The following command connects to our server and forwards a specific port on our local machine to the server. In this case we forward port 5432 which belongs to PostgreSQL, so when we connect to localhost:5432 on the desktop, the connection is forwarded through the secure tunnel to the server.

ssh -N -L 5432:localhost:5432
//   │    └ port  └ remote  └ remote port        └ server
//   │
//   └ Does not run a command once connected, if you remove this you will get an interactive SSH session while forwarding

This avoids exposing sensitive services to the Internet in order to work with them. Ideally this isn’t how you would want to work regularly, but it can be useful for one-off testing or fixes.