diff --git a/cli-main.c b/cli-main.c
index c7c9035..e3683d9 100644
--- a/cli-main.c
+++ b/cli-main.c
@@ -73,7 +73,9 @@ int main(int argc, char ** argv) {
 	} else
 #endif
 	{
-		progress = connect_remote(cli_opts.remotehost, cli_opts.remoteport, cli_connected, &ses);
+		progress = connect_remote((cli_opts.proxy_over_localhost
+				? "localhost" : cli_opts.remotehost),
+				cli_opts.remoteport, cli_connected, &ses);
 		sock_in = sock_out = -1;
 	}
 
diff --git a/cli-runopts.c b/cli-runopts.c
index 58b64ce..c7f28c1 100644
--- a/cli-runopts.c
+++ b/cli-runopts.c
@@ -56,6 +56,7 @@ static void printhelp() {
 					"Usage: %s [options] [user@]host[/port] [command]\n"
 #endif
 					"-p <remoteport>\n"
+					"-Y <port> Connect to localhost:port, authenticate as [user@]host\n"
 					"-l <username>\n"
 					"-t    Allocate a pty\n"
 					"-T    Don't allocate a pty\n"
@@ -227,6 +228,9 @@ void cli_getopts(int argc, char ** argv) {
 					}
 					cli_opts.always_accept_key = 1;
 					break;
+				case 'Y': /* "local-remoteport" */
+					cli_opts.proxy_over_localhost = 1;
+					/* FALLTRHU */
 				case 'p': /* remoteport */
 					next = &cli_opts.remoteport;
 					break;
@@ -650,6 +654,8 @@ static void parse_hostname(const char* orighostarg) {
 		port = strchr(cli_opts.remotehost, '/');
 	}
 	if (port) {
+		if (cli_opts.proxy_over_localhost)
+			dropbear_exit("-Y mutually exclusive with ^port");
 		*port = '\0';
 		cli_opts.remoteport = port+1;
 	}
diff --git a/dbclient.1 b/dbclient.1
index cf9c647..0788e3b 100644
--- a/dbclient.1
+++ b/dbclient.1
@@ -4,6 +4,7 @@ dbclient \- lightweight SSH client
 .SH SYNOPSIS
 .B dbclient
 [\-Tt] [\-p
+.I port\fR] [\-Y
 .I port\fR] [\-i
 .I id\fR] [\-L
 .I l\fR:\fIh\fR:\fIr\fR] [\-R
@@ -28,6 +29,11 @@ Connect to
 on the remote host. Alternatively a port can be specified as hostname^port.
 Default is 22.
 .TP
+.B \-Y \fIport
+Connect to
+.I port
+on localhost, but use the given hostname for key comparison purposes.
+.TP
 .B \-i \fIidfile
 Identity file.
 Read the identity key from file
diff --git a/runopts.h b/runopts.h
index 062cfd8..add1a42 100644
--- a/runopts.h
+++ b/runopts.h
@@ -132,6 +132,7 @@ typedef struct cli_runopts {
 	int wantpty;
 	int always_accept_key;
 	int no_hostkey_check;
+	int proxy_over_localhost;
 	int no_cmd;
 	int backgrounded;
 	int is_subsystem;
diff --git a/scp.c b/scp.c
index 5a71292..0f6a8fb 100644
--- a/scp.c
+++ b/scp.c
@@ -324,7 +324,7 @@ main(int argc, char **argv)
 	addargs(&args, "%s", ssh_program);
 
 	fflag = tflag = 0;
-	while ((ch = getopt(argc, argv, "dfl:prtvBCc:i:P:q1246S:o:F:")) != -1)
+	while ((ch = getopt(argc, argv, "dfl:prtvBCc:i:P:Y:q1246S:o:F:")) != -1)
 		switch (ch) {
 		/* User-visible flags. */
 		case '1':
@@ -343,6 +343,9 @@ main(int argc, char **argv)
 		case 'P':
 			addargs(&args, "-p%s", optarg);
 			break;
+		case 'Y':
+			addargs(&args, "-Y%s", optarg);
+			break;
 		case 'B':
 			fprintf(stderr, "Note: -B option is disabled in this version of scp");
 			break;
@@ -1146,7 +1149,7 @@ usage(void)
 {
 	(void) fprintf(stderr,
 	    "usage: scp [-1246BCpqrv] [-c cipher] [-F ssh_config] [-i identity_file]\n"
-	    "           [-l limit] [-P port] [-S program]\n"
+	    "           [-l limit] [-P port] [-Y port] [-S program]\n"
 	    "           [[user@]host1:]file1 [...] [[user@]host2:]file2\n");
 	exit(1);
 }