SSH port forward*** entry type, each header representing a tab in the entry's creation/edit window.

<table data-header-hidden><thead><tr><th width="144.39996337890625"></th><th></th></tr></thead><tbody><tr><td><strong>SETTINGS</strong></td><td><strong>DESCRIPTION</strong></td></tr><tr><td><strong>Name</strong></td><td>The name of the entry.</td></tr><tr><td><strong>Folder</strong></td><td>The folder where the entry is located. A folder can be selected by clicking the arrow or the three dots to open the <em><strong>Folder</strong></em> window. To create a new folder, click on the plus (<em><strong>+</strong></em>) icon.</td></tr><tr><td><strong>Display</strong></td><td>How the session is displayed. <em><strong>Embedded (tabbed)</strong></em> means that the remote connection is open within the same window as the other tabs or entries. Each connection has its own tab, making it easy to switch between them. An <em><strong>Undocked</strong></em> display refers to the session window being detached from the main application. It allows you to move and resize the remote session window freely on your desktop.</td></tr><tr><td><strong>Host</strong></td><td><em><strong>Host configured</strong></em> lets you select the host. <em><strong>Linked</strong></em> indicates that the host for the entry is linked to a host entry. <em><strong>Inherited</strong></em> is used when the host is inherited from a higher-level or parent entry.</td></tr><tr><td><strong>Credentials</strong></td><td><ul><li><strong>Username and password</strong>: You will set the username and password in the <em><strong>SSH settings</strong></em> tab.</li><li><strong>Linked</strong>: Links to a credential entry selected from a vault. To use this feature, users must have the <em><strong>View</strong></em> permission on the entry.</li><li><strong>Inherited</strong>: Inheritance means that credentials will automatically be passed down from a higher-level entry to lower-level entries that inherit from it.</li><li><strong>My personal credentials</strong>: These credentials are not entry specific but are instead taken from the option under <em><strong>File</strong></em> – <em><strong>My account settings</strong></em> – <em><strong>Local credentials</strong></em> – <em><strong>My personal credentials</strong></em>.</li><li><strong>None</strong>: Remote Desktop Manager will not send credentials to the entry.</li><li><strong>My privileged account</strong>: These credentials are not entry specific but are instead taken from the option under <em><strong>File</strong></em> – <em><strong>My account settings</strong></em> – <em><strong>Local credentials</strong></em> – <em><strong>My privileged account</strong></em>.</li><li><strong>Use linked host credentials</strong>: Uses the credentials of the linked host entry. Available when <em><strong>Host</strong></em> is set to <em><strong>Linked</strong></em>.</li></ul></td></tr></tbody></table>

### General

The ***General*** tab allows you to add, edit, delete, import and export port forward data. Added port forwards appear in the tab's box, with their ***Source***, ***Source port***, ***Destination***, ***Destination port***, ***Mode*** (***Local***, ***Remote***, or ***Dynamic***), and ***Description***.

### SSH settings

<table data-header-hidden><thead><tr><th width="215.5999755859375"></th><th></th></tr></thead><tbody><tr><td><strong>SETTINGS</strong></td><td><strong>DESCRIPTION</strong></td></tr><tr><td><strong>Host</strong></td><td>The field contains the host name. Clicking on the ellipsis button opens the <em><strong>Computer list</strong></em> menu. Available when <em><strong>Host</strong></em> is set to <em><strong>Host configured</strong></em>.</td></tr><tr><td><strong>Port</strong></td><td>Select the default port (22) or use the <em><strong>Port generator</strong></em> to generate one.</td></tr><tr><td><strong>Set host public key</strong></td><td>Set the public key expected from the SSH host. Once a key is set, a clear button removes it, and the <em><strong>View comment</strong></em> button displays the comment stored with the key, if any.</td></tr><tr><td><strong>Username</strong></td><td>This entry's login credentials.</td></tr><tr><td><strong>Password</strong></td><td>This entry's login credentials. Unavailable when <em><strong>Always ask for password</strong></em> is checked.</td></tr><tr><td><strong>Always ask for password</strong></td><td>Prompt for the password instead of saving it in the entry.</td></tr><tr><td><strong>Password prompt string</strong></td><td>A string used if a server has a different login process (this field is optional).</td></tr><tr><td><strong>OTP prompt string</strong></td><td>A string used to know when to send the OTP (this field is optional).</td></tr><tr><td><strong>Use smart card</strong></td><td>Uses the smart card.</td></tr><tr><td><strong>Certificate method</strong></td><td><p>The method used to fetch the smart card credentials. Available when <em><strong>Use smart card</strong></em> is checked:</p><ul><li><strong>CAPI</strong></li><li><strong>PKCS</strong></li><li><strong>Try all modes</strong></li></ul></td></tr><tr><td><strong>PIN code</strong></td><td>The smart card PIN. Available when <em><strong>Use smart card</strong></em> is checked.</td></tr></tbody></table>

