Port forwarding for localhost traffic over SSH to production machine database

Question

On windows I used to use Bitvise Tunnler to foward all traffic on my PC's localhost:33306 over an SSH connection to my server - and then from there to the mysqlserver:3306 server database.

PC:33306 -> server:3306 -> databaseserver:3306

Now that I'm using linux I find that it is easy to SSH anywhere anytime with:

ssh user@site.tld

However, I'm not sure how to replicate this port forwarding using the ssh options. If it was just from one computer to another I think I could do something like this...

ssh -L 33306:localhost:3306 user@site.com

UPDATE

I have tried connecting using the following SSH and the connection seems to work.

ssh -L 33306:localhost:3306 user@otherserver.com

But phpMyAdmin throws this error when trying to connect to the other server

#1045 - Access denied for user '[[user]]'@'localhost' (using password: YES)

Then I tried

ssh -L 33306:db.server.com:3306 user@otherserver.com

and phpMyAdmin threw this error

#1045 - Access denied for user '[[user]]'@'localhost' (using password: YES)

running netstat -an | more shows

tcp6       0      0 ::1:33306               :::*                    LISTEN   

Again, the process flow should look like this:

mypc -> server -> otherdbserveronprivatelan

Answer 1

This should do:

ssh -L 33306:databaseserver:3306 user@site.com

Answer 2

It did work. However, I was still using "localhost" instead of "127.0.0.1" when trying to connect.

For the command line ssh, this is

ssh -L 3333:mysqlhostname.youdomain.com:3306 shelluser@yourdomain.com

You then open connections in your mysql frontend to 127.0.0.1 port 3333. Note that it must be 127.0.0.1, not localhost, as the later would use UNIX domain sockets.

http://blog.dreamhosters.com/kbase/index.cgi?area=2991

Answer 3

This is not a ssh issue but rather a MySQL one. For MySQL, you need to ensure that the user has been granted access to that database. This is typically done with a:

GRANT ALL PRIVILEGES ON dbname.* TO 'username'@'host' IDENTIFIED BY 'password';

The main thing to note here is the 'host' setting. Since you are tunneling over SSH, you need to be 'username'@'localhost' in order to work. The wildcard setting of 'username'@'%' will not work for localhost connections.