Port forwarding tunnels traffic through an SSH connection — local forwarding (local port → remote), remote forwarding (remote port → local), dynamic forwarding (SOCKS proxy).
SSH -L (local), -R (remote), -D (dynamic/SOCKS). Dynamic forwarding creates a full SOCKS5 proxy through SSH. Used in pen testing to pivot through SSH-accessible hosts to reach internal systems. Also bypasses firewalls.