SSH Tunnel to AWS RDS in Private Subnet

SSH Tunnel to RDS

We needed to connect to an RDS DB in the Amazon cloud that is not publicly accessible. Normally we  would connect through an ec2 instance but as this is time consuming and gets quite annoying we looked  at setting this up so we could simply connect via

sqlplus user/pass@tns

How to implement

1. Set up the SSH Tunnel

ssh -N -L 1521:your.rds.endpoint.rds.amazonaws.com:1521 sshuser@yourserver.com

 -N   
only set up the tunnel

 -L   
set up the forwarding

 1521
that first number is the port on your local machine

your.rds.endpoint.amazonaws.com
The name of the rds endpoint

1521
the port on the remote computer

sshuser@yourserver.com
how you log in to your ec2 instance

2. Set up a new tns entry for the tunnel connection

ORACLE-AWS =
  (DESCRIPTION =
    (ADDRESS = (PROTOCOL = TCP)(HOST = 127.0.0.1)(PORT = 1521))
    (CONNECT_DATA =
      (SERVER = DEDICATED)
      (SERVICE_NAME = ORCL)
    )
  )

2. Use the SSH Tunnel

sqlplus user/pass@ORACLE-AWS

This lets you connect to the remote rds instance. Note that you have to use the host here 127.0.0.1 explicitly and that it is not the host you set up earlier. This is because it is now forwarding all of the requests. That’s all.

To be clear on how the ports work, here is another example

ssh -N -L 1234:your.rds.endpoint.rds.amazonaws.com:1521 sshuser@yourserver.com

ORACLE-AWS =
  (DESCRIPTION =
    (ADDRESS = (PROTOCOL = TCP)(HOST = 127.0.0.1)(PORT = 1521))
    (CONNECT_DATA =
      (SERVER = DEDICATED)
      (SERVICE_NAME = ORCL)
    )
  )

This states that forward from port 1234 on my computer to port 1521 on the remote instance.