Using SSH Tunnel Forwarding

Introduction

In a clustered AutoPilot deployment, you must SSH to your jump server before you can connect to another server in the cluster. In some cases, you may need to establish a tunnel to a server other than the jump server, such as a web or database server (for example, to use Xdebug or a MySQL client).

Forwarding

In this example, we will create an SSH tunnel to allow your local machine to connect to MySQL on the database server.

ssh -L 3306:database.internal:3306 user@123.123.123.123

This command forwards connections on your local machine's port 3306 to database.internal on your AutoPilot deployment. You can then connect to localhost on port 3306 in your MySQL client, and this connection will be forwarded to your database server.

Reverse forwarding

In this example, we will establish SSH tunnels to forward traffic from Xdebug (port 9000) on the web server to your local machine's port 9003.

ssh -R 9003:localhost:9003 user@123.123.123.123 ssh -R 9000:localhost:9003 web.internal

Replace user@123.123.123.123 with your username and jump server's IP address.

The SSH -R flag establishes reverse port forwarding. The arguments, separated by colons (:) in order are:

• port - The port on the remote machine to listen on.
• host - The host to forward the connection to. This will almost always be localhost.
• hostport - The port on the target host (localhost) to forward connections to.

In the above example, we are forwarding traffic from port 9000 (for Xdebug) on the web server to the jump server on port 9003. The jump server then forwards this back to your local machine, also on port 9003.