Sometimes it's very useful to directly connect tools (i.e. a database management tool) that runs on a developer or administrator PC, to a daemon on a server (i.e. mysql server) that is only available locally with the server for security reasons.
For the following tunnel examples we assume:
- A server,
www.clazzes.org, runs a mysql server listening on
- It provides a database
testdb, accessible for user
- The server provides a unix account,
webadmin, and we have a ssh key allowed to connect to
firstname.lastname@example.org(or we have password based ssh access)
- We want to access to the database
testdbthrough an ssh tunnel
- When logged in to the server, the local mysql client can connect to the database with:
mysql -h 127.0.0.1 -u dbtester --password=testsecret testdb
- We want to create a tunnel so when connection to port
3333on our local system, we actually connect to mysql-server's port
DO NOT bother to try using those credentials, it might get your IP blocked!
OpenSSH is the default ssh implementation for most Linux distros, and even Microsoft has announced an agreement to include it in Windows.
I'm not sure how equal or similar other Unix ssh clients (like BSD, MacOS) are.
To create a tunnel that stays in foreground:
Test connect to the database:
To close the tunnel, abort or kill the according
ssh process (
ctrl-c, evtl. after
fg to get it back to the foreground).
Forward) and reverse forwards (
RemoteForward) can only be applied to sockets, like
~/.gnupg/S.gpg-agent if the socket to listen on is not yet owned by some daemon.
Hopping can be done automatically using
Putty is the most common ssh client for Windows. Hints for setting up key-based ssh access with Putty can be found everywhere on the internet, we'll focus on tunneling here.
Just one hint anyway: With ssh keys, have
pageant running. Simply double-klick the
.ppk file or even put it in your autostart group.
To setup the tunnel:
- Start Putty
- If you don't have a session yet that allows you to connect to
webadmin, set one up and don't forget to save the session before (re)trying to connect.
- In Session, load the session that allows you to connect to
- In "
- In "
Source port", enter
- In "
127.0.0.1:3306as shown in this screenshot (click to enlarge):
- If you really really want to DANGEROUSLY provide the tunnel for other colleages in you LAN, check "Local ports accept connections from other hosts".
- Click "
- In "
Category", click on "
Save", then "
Now a putty window should open, you should be on
webadmin., and the tunnel should be up.
To check if there's a tunnel, open a Command window and use netstat like this:
To close the tunnel, just close the according putty terminal, preferrably by entering