Tunnels

A tunnel forwards a port over a host's SSH connection. Reach a database or a dashboard on the server's network from your Mac, or let the server reach your Mac. A tunnel needs no second login and goes through the host's jump hosts.

Add one

Open the host's tunnels: Tunnels… in its menu in the sidebar, or the Tunnels button in the toolbar while its tab is in front.
Click Add Tunnel, or use its arrow for a ready-made one: a web page or HTTPS on the server, PostgreSQL, MySQL or MariaDB, Redis, a SOCKS proxy, or a way back to this Mac.
Turn it on with its switch. A tunnel to a web port has an Open button for your browser.

Tick Open when a terminal to the host connects to have it ready whenever you connect.

The three kinds

Local (ssh -L): a port on this Mac reaches a host and port the server can reach. localhost:15432 to localhost:5432 is the server's own PostgreSQL. localhost:8080 to grafana.internal:3000 is a dashboard on its network.
Remote (ssh -R): a port on the server reaches a host and port this Mac can reach, such as a development server on your Mac.
SOCKS (ssh -D): a proxy on this Mac whose connections leave from the server. Set a browser's SOCKS proxy to localhost:1080 to browse as the server would.

Good to know

Only this Mac can use a tunnel's port, unless you tick that other machines may connect.
Pick a port of 1024 or above on this Mac. Lower ones need root.
A tunnel stays open while Wayfinder runs, with or without a terminal to the host, and closes when Wayfinder quits. The tab's status bar shows how many are open.
A tunnel is kept with its host, and moves with your hosts to iCloud Drive if you keep them there.
"The server refused the forward" means the port is in use on the server, or the server does not allow forwarding (AllowTcpForwarding in its sshd_config).
Each tunnel opened or closed is in Window › Activity Log.

Next: Set up the assistant