Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Local machine running my scripts needs to access a remote server's DB. Last week I could do, on the local machine ssh -f -N -T -L1081:localhost:3306 ueser@remoteserver -p2222 on the local machine:

# netstat -an | egrep "tcp.*:1081.*"
tcp        0      0 127.0.0.1:1081          0.0.0.0:*               LISTEN     
tcp6       0      0 ::1:1081                :::*                    LISTEN

then telling my scripts to use port 1081 for mysql connections worked. This netstat command shows me im accepting connections fine on the local side but the same check on the remote machine the one with the actual mysql server is not listening in on 1081 at all, which wasn't the case before

I checked sshd_config which seems to allow tunnelling, that is no config change. I also tried opening a tunnel to another server on my network and that's also not working, is my command crap or something? Tried with various combinations of -f -T

share|improve this question
add comment

2 Answers

I have drawn some sketches

The machine, where the ssh tunnel command is typed is called »your host«.

ssh tunnel starting from local


ssh tunnel starting from remote

Introduction

  1. local: -L Specifies that the given port on the local (client) host is to be forwarded to the given host and port on the remote side.

    ssh -L sourcePort:forwardToHost:onPort connectToHost means: connect with ssh to connectToHost, and forward all connection attempts to the local sourcePort to port onPort on the machine called forwardToHost, which can be reached from the connectToHost machine.

  2. remote: -R Specifies that the given port on the remote (server) host is to be forwarded to the given host and port on the local side.

    ssh -R sourcePort:forwardToHost:onPort connectToHost means: connect with ssh to connectToHost, and forward all connection attempts to the remote sourcePort to port onPort on the machine called forwardToHost, which can be reached from your local machine.

Additional options

  • -f tells ssh to background itself after it authenticates, so you don't have to sit around running something on the remote server for the tunnel to remain alive.
  • -N says that you want an SSH connection, but you don't actually want to run any remote commands. If all you're creating is a tunnel, then including this option saves resources.
  • -T disables pseudo-tty allocation, which is appropriate because you're not trying to create an interactive shell.

Your example

The first image represents your case. If you do

ssh -L 1081:localhost:3306 remotehost

all connection attempts to the green port 1081 are forwarded through the ssh tunnel to the pink port 3306 on the remotehost’s localhost, i.e. the remotehost itself.

Now your php scripts can access your database via localhost:1081. But the netstat command on your remotehost can’t find anything listening at 1081 (at least not as a result of the tunnel). Because the pink port isn’t a listening port created by ssh, but the target of the forwarding. And it is not forwarding to port 1081 but to 3306.

Is your db server really listening on port 3306 or possibly on port 1081? If the latter is true, then your command should be changed to look like this:

ssh -L 1081:localhost:1081 remotehost

If your database listens on port 1081 you should find it with netstat (independently of ssh).

Hope this helps clear the confusion.

share|improve this answer
    
Well those are most useful, thanks. As I had the -p it was complaining about -N in any position other than the last. –  Recc Mar 17 at 11:41
add comment

You wouldn't expect the remote side to be listening on port 1081. You're asking the tunnel to connect to port 3306 on the remote side, and this is mysql's default port. It might be worth checking that it is actually listening on that port. Alternatively, if you actually want to use port 1081 on both sides, substitute your -L option with -L1081:localhost:1081.

share|improve this answer
    
You're right it doesnt show on the other end I suppose I had the parameters in wrong order as ssh -T -f -L1081:localhost:3306 ueser@remoteserver -p2222 -N works –  Recc Mar 13 '13 at 15:32
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.