The Tunnels tab of the sidebar keeps port forwards that run over a saved SSH session, each with its own connection:
- Local (-L): listens on this machine and forwards each connection through the server to the destination (as seen from the server).
- Remote (-R): the server listens on the port and forwards each connection back to the destination as seen from this machine.
- Dynamic (-D): a SOCKS5 proxy on this machine (no authentication, CONNECT only, IPv4/IPv6/domain targets); the server opens the connections. A client that does not finish the SOCKS handshake within 10 seconds is disconnected.
Listeners bind to 127.0.0.1 by default; any other address must be typed explicitly and the editor warns that other machines can reach it.
Each tunnel shows its status (stopped, starting, running, or the error) and a Start/Stop toggle; Start all and Stop all act on every tunnel.
Starting a tunnel whose session uses a password tries your keys, then the password saved in the keyring, and asks for the password only if the server still needs it (see Saved passwords), and an unknown host asks to trust its fingerprint like SSH tabs do. A tunnel deleted or changed while one of these prompts is open is not started.
Stopping closes the listener, the open connections and the SSH connection; running tunnels stop when the app exits.
Tunnels are stored in ~/.config/dev.plexusterm.app/tunnels.json with the same rules as sessions (atomic, mode 0600, no secrets, editing disabled if the file cannot be read).