### SSH key

<table data-header-hidden><thead><tr><th width="142.7999267578125"></th><th></th></tr></thead><tbody><tr><td><strong>SETTINGS</strong></td><td><strong>DESCRIPTION</strong></td></tr><tr><td colspan="2"><strong>Key</strong></td></tr><tr><td><strong>Private key</strong></td><td><p>The source of the SSH key. Choose between:</p><ul><li><strong>No private key</strong></li><li><strong>File (local)</strong>, which lets you choose a path to a local private key file.</li><li><strong>Embedded data</strong>, which lets you manually enter a private key (or generate one via the <em><strong>Generate key</strong></em> button).</li><li><strong>Linked</strong>, which lets you choose an SSH key entry from which to retrieve a key. To use this feature, users must have the <em><strong>View</strong></em> permission on the entry.</li><li><strong>My personal SSH key</strong>, which uses the SSH key set in <em><strong>File</strong></em> – <em><strong>My account settings</strong></em> – <em><strong>My personal SSH key</strong></em>, under <em><strong>Local credentials</strong></em>. Click the edit button next to the list to change it.</li></ul></td></tr><tr><td><strong>Vault</strong></td><td>The vault that contains the SSH key entry. Available when <em><strong>Private key</strong></em> is set to <em><strong>Linked</strong></em>.</td></tr><tr><td><strong>Entry</strong></td><td>The SSH key entry to use. Click the add button to create a new SSH key entry, or the clear button to remove the selection. Available when <em><strong>Private key</strong></em> is set to <em><strong>Linked</strong></em>.</td></tr><tr><td><strong>File</strong></td><td>This field points to the SSH key file (this field is only available if the <em><strong>Private key</strong></em> is <em><strong>File (local)</strong></em>).</td></tr><tr><td><strong>Passphrase</strong></td><td>The passphrase used to decrypt the key. Available when <em><strong>Private key</strong></em> is set to <em><strong>File (local)</strong></em> or <em><strong>Embedded data</strong></em>, and unavailable when <em><strong>Always prompt for passphrase</strong></em> is checked.</td></tr><tr><td><strong>Always prompt for passphrase</strong></td><td>Prompt for the passphrase each time the key is used instead of saving it. Available when <em><strong>Private key</strong></em> is set to <em><strong>File (local)</strong></em> or <em><strong>Embedded data</strong></em>.</td></tr><tr><td><strong>Private key data</strong></td><td>Select or generate a private key file (this field is only for <em><strong>Embedded data</strong></em> and the key is saved in Remote Desktop Manager). The buttons next to the field generate, view, paste, browse for, or clear the key.</td></tr><tr><td colspan="2"><strong>Certificate</strong></td></tr><tr><td><strong>Certificate type</strong></td><td><p>The source of the certificate. The <em><strong>Certificate</strong></em> sub-tab is available when <em><strong>Private key</strong></em> is set to <em><strong>File (local)</strong></em> or <em><strong>Embedded data</strong></em>, or when a certificate is already configured. Choose between:</p><ul><li><strong>No certificate</strong></li><li><strong>File (local)</strong>, which lets you select a local certificate file.</li><li><strong>Embedded data</strong>, which stores the certificate in the SSH entry.</li></ul><p>For a linked key, an information icon indicates that a certificate configured on the linked SSH credential takes priority over the one specified here.</p></td></tr><tr><td><strong>File</strong></td><td>The path to the certificate file. Available when <em><strong>Certificate type</strong></em> is set to <em><strong>File (local)</strong></em>.</td></tr><tr><td><strong>Certificate</strong></td><td>The certificate stored in the entry. The buttons next to the field view, clear, paste, or browse for the certificate. Available when <em><strong>Certificate type</strong></em> is set to <em><strong>Embedded data</strong></em>.</td></tr></tbody></table>

