A systems administrator deployed a new web application in a public cloud and would like to test it, but the company's network firewall is only allowing outside connections to the cloud provider networ

IPSec uses UDP ports 500 and 4500 along with IP protocol 50 (ESP), none of which are TCP port 22, so the firewall would block all IPSec tunnel negotiation and traffic.

A VPN tunnel can be configured to run over TCP port 22, allowing the administrator to encapsulate and forward application traffic through the sole open port, establishing a functional encrypted path to the cloud-hosted web application.

Browsing to the default gateway IP address does not bypass the firewall restriction or redirect traffic to the cloud-hosted application running on a separate host and different port.

The localhost address (127.0.0.1) refers only to the local machine, not the remote cloud-hosted application, so no external application traffic is reachable this way.

GRE encapsulates traffic using IP protocol 47, not TCP port 22, and would be blocked by a firewall permitting only TCP port 22.

SSH natively operates on TCP port 22 and supports local port forwarding, enabling the administrator to tunnel HTTP or HTTPS traffic through the SSH connection to test the web application without waiting for additional firewall ports to be opened.