title: SSH Port forwarding / Tunneling with multiple hops
body: <p><a href="https://i.stack.imgur.com/1imYQ.jpg" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/1imYQ.jpg" alt="SSH-Tunneling"></a></p>
  
  <p><strong>Background</strong></p>
  
  <ul>
  <li>Three subnets exist in an AZ in AWS. Two of them are private and one is public.</li>
  <li><p>The Public Subnet has a <code>Jumpbox</code> which can be connected to from my local machine via <code>ssh</code> using a <code>pem</code> file (Sample - <code>ssh -i my-key-file.pem ec2-user@host1</code></p></li>
  <li><p>The First private subnet has an EC2 Instance that acts as a Application Server. It can only be reached from the Jumbox via <code>ssh</code>. The same <code>pem</code> file is used here. (Sample - <code>ssh -i my-key-file.pem ec2-user@host2</code>). This command is executed on <code>host1</code>.</p></li>
  <li>The second private subnet hosts an Oracle Instance using AWS RDS Service. It is running on port <code>1521</code>. The DB Can only be accessed from the App Server/<code>host2</code>.</li>
  </ul>
  
  <p><strong>How I am working currently</strong></p>
  
  <ul>
  <li><p><code>host2</code> has <code>sqlplus</code> client installed. </p></li>
  <li><p>First,I connect to <code>host1</code>, then to <code>host2</code>, and then execute <code>sqlplus</code> to execute Queries at the Command line (No GUI).</p></li>
  </ul>
  
  <p>I am planning to use GUI tools like SQL Developer to connect right from my local machine. I thought using Port forwarding/SSH Tunneling It can be achieved. </p>
  
  <p>I tried using different options, but with no success. The following links are useful:</p>
  
  <ul>
  <li><a href="https://superuser.com/questions/96489/an-ssh-tunnel-via-multiple-hops">https://superuser.com/questions/96489/an-ssh-tunnel-via-multiple-hops</a></li>
  <li><a href="https://rufflewind.com/2014-03-02/ssh-port-forwarding" rel="nofollow noreferrer">https://rufflewind.com/2014-03-02/ssh-port-forwarding</a></li>
  </ul>
  
  <p><strong>My Approach to SSH Tunneling</strong></p>
  
  <ul>
  <li><code>ssh -N -L 9999:127.0.0.1:1234 ec2-user@host1 -i my-key-file.pem -v -v -v</code>
  
  <ul>
  <li>This is executed on my local machine.</li>
  <li>It does not do much as I can already connect to <code>host1</code> using <code>ssh</code>. I did not know how to forward many levels. Using this host as my first hop. After this, <code>ssh</code> listens on port <code>9999</code> which is <code>Local</code> to my machine. It forwards any traffic to <code>host1</code> to Port <code>1234</code>. <em>My assumption is that, If I use sqlplus on my local machine connecting to <code>localhost:9999</code>, the traffic will arrive at <code>host1:1234</code></em></li>
  <li>I used <code>127.0.0.1</code> because the target of SSH tunneling is with respect to the SSH Server, which is <code>host1</code>. Basically, Both <em>Target</em>, <em>SSH Server</em> are on the same host.</li>
  </ul></li>
  <li><p><code>ssh -N -L 1234:db-host:1521 ec2-user@host2 -i my-key-file.pem -v -v- v</code></p>
  
  <ul>
  <li>This is executed on <code>host1</code></li>
  <li><p>After this, ssh forwards any incoming traffic on port <code>1234</code> to target host (DB Host)/1521 using <code>host2</code> as the Tunnel. </p></li>
  <li><p>Again, my assumption is that, <code>ssh</code> is listening on port <code>1234</code> on <code>host1</code>. Any traffic arriving from anywhere will be delivered to <code>DB Host</code> using <code>host2</code> as the tunnel.</p></li>
  </ul></li>
  </ul>
  
  <p>I executed both commands and did not see any error. I verified which ports are listening using <code>netstat -tulpn | grep LISTEN</code>.</p>
  
  <p>After these two, My plan was to connect to the Database using Hostname as <code>localhost</code> and Port number as <code>9999</code>. </p>
  
  <p><strong>What's going wrong !</strong></p>
  
  <ul>
  <li>But when I try to connect to the DB from my local machine, getting an error from my SQL Client <em>Got minus one from a read call</em>. I could not understand the Debug messages from ssh logs.</li>
  </ul>
  
  <p>I believe my understanding of how port forwarding works might not be right. Any inputs would be helpful. 
  Thanks for your time !</p>