Ports, listeners and tunnels, from a Windows point of view
A port is just a number that tells the operating system which program should receive an arriving packet. Most SSH mysteries — refused, timed out, works at home only — become obvious once that idea is concrete.
Port 22 and its alternatives
SSH servers listen on TCP 22 by convention. Moving the listener to another port cuts down automated noise in the logs but is not security by itself; it just changes the number you type in the Port box.
Why a corporate network blocks it
- Egress filtering permits web traffic and little else.
- A proxy intercepts everything and does not understand SSH.
- The destination firewall allows only known source ranges.
- Split-tunnel VPN routing sends your packets the wrong way.
Local forwarding
A local forward makes a port on your Windows PC stand in for a service on the far side. Connect your local tool to 127.0.0.1 and the traffic emerges from the SSH server.
plink -L 15432:db-internal:5432 [email protected]
Remote and dynamic forwarding
A remote forward does the reverse, publishing a port on the server that reaches back to your workstation. Dynamic forwarding turns the client into a SOCKS proxy so an application can route many destinations through one tunnel. Both are policy decisions as much as technical ones — confirm they are permitted before you rely on them.
Questions people ask about this
How do I see which ports are listening on my Windows PC?
Does changing the SSH port break my saved sessions?
Independent guide. Software names belong to their respective developers; always download from the vendor's own site. Back to all Windows SSH guides.