Practical Secure Pipes use cases

Choose a setup by the task you want to complete, then follow the detailed guide for its fields and safety checks.

Reach a remote PostgreSQL database

Goal: use a database client on your Mac without opening the database's port to the public internet.

Create a local forward: Mac listener 127.0.0.1:15432, remote target 127.0.0.1:5432, over your real SSH server. Connect the profile, then point the database client at 127.0.0.1:15432 using the database's own credentials.

If PostgreSQL runs on another machine in the server's private network, use that private hostname/address as the remote target. The SSH server must be allowed to reach it.

Reach several internal services through one profile

Create the first local mapping, then open Manage Port Forwarding… and add an internal web service as a second row. Use different local listener ports, enter purpose labels and save both the table and profile.

The rows share SSH settings and stop together. They are TCP/Unix-target mappings, not general UDP forwarding. Multi-port forwarding requires Pro after the shared trial.

Preview a local web application from an SSH server

Run the web app locally on 127.0.0.1:3000, then create a remote forward with server listener 127.0.0.1:18080. From the SSH server, visit its forwarded port.

This setup is loopback-only. To allow other remote clients, review server GatewayPorts policy, authentication and firewall restrictions with the administrator before exposing it.

Send one browser through a proxy

For a proxy-aware browser/client, create a SOCKS profile on 127.0.0.1:1080 and configure that client to use it, including proxy-side DNS when supported.

For application-based routing, configure an upstream server under Proxy, create a This Mac rule for the chosen browser, select the proxy action and start the transparent proxy. Check the matched rule in active connections instead of assuming the browser used the proxy.

Share routing with a phone

Start transparent proxying and LAN Sharing. Enter the Mac's selected LAN address and sharing port in the phone's manual Wi-Fi HTTP proxy settings. Keep authentication enabled and use a trusted network.

To route that phone differently from your Mac, create a LAN Devices rule using its source IP. Apps that ignore manual proxy settings are outside this setup's scope.

Move settings to a new installation

For your own full configuration, export an encrypted backup, retain its password and separately preserve private-key files. Restore and inspect settings before connecting.

For selected connection settings, generate a share QR code, use a short validity and send its password separately. The recipient configures their own credentials and verifies server trust.