My step by step understanding how to set up SSH tunneling

Begin with casual ssh command:

ssh user@example.com

Add -N option to do Nothing except port forwarding:

ssh user@example.com -N

Decide if tunnel starts on Local or Remote machine. On which port?

ssh user@example.com -N -L 8080 # open local port
ssh user@example.com -N -R 80 # open remote port

Imagine you're on computer where the tunnel ends.

ssh user@example.com -N -L 8080 # I'm on remote host
ssh user@example.com -N -R 80 # I'm on local host

Decide to what site you want to connect, relative to end of the tunnel (computer you're on). That connection won't be encrypted.

Open local 8080 port and forward to google website on port 80:

ssh user@example.com -N -L 8080:google.com:80

Open remote 80 port and forward to local rails app on port 3000:

ssh user@example.com -N -R 80:localhost:3000

• Bonus: read a great article about three types of forwarding.