---
title: "wendy net forward"
description: "Forward a local TCP port to a running mesh app"
---

## Syntax

```sh
wendy net forward <local-port>:<remote-port> [flags]
```

## Examples

```sh
wendy net forward --help
```

## Arguments

Argument notation from the CLI: `<local-port>:<remote-port>`. Angle brackets mark required values; square brackets mark optional values. See Details for command-specific validation.

## Flags

Flags below include inherited options. Types and defaults come from the CLI source. An empty default means no value is configured.

| Flag | Type | Default | Description |
| --- | --- | --- | --- |
| `--device` | string | (empty) | Target device `host` (hostname, IP, or host:port); 'wendy run' accepts a comma-separated list to deploy one build to several devices (needs a remote build host and --detach). Defaults to $WENDY_DEVICE, then the saved default device |
| `--json` | bool | `false` | Output in JSON format |

## Output

Output depends on the operation and selected target. Use the command help for additional guidance..

## JSON output

The global `--json` option requests machine-readable output. The CLI also selects JSON mode when no interactive terminal is attached. Support and payloads are command-specific; this flag does not guarantee a single JSON document for commands that stream logs or invoke build tools. Consult Details before parsing command output.

## Exit codes

The CLI entry point returns `0` on success and for its user-cancelled or default-cleared results. Other returned errors exit with `1` and print a diagnostic to stderr. Some operations may terminate through subprocess or signal handling; do not infer application health from the CLI exit code alone.

## Common errors

Check argument values and flag combinations against the synopsis above. For discovery, build, port, and readiness failures, see [deployment troubleshooting](../../../../errors/). Command-specific constraints are in Details.

## See also

- [wendy net](../../../../reference/cli/net/)
- [CLI conventions and configuration](../../../../reference/)

## Details

Listen on loopback and open an authorized app stream through the selected device's authenticated agent connection, or native app TLS for a routed Lite service. Mesh selectors reuse their retained operator router. Lite ports must be declared in the current signed manifest; destination WAS1 admission still checks the running app. Each connection owns its own stream; the listener supports up to eight simultaneous connections.

Use the command help for additional guidance.