### Proxy

<table data-header-hidden><thead><tr><th width="170.79998779296875"></th><th></th></tr></thead><tbody><tr><td><strong>SETTINGS</strong></td><td><strong>DESCRIPTION</strong></td></tr><tr><td><strong>Proxy mode</strong></td><td><p>Choose between:</p><ul><li><strong>None</strong></li><li><strong>Link</strong>, which points to a <em><strong>Proxy Tunnel</strong></em> entry.</li><li><strong>Custom</strong>, which sets up a custom proxy with the same settings as a proxy tunnel.</li></ul></td></tr><tr><td><strong>Proxy</strong></td><td>The proxy entry to use. Available when <em><strong>Proxy mode</strong></em> is set to <em><strong>Link</strong></em>.</td></tr><tr><td><strong>Proxy type</strong></td><td><p>The type of custom proxy. Available when <em><strong>Proxy mode</strong></em> is set to <em><strong>Custom</strong></em>:</p><ul><li><strong>Socks4</strong></li><li><strong>Socks5</strong></li><li><strong>HTTP</strong></li><li><strong>Local</strong></li></ul><p><em><strong>Telnet</strong></em> is listed only for an entry that already uses it.</p></td></tr><tr><td><strong>Host</strong></td><td>The host name and port of the proxy. Available when <em><strong>Proxy type</strong></em> is not <em><strong>Local</strong></em>.</td></tr><tr><td><strong>Username</strong></td><td>The proxy username. Available when <em><strong>Proxy type</strong></em> is not <em><strong>Local</strong></em>.</td></tr><tr><td><strong>Password</strong></td><td>The proxy password. Unavailable when <em><strong>Always ask for password</strong></em> is checked.</td></tr><tr><td><strong>Always ask for password</strong></td><td>Prompt for the proxy password instead of saving it in the entry.</td></tr><tr><td><strong>Excluded hosts</strong></td><td><p>Hosts that do not go through the proxy. Available when <em><strong>Proxy type</strong></em> is not <em><strong>Local</strong></em>. The list supports:</p><ul><li>Wildcards, such as asterisks, which are interpreted as any number of characters (including 0), and question marks, each of which represents a single character.</li><li>Leading point notation, according to which ".domain.com" equals "*.domain.com".</li></ul></td></tr><tr><td><strong>Consider proxying localhost connections</strong></td><td>Send connections to the local host through the proxy as well. Available when <em><strong>Proxy type</strong></em> is not <em><strong>Local</strong></em>.</td></tr><tr><td><strong>DNS name lookup at the proxy end</strong></td><td><p>Where host names are resolved. Available when <em><strong>Proxy type</strong></em> is not <em><strong>Local</strong></em>:</p><ul><li><strong>Automatic</strong></li><li><strong>Yes</strong></li><li><strong>No</strong></li></ul></td></tr><tr><td><strong>Telnet / local proxy command</strong></td><td>The command used by the <em><strong>Local</strong></em> or <em><strong>Telnet</strong></em> proxy type. Leave the field blank to use the default.</td></tr></tbody></table>

### SSH gateway

<table data-header-hidden><thead><tr><th width="173.199951171875"></th><th></th></tr></thead><tbody><tr><td><strong>SETTINGS</strong></td><td><strong>DESCRIPTION</strong></td></tr><tr><td><strong>Gateway mode</strong></td><td><p>Choose between:</p><ul><li><strong>None</strong></li><li><strong>Custom</strong>, which lets you configure an SSH gateway. Gateways are listed with their host and port, and the toolbar adds, edits, deletes, and reorders them.</li><li><strong>Linked</strong>, which picks from an already existing SSH gateway in the <em><strong>Gateway</strong></em> field.</li></ul></td></tr></tbody></table>

### Logs

<table data-header-hidden><thead><tr><th width="197.2000732421875"></th><th></th></tr></thead><tbody><tr><td><strong>SETTINGS</strong></td><td><strong>DESCRIPTION</strong></td></tr><tr><td><strong>Enable logging</strong></td><td>Write the connection's log to a file.</td></tr><tr><td><strong>Log path type</strong></td><td>The <em><strong>Custom</strong></em> mode requires the path and file name. The <em><strong>Global</strong></em> mode requires the file name and then to configure the global path in <em><strong>File</strong></em> – <em><strong>Settings</strong></em>. Available when <em><strong>Enable logging</strong></em> is checked.</td></tr><tr><td><strong>Log path</strong></td><td>Includes the path and the file for the log. Available when <em><strong>Log path type</strong></em> is set to <em><strong>Custom</strong></em>.</td></tr><tr><td><strong>Log filename</strong></td><td>The name of the file at the location defined in <em><strong>File</strong></em> – <em><strong>Settings</strong></em> – <em><strong>Session</strong></em> – <em><strong>Terminal</strong></em> – <em><strong>Default path</strong></em>. Available when <em><strong>Log path type</strong></em> is set to <em><strong>Global</strong></em>.</td></tr><tr><td><strong>Verbose</strong></td><td>This will set how in-depth logs are, from 0 to 4.</td></tr></tbody></table>

