Here's the network setup:

Machine A (my PC) SSH 22 => Machine B (Linode with root access) SSH 21343 => Machine C (MySQL server).

I want to forward port 3306 from C through B to A, so I can use SQL Workbench on A to execute commands on C.

Note that C is only accessible over SSH port 21343 and only from B (we cannot change the firewall on C to open any more ports, but we can change its SSH settings).

Is this possible? I've read about tunnels and ProxyCommand. But I need a simple step-by-step example.

All machines are debian Lenny.

  • 1
    possible duplicate of SSH tunneling and port forwarding – voretaq7 Aug 28 '11 at 16:54
  • 1
    See the question I marked as a dupe, also see the man page for ssh, specifically the -L option. – voretaq7 Aug 28 '11 at 16:54
  • The dupe question seems to only refer to two machines. I don't understand it. – Moishe Mo Aug 28 '11 at 18:07
  • @Moshie - Please read the man page as it explains how to use an intermediate machine (b) to forward ports exactly the way you wish. See also Quanta's answer below. – voretaq7 Aug 28 '11 at 18:22

On the machine A:

ssh -L 3307:C:3306 user@B

This allocated a socket listen to port 3307 on A. And whenever a connection is made to this port, it is forwarded over ssh tunnel to C:3306.

You can then connect to MySQL server on C with:

mysql -u <user> -p -h -P 3307

( to connect via TCP/IP instead of a socket)

No, I cannot connect to MySQL on C from B. Only SSH listening on 21343 is open to B.

If the firewall on C only allow to connect from localhost, something like this:

iptables -A INPUT -p tcp -s --dport 3306 -j ACCEPT
iptables -A INPUT -p tcp --dport 3306 -j DROP

so, AFAIK, there is no way to do this. If you try to connect over ssh tunnel, you will get the below errors:

ERROR 2013 (HY000): Lost connection to MySQL server at 'reading initial communication packet', system error: 0
  • Only machine B can talk to machine C, and only over SSH port 21343 – Moishe Mo Aug 28 '11 at 18:04
  • Can you connect to MySQL server on C from B? – quanta Aug 29 '11 at 2:15
  • Hi Quanta, thanks for the follow-up. No, I cannot connect to MySQL on C from B. Only SSH listening on 21343 is open to B. – Moishe Mo Aug 31 '11 at 3:12
  • Please check out my above answer. – quanta Aug 31 '11 at 7:17

~/.ssh/config on machine A looks like this:

Host C
  ProxyCommand ssh -q B nc %h %p
  LocalForward 3306 localhost:3306
  Port 21343

Host B
  Hostname X.X.X.X  (ip of host B)

Then on A ssh C

and in another terminal on A run mysql -h localhost This will connect you to mysql on C over the ssh port forward.


You might consider something along the lines of http://sourceforge.net/projects/portfwd/ on machine B, possibly listening on something other than TCP 22 so SSH can remain on its standard port for machine B.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.