PortForward

SSH port forwarding from your Mac's menu bar.

---

PortForward is a small, native macOS menu bar app for SSH local port forwarding. Set up your tunnels once, then connect and disconnect each one with a single click. It uses the system ssh and your existing ~/.ssh/config, so there are no extra keys, passwords or daemons to manage.

Features

• One-click tunnels. Click a connection in the menu to connect or disconnect it.
• Picks up where you left off. Connections that were on when you quit reconnect automatically the next time the app opens.
• Live status. A green dot marks active connections and a red dot marks failed ones, with the error shown right in the menu. The menu bar icon fills in while any tunnel is up.
• Several ports per host. Forward as many ports as you need over a single SSH connection, and run several hosts at once.
• Works with your SSH config. Use any host alias from ~/.ssh/config. Authentication goes through your SSH agent and config.
• Saves as you type. Valid changes save automatically. Incomplete entries are flagged in Settings and never replace a working configuration.
• Local by default. Forwarded ports listen on 127.0.0.1. Turn on Allow connections from other devices for a connection to share its ports with your network.
• Lightweight. Native AppKit, no dependencies, no Dock icon.

Requirements

• macOS 13 Ventura or later
• Xcode 26 or later to build
• Key-based SSH access to your servers (for example, through ssh-agent or the macOS Keychain)

Building

1. Clone this repository and open PortForward.xcodeproj in Xcode.
2. Select the PortForward scheme and My Mac.
3. Press Run (⌘R).

To keep a copy, choose Product → Archive, or copy PortForward.app from the build products folder into /Applications.

Usage

1. Click the ⇄ icon in the menu bar and choose Settings….
2. Click + to add a connection, then fill in:
   • Name — optional. Shown in the menu; defaults to the host.
   • Host — a hostname or an alias from ~/.ssh/config.
   • User — optional. Leave blank to use your SSH config.
   • Allow connections from other devices — optional. Lets other devices on your network use the forwarded ports.
3. Under Forwarded Ports, click + and enter the Port on remote server. Set the Port on this Mac only if it should differ.
4. Close Settings and click the connection in the menu to connect.

Your service is then available at localhost:LOCAL_PORT on your Mac.

How it works

For each connection, PortForward runs one ssh process equivalent to:

ssh -N -T -o BatchMode=yes -o ExitOnForwardFailure=yes \
  -o ControlMaster=no -o ControlPath=none \
  -L BIND_ADDRESS:LOCAL_PORT:localhost:REMOTE_PORT [-l USER] HOST

• BIND_ADDRESS is 127.0.0.1, or 0.0.0.0 when Allow connections from other devices is on. macOS may ask whether to accept incoming connections the first time.

• localhost in the forward is resolved on the remote server, so you reach services bound to the server's loopback interface.

• BatchMode=yes means the app never prompts for passwords. If SSH needs one, the connection fails and shows the error instead.

• ExitOnForwardFailure=yes fails fast if a port can't be bound, for example when it's already in use.

• Editing or removing a connection disconnects it once the change saves.

Settings, the connections to restore on launch, and a record of running SSH processes are kept in ~/Library/Application Support/PortForward/. When the app quits, it stops its SSH processes. On the next launch, it cleans up any left behind by a crash, after verifying each one by PID and a unique marker on its command line.

License

PortForward is released under the MIT License.