Hi I am trying to use puppet client/master to set up my servers. I have everything working perfectly on local VM's and now I'm trying to set up my first external server. However I can't get the client on the external server to connect to the master; probably because the master is behind a firewall with only port 22 open. I started looking into SSH tunnels but I can't seem to get it working. Does anyone have any experience with this?
Your best bet is to file a ticket requesting the following firewall rule be enabled:
The Client<->Master communication is already encrypted over an SSL tunnel. In order to have it go over ssh will require some configuration hackery on both clients and server that will only serve to confuse and confound anyone else that works on your environment. You're better off having off opening the firewall.
I wouldn't discount what Scott Pack says, but the hackery isn't that big a deal for one-shot type use, and sometimes this is useful for deployment. ssh is less acceptable for a persistent tunnel, and in any case for ongoing maintenance via puppet, see Scott's answer and do it properly.
You can trigger puppet from the puppetmaster like so:
You can use any server name that matches up with the puppetmaster's certificate, and you map that name to localhost in the client's /etc/hosts file.