Not to clear, if we get your setup correct. So I assume
firewallhost is the host reachable from your Workbench. So It's needed to create an open port on this server, that can access the 'real' mysql Server behind this firewall.
That is quite ok, if you set up an persistent ssh tunnel on the
firewallhost. That is done like this on
ssh -L localhost:33060:localhost:3306 someshelluser@databasehost
This creates an openssh tunnel for localhost (not public on any nic) on port 33060 (or whatever port you have free here) on
firewallhost which is in return connected over this tunnel with the 3306 port (again on localhost but on machine
databasehost) because its connected as someshelluser on
And now you can connect with workbench:
To have the ssh tunnel on
firewallhost persistent, you can start it there like the following way with a keyfile (for accessing
databasehost) and an detached process thru screen. This can be put into your rc.local or whatever you use on
screen -d -m /usr/bin/ssh -v -o "StrictHostKeyChecking=no" -o "UserKnownHostsFile=/dev/null" -o "BatchMode=yes" -i /your/.ssh/ssh_host_dsa_key -q -L locahost:33060:localhost:3306 someshelluser@databasehost
You must just 'imagine' that such an ssh tunnel can 'transport' any port stream from one machine to another by opening a 'new' port on the machine you create that ssh tunnel (here
firewallhost). This can be even done on the public nic of
firewallhost, but you want it on localhost as you don't want expose your mysql port to the public ;)
Ok, as you have no direct access to
firewallhost for creating an persistent tunnel, try another way. You said you are able to connect with proxycommand. As you wrote it inline and not as '-o' Option, I assume you have this in your ssh_config.
If your ssh_config looks like this:
ProxyCommand ssh -W %h:%p firewallhost.example.org
Then you could try the following as 'SSH Hostname' in workbench. With chance, you are allowed to give ssh params with it. I did not test it, but it is not unusal for application to pass the content of Hostname fields right into the ssh call.
-o ProxyCommand="ssh -W %h:%p firewallhost.example.org" mysqlserver.example.org
This should bring you onto your mysqlserver thru your firewallhost. From here your mysql settings can be used as if you would directly connect to mysqlserver as the workbench is expecting.
As you wrote, you are on the same machine (Ubuntu 14) that is able to connect to your mysql database behind
firewallhost, you should just use the values in workbench that you use on the console. The workbench will use your .ssh/config if you call workbench with the same user that the .ssh/config is for.
SSH Hostname would just be 'targetHost' where the proxycommand from your .ssh/config will tunnel you to 'targetHost' thru 'firewallHost'.
SSH Username is 'username' (from .ssh/config again).
MySQL Hostname should be localhost and port 3306 - that should be exactly like you do when accessing the 'targetHost' by ssh as you wrote in your question. Because workbench will use these values after(!) it connects by ssh.