Static Local Port Forwarding

Static local port forwarding maps one local listening port to one fixed destination host and port. It is the usual choice for a database, internal web server, mail server, or any other single TCP service.

Static local port forwarding architecture A database client process on the local computer connects to local port 3307. Chilkat-managed background threads inside the application process forward the traffic over SSH to the remote SSH server, which connects to db.internal on port 3306. LOCAL COMPUTER Database Client ProcessSeparate executable or processhost = 127.0.0.1port = 3307 Your Application Process Application threadDestHostname = "db.internal"DestPort = 3306BeginAccepting(3307) Chilkat background threadsListener thread accepts clientsTunnel-pool thread manages SSHClient threads relay bytesRuns inside this process controls local TCP REMOTE NETWORK SSH Server ProcessReceives direct-tcpip requestsand reaches db.internal fromthe SSH server's network. Database Server Processdb.internal:3306May be on the SSH server oranother remotely reachable host. Encrypted SSH connection ordinary TCP

Example: the database client connects to 127.0.0.1:3307, while the SSH server connects to db.internal:3306.

Chilkat object or managed thread Separate process or application code SSH server or remote network component Destination service Local-computer boundary

Where each part runs

PartLocationProcess or thread
Database clientLocal computerSeparate process, such as a database administration tool, ODBC consumer, or application
Application codeLocal computerYour application thread configures and controls SshTunnel
Listener and relayLocal computer, same application processChilkat listener, tunnel-pool, and client background threads
SSH serverRemote gateway or serverSeparate SSH server process
Destination databaseReachable from the SSH serverSeparate database server process; it may be on the SSH server or another host

Property and port meanings

SettingMeaning
BeginAccepting(3307)Create the local listening socket on port 3307. The database client connects here.
ListenBindIpAddress = "127.0.0.1"Restrict the listener to clients on the same computer.
DestHostname = "db.internal"The destination host the SSH server will attempt to reach.
DestPort = 3306The destination service port opened by the SSH server.
DynamicPortForwarding = falseUse fixed-destination forwarding. This is the default mode.
Important name-resolution detail: DestHostname identifies a host from the SSH server's network perspective. A private name such as db.internal may be resolvable from the SSH server even when it is not resolvable from the local computer.

Language-neutral API sequence

tunnel.ListenBindIpAddress = "127.0.0.1"
tunnel.DynamicPortForwarding = false
tunnel.DestHostname = "db.internal"
tunnel.DestPort = 3306

success = tunnel.Connect("ssh.example.com", 22)
// Compare tunnel.HostKeyFingerprint with the expected fingerprint.
success = tunnel.AuthenticatePw("ssh-user", "ssh-password")

success = tunnel.BeginAccepting(3307)
// Check tunnel.IsAccepting after the listener thread has started.

Credentials belong to different layers

The SSH username and password authenticate the tunnel application to the SSH server. The database username and password authenticate the database client to the database server. The tunnel transports the database protocol but does not replace database authentication.

Common mistakes

  • Configuring the database client to connect directly to db.internal:3306 instead of the local endpoint 127.0.0.1:3307.
  • Using a local port already occupied by another process. BeginAccepting starts asynchronously, so inspect IsAccepting to confirm the listener remained active.
  • Binding to all interfaces when only local access is intended.
  • Assuming SSH also encrypts the SSH-server-to-database segment.