### Advanced

<table data-header-hidden><thead><tr><th width="288.39996337890625"></th><th></th></tr></thead><tbody><tr><td><strong>SETTINGS</strong></td><td><strong>DESCRIPTION</strong></td></tr><tr><td><strong>Internet protocol</strong></td><td>Choose between <em><strong>Default</strong></em>, <em><strong>IPv4</strong></em>, or <em><strong>IPv6</strong></em>.</td></tr><tr><td><strong>Interactive authentication in terminal</strong></td><td>This option manages the behavior when the terminal asks you for interactive authentication. The <em><strong>No</strong></em> option makes Remote Desktop Manager manage it, while <em><strong>Yes</strong></em> makes the terminal manage it. <em><strong>Default</strong></em> is also available.</td></tr><tr><td><strong>Delay before reconnecting</strong></td><td>The delay before reconnecting, from 1 to 10000 seconds.</td></tr><tr><td><strong>Display error messages</strong></td><td>Choose to show error messages or not: <em><strong>Default</strong></em>, <em><strong>Yes</strong></em>, or <em><strong>No</strong></em>.</td></tr><tr><td><strong>Always accept fingerprint</strong></td><td>Always accept fingerprints or not: <em><strong>Default</strong></em>, <em><strong>Yes</strong></em>, or <em><strong>No</strong></em>.</td></tr><tr><td><strong>Algorithm support</strong></td><td>In the <em><strong>Custom</strong></em> mode, click the button next to the list to select one or multiple <em><strong>Cipher</strong></em>, <em><strong>Host key</strong></em>, <em><strong>Kex</strong></em> and/or <em><strong>MAC</strong></em> algorithms. The other mode is <em><strong>Default</strong></em>.</td></tr><tr><td><strong>Enable compression</strong></td><td>Allows sending compressed data or not: <em><strong>Default</strong></em>, <em><strong>Yes</strong></em>, or <em><strong>No</strong></em>.</td></tr><tr><td><strong>Bracketed paste</strong></td><td>Choose between <em><strong>Default</strong></em> and <em><strong>Disable bracketed paste</strong></em>.</td></tr><tr><td><strong>Show logs</strong></td><td>Show the connection logs.</td></tr><tr><td><strong>Enable GSSAPI authentication</strong></td><td>Enables GSS API authentication.</td></tr><tr><td><strong>Hide when connection is successful</strong></td><td>Hide the connection window once the connection succeeds.</td></tr><tr><td><strong>Enable GSSAPI credential delegation</strong></td><td>Enable GSS API credential delegation.</td></tr><tr><td><strong>Enable TCP keep-alives</strong></td><td>Enables TCP keepalives.</td></tr><tr><td><strong>Disable Nagle's algorithm</strong></td><td>Disable Nagle's algorithm.</td></tr><tr><td><strong>Seconds</strong></td><td>The interval between TCP keep-alives, from 1 to 99999 seconds. Available when <em><strong>Enable TCP keep-alives</strong></em> is checked.</td></tr><tr><td><strong>Use SSH authentication agent</strong></td><td>Uses the SSH authentication agent currently opened on your machine (including the Remote Desktop Manager SSH key agent). When this option or agent forwarding is checked, the entry's private key is ignored to avoid conflicts with the agent.</td></tr><tr><td><strong>Allow SSH authentication agent forwarding</strong></td><td>Allow SSH authentication agent forwarding.</td></tr><tr><td><strong>No shell</strong></td><td>Open the connection without starting a shell on the remote host.</td></tr><tr><td><strong>Skip environment variable setup</strong></td><td>Skips environment variable setup.</td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.devolutions.net/rdm/knowledge-base/knowledge-base-articles/entry-settings/ssh-port-forward.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.