Secure Connections via SSH Tunneling (Port Forwarding) in Cloud Environments

The Danger of Exposing Databases Directly to the Internet

When provisioning database instances or internal servers on cloud platforms like Oracle Cloud Infrastructure (OCI), one of the most critical architectural errors an administrator can make is assigning public IP addresses directly to these sensitive services or opening database ports (such as Oracle's 1521 or PostgreSQL's 5432) in the VCN public firewall rules.

This direct exposure opens gaps for automated port scans on the internet, brute‑force attacks, and intrusion attempts. The best corporate practice for managing these servers strictly securely without exposing them to the outside world is the use of SSH tunnels with port forwarding (SSH Tunneling / Port Forwarding).

How Does the SSH Tunnel Work?

SSH (Secure Shell) is not only used to access remote terminals via command line; it also has the native ability to create an encrypted, point‑to‑point secure communication channel between your local machine and an intermediate server in the cloud (often called a Bastion Host or Jump Host).

Through this encrypted tunnel, network traffic from your local management tool (like Oracle SQL Developer or DBeaver) is encapsulated inside the SSH protocol, allowing you to access private cloud services as if you were directly connected to the company's internal network.

Implementing Local Port Forwarding in Practice

Imagine the following secure architecture scenario:

• A Bastion server (with a public IP and access allowed only from your corporate IP on port 22).
• A database running on a Private Subnet in the cloud (with internal IP 10.0.1.15, no public IP).

To connect your local SQL client directly to this private database through the Bastion, you execute the following command in your local machine terminal:

ssh -i /path/to/your/private_key.key -L 1522:10.0.1.15:1521 opc@bastion_public_ip -N

Understanding the command parameters:

• -i: Specifies the authorized SSH private key file.
• -L 1522:10.0.1.15:1521: Defines the local forwarding. Tells SSH to listen on local port 1522 of your machine and redirect all traffic through the tunnel to the private IP 10.0.1.15 on destination port 1521.
• opc@bastion_public_ip: Username and public IP address of the Bastion intermediate server.
• -N: Tells SSH that no remote command will be executed in the terminal; only port forwarding should be kept active.

With the tunnel open, when configuring the connection in your local Oracle SQL Developer, simply point the host to localhost (or 127.0.0.1) and use port 1522. The traffic will pass fully encrypted through the Bastion until it reaches the private database with maximum security.

Operational Security Advantages

1. Zero Public Attack Surface: The database remains isolated in a private subnet, with no ports open to the public internet.
2. End‑to‑End Encryption: All administrative traffic travels tunneled under robust SSH keys.
3. Centralized Auditing: Administrative access is restricted and monitored through the edge Bastion server.

Conclusion

Adopting SSH tunneling for cloud infrastructure management is an indispensable skill for engineers and developers seeking to combine operational agility and absolute rigor in information security.