1

I have a postgres server (but it could be any service, I suppose) running in local a network and a server (AWS EC2 instance) that I'd like to use as an intermediary to access the database.

So far, I've managed to make a reverse ssh tunnel from the local server to the intermediary:

autossh -o "ServerAliveInterval 60" -o "ServerAliveCountMax 3" -fnN -R 5432:localhost:5432 user@intermedite-host

I can already access the database from my laptop if I do a "forward" tunnel to the server, and then just connect to my localhost:5432 (in the laptop).

However, what I'd like to do is to have the database public as if it were running in the intermediary server, connecting to it with just intermedite-host:5432.

So far, I've played around with another ssh tunnel only inside intermedite-host and with iptables. But I'm out of my depth and can't figure it out. Any help would be appreciated.

1 Answer 1

0

There is a way to do what you ask (below) but I wonder if it's really the right thing in your case.

The canonical way to do what you are looking for in AWS is to use AWS features rather than a Linux host forwarding ports. This would usually be either:

  • setup the EC2 Instance running your service (PostgreSQL) with its own public IP address. You can use security groups to limit public access down to only the one port (5432).
  • or setup an NAT gateway in AWS and forward port 5432 to your EC2 machine there.

Configuring with stunnel

Since you are going to expose this to the public internet you might consider using making your intermediate machine an SSL gateway. You could setup stunnel to serve an SSL encrypted port 5432 to the internet and forward the unencrypted side to your PostgreSQL server.


Configuring with IP tables

To do this under Linux you can setup the intermediate machine as a NAT gateway. But challenge is making sure the PostgreSQL understands correctly what to do with the outbound traffic (back to the clients). You need to either:

  • Configure your PostgreSQL server to route all outbound traffic (port 5432) to public IP addresses via your intermediate server
  • Configure your intermediate server with two NATs: One public side, one private side. That way PostgreSQL will always see your intermediate server talking to it, and.

I don't have the right commands to do this to hand so will come back to edit them in later.

2
  • Thank you for the detailed answer. After some more search after posting the question, I ended up finding the option GatewayPorts no in sshd_config file and setting it to yes. That did the trick for me. I don't know whether I should post that as an answer, though.
    – mbtg
    May 18, 2021 at 9:32
  • @mbtg It would be good to for future readers
    – ARF
    May 18, 2021 at 18:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .