Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a web server that connects to a 3rd party database server and is granted permission to do so via a firewall rule on the database server.

When I'm developing locally on my laptop, I use an SSH tunnel to connect to the database server via the web server.

ssh -L

What I would like to do, if it's even possible, is to set up a firewall rule on the web server that essentially accomplishes the same thing persistently.

So connecting to forwards my connection on to and the database server allows the connection as it's coming from the web server.

Problem is, I'm not really sure where I should start looking for ways to do this.

I'm running Shorewall 3.2.6 on the web server to configure my firewall.

Do I need to start with a VPN or can this be achieved without one?

share|improve this question
While I consider this to be a good question I also feel I should warn you that you would potentially be opening an extra and undesirable hole to the database server, thereby pretty much killing the protection afforded by the current setup. At the very least you should restrict it to the single source IP addresses you will be connecting from. – John Gardeniers Apr 29 '11 at 11:51

Using Shorewall, you're looking for a DNAT rule (the online documentation is superb, go there). You'll end up with something like

DNAT net loc: tcp 5678

in your rules file, where is the IP address of your database server. You may have to enable the routeback option if your incoming connection and your web server's connection to the database server are on the same NIC.

However, I very strongly urge you do not do this!! This opens up your database server to literally anyone, explicitly granting them access to masquerade themselves as your web server and negating any ability for the database server to firewall itself. Additionally, everything you do over this connection would be unencrypted, including your database server username and password! So don't do this! Your SSH tunnel provides authentication and encryption, which this port forwarding would not do.

Also, why are you using such an old version of Shorewall? I've been using Shorewall for years, and when I started version 3 was obsolete! You should at least be on 4.0 by now, or better yet 4.2 or 4.4. Keeping your security software up-to-date is absolutely essential!

share|improve this answer

I guess that you can achieve what you want with something like this (not tested, just from memory and probably wont work, but can give you some hints to start). In the web server try:

iptables -t nat -I PREROUTING -p tcp --dport 5678 -j REDIRECT --to-port 1234
iptables -t nat -A PREROUTING -p tcp --dport 1234 -j DNAT --to-destination 

Unless you have your database server directly unreachable from your router, you can do the same just mapping the corresponding ports directly at your router.

However in my opinion you should still using your ssh tunnel because its advantages:

1) the connection require autentification which is good 2) the traffic is encrypted 3) you can tweak your connection whenever you wish with ssh (adding compression, adding more ports to tunnel, adding socks5 bindings, etc...

share|improve this answer
I can just repeat, what hmontoloiu says: Stay with the tunnel. You can write a start script or a regular script to start your tunnel. I would like to add the aspect of using autossh for the connection, since it rebuilds the connection after unwanted disconnects. – ansi_lumen Apr 29 '11 at 9:40
add a .ssh/config file that automatically creates the tunnel whenever you do ssh – Flashman Apr 29 '11 at 18:35

If you don't want to keep the ssh tunnel, you could set up an automatic encrypted VPN like openvpn to do the same. This would keep your server more protected.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.