Accessing a Private VPS Database through an SSH Tunnel

An SSH local forward lets a database client on your computer reach a private service through the VPS's SSH connection. The database can remain bound to the guest's loopback address without a public database mapping.

PostgreSQL example

On your own computer, use:

ssh -N -o ExitOnForwardFailure=yes \
  -L 127.0.0.1:15432:127.0.0.1:5432 \
  -p PUBLIC_SSH_PORT USER@PUBLIC_HOST

Replace the SSH endpoint and add your key option if needed. Leave this session running, then configure the database client to connect to 127.0.0.1 port 15432 on your computer. The far end connects to port 5432 on the VPS's own loopback interface.

The loopback addresses refer to different computers on each side. Normal database credentials are still required; SSH forwarding does not bypass database authentication.

Keep the forward private

Binding explicitly to local 127.0.0.1 avoids offering the tunnel to your entire local network. Do not use 0.0.0.0 or gateway options unless you intend and secure that exposure. Stop the SSH session when the tunnel is no longer needed.

If it fails

Check whether the local port is already occupied, whether the guest database listens on the expected port and whether SSH forwarding is permitted. ExitOnForwardFailure catches some forwarding setup failures, but it does not prove the database is healthy or that credentials are correct.

See private PostgreSQL, SSH errors and SSH key management.

Reference: OpenSSH forwarding options.