SSH tunnel/bridge to a remote database

Question

I can't seem to wrap my head around the concept of ssh tunneling. The situation I'm currently in is that I have:

• Server A, which can be accessed through ssh, and inside it there's a mysql db accessed through localhost:3306.
• Server B, which has ssh access to A.
• MySQL instance C which has access to B. I can only access the db server, not the server itself, so I am unable to ssh anywhere from C. I can only connect to any port on B.

My goal is MySQL replication from A to C, where A is the master, and C - the slave. How should I proceed if I wanted to connect from C to A. I imagine it something like this diagram:

C ─────────B:B_PORT────────> B
                            │││
         |/─────tnl A:22────┘││
A_db <────localhost:3306─────┘│
         |\─────tnl A:22──────┘

So far I tried to run this on B sudo ssh -L B_PORT:localhost:3306 A_user@A_ip -f -N but I still can't seem to access A from C, when connecting to B_PORT.

EDIT: Also tried ssh -L B_PORT:localhost:3306 A_user@A_ip -f -N -g as suggested by @larsks with no avail. His explanation leads me to believe there might be issues within the network

My journey so far

1. Create tunnel on B with ssh -L B_PORT:localhost:3306 A_user@A_ip -f -N -g
2. Connect C to B.
3. netstat on B shows multiple SYN_RECV connections from C to B
4. If I try to connect to B_PORT from B I get this

packet_write_wait: Connection to A port 22: Broken pipe
ERROR 2013 (HY000): Lost connection to MySQL server at 'reading initial communication packet', system error: 0

5. ssh connection is dropped on B and tunnel needs to be reopened
6. Fiddled around with security groups and other network rules. Enabled network inbound and outbound from and to C and everything is working!

Answer 1

You need to add the -g option to your ssh command line:

     -g      Allows remote hosts to connect to local forwarded ports.
             If used on a multiplexed connection, then this option
             must be specified on the master process.

This will expose forwarded ports on host B so that they are accessible from C. This assumes your firewall configuration on B permits these connections.

The -g option changes the local bind address that ssh uses for the local port. Without -g, -L 8000:localhost:8000 results in:

$ netstat -tln | grep 8000
tcp        0      0 127.0.0.1:8000          0.0.0.0:*               LISTEN     
tcp6       0      0 ::1:8000                :::*                    LISTEN     

As you can see, in this case, both sockets are bound to the loopback address (127.0.0.1 for ipv4 and ::1 for ipv6).

With -g, we instead get:

$ netstat -tln | grep 8000
tcp        0      0 0.0.0.0:8000            0.0.0.0:*               LISTEN     
tcp6       0      0 :::8000                 :::*                    LISTEN     

In this case, you can see that ssh is now binding to the wildcard address instead of the loopback address.

Answer 2

Why the sudo? sudo is not the answer to all problems, and often the cause.

I think this is what you want.

ssh -L local_port:remote_ip:remote_port jump_user@jump_ip
ssh -L C_PORT:A_ip:3306 B_user@B_ip -f -N

• remote is from jump's perspective
• jump is from local's perspective