ssh -L [tunnel-in-port]:[client-host]:[tunnel-out-port] [user@host-to-reach]