SSH Tunnel
Reach a database that only listens on localhost by tunneling through a bastion host.
🔒 Pro feature. SSH tunnels are gated to the Pro tier. Test and Save are blocked on Free.
When to use
Your database is on a private network and only reachable from a bastion/jump host. Typical cases: database in a private subnet, database bound to 127.0.0.1 on a remote server, or cloud DB that only whitelists the bastion IP.
Enable
Toggle SSH Tunnel on the connection form to reveal the SSH fields.
Fields
Bastion (the SSH server)
| Field | Required | Default |
|---|---|---|
| Host | yes | — |
| Port | yes | 22 |
| Username | yes | — |
Authentication
Two modes are supported:
Password
Username + password stored in the OS keychain.
Private Key
Path to a private key file (e.g. ~/.ssh/id_ed25519). If the key is encrypted, also provide a passphrase — stored in the keychain separately from the key file.
Target (the database)
The database host/port from the bastion's perspective — usually 127.0.0.1:<db port>.
Behavior
Ephemeral local port
RaisDB opens a random local port and forwards it through the tunnel. You don't configure the local side.
Reuse across queries
The tunnel is opened on first connect and cached per connection — subsequent queries reuse it.
Auto-reconnect
If the SSH link drops, RaisDB retries with exponential backoff (1s → 2s → 4s → 8s → 16s, 5 attempts).
Combining with SSL
SSH and SSL can be layered. See SSL / TLS.