SSH can forward ports in three ways. They look similar on the command line, but each solves a different problem.
Local forwarding (-L)
Opens a port on your machine and sends its traffic through the SSH server to a target it can reach. This is the one you use to reach a database behind a bastion.
ssh -N -L 5432:db.internal:5432 [email protected]
Remote forwarding (-R)
Works the other way round: it opens a port on the server and sends its traffic back to your machine. Handy for showing a local dev server to someone else.
ssh -N -R 8080:localhost:3000 [email protected]
Dynamic forwarding (-D)
Starts a SOCKS proxy on your machine. Any application pointed at it routes its traffic through the SSH server.
ssh -N -D 1080 [email protected]
Tip: add -N when you only want the tunnel and no remote shell.