When you are connecting to cloud providers and if you DO NOT want to open the ports of the application from the IASS providers port. Then you use the Sock connection to do that
ssh -i ~/sshkey.pem.txt -D1088 user@IP
In the browser proxy setting, select SOCK host and provider localhost ip 127.0.0.1 and port as 1088. This way you can connect to the remote machine with specified port.
To access specific port through tunnelling use -L option
ssh -i <key> -L <localport>:1127.0.0.1:<remoteport> user@IP