Reverse SSH tunnel for ELT & CDC

Reverse SSH tunneling allows customers behind strict firewalls to connect their databases to Integrate.io without exposing any inbound ports. Instead of Integrate.io connecting to your server, you initiate an outbound SSH connection to our public jumphost, which creates a port forward that our pipeline containers connect through.

How it works

You generate an SSH key pair on your machine
You provide the public key when creating the tunnel in Integrate.io
Integrate.io allocates a port and provides connection details
You run autossh to establish the reverse tunnel from your network to our jumphost
Integrate.io pipelines connect through the tunnel to reach your database

Tunnel host requirements

The reverse SSH tunnel host runs only a lightweight SSH client (autossh) that forwards a single port to your database. It performs no data processing, so a minimal VM is sufficient. Recommended minimum specification:

CPU: 1 vCPU
RAM: 1 GB
Disk: ~10 GB (OS plus autossh and tunnel logs)
OS: any current Linux distribution with systemd and OpenSSH, for example Ubuntu 20.04/22.04/24.04, Debian 11/12, Amazon Linux 2/2023, or RHEL/CentOS 8/9. Windows Server is also supported (see Reverse SSH Tunnel from Windows (PowerShell)).
Connectivity: outbound SSH access to the Integrate.io jump host.

This maps to the smallest common cloud instance types, such as AWS t3.micro / t4g.micro, Azure B1s, or GCP e2-micro. Sizing note: the only real constraint is network throughput for the database traffic being forwarded, not CPU or RAM. For high-volume CDC workloads, 2 vCPU / 2 GB with adequate network bandwidth is comfortable, but the host never needs to be sized like a data-processing node.

Prerequisites: generate an SSH key

You need to generate an SSH key pair on the machine that will run autossh. The private key stays on your machine, the public key is pasted into Integrate.io. Supported key type: ssh-ed25519

ssh-keygen -t ed25519 -f ~/.ssh/integrateio_reverse -N "" -C "integrateio-reverse-tunnel"
cat ~/.ssh/integrateio_reverse.pub

Copy the output of cat (starts with ssh-ed25519) and paste it into the Your SSH Public Key field in the next step.

Setting up a reverse SSH tunnel

Step 1: Create a new reverse SSH tunnel

On the Connection options section of Source or Destination creation:

Select Connect via secure tunnel
Choose Create a new tunnel
Select Reverse SSH Tunnel from the tunnel type dropdown
Choose your Region (e.g. US East / us-east-1)
Enter a Tunnel name
Paste your SSH public key (generated in the prerequisites above)
Click Create Reverse SSH Tunnel

Creating a new reverse SSH tunnel in Integrate.io

Step 2: Copy the tunnel endpoint

After creation, you will see the Tunnel Endpoint (e.g. virginia-tunnel.flydata.app:12345). The status will show Setup Complete and Inactive until you establish the tunnel from your side.

Step 3: Establish the tunnel

The UI provides step-by-step setup instructions with pre-filled commands. All commands include your tunnel’s endpoint, port, and hostname. Click Copy to copy each one.

Establishing the reverse SSH tunnel connection

3a. Install autossh on your server (or a server that has access to your database):

# Ubuntu/Debian
sudo apt-get install autossh

# CentOS/RHEL
sudo yum install autossh

# macOS
brew install autossh

3b. Add Integrate.io’s server to your known_hosts:

ssh-keyscan -p 50683 <jumphost> >> ~/.ssh/known_hosts

Example:

ssh-keyscan -p 50683 virginia-tunnel.flydata.app >> ~/.ssh/known_hosts

3c. Test the connection:

ssh -NR <allocated_port>:<your-db-host>:<your-db-port> sshtunnel@<jumphost> -i <path-to-private-key> -p 50683 -o "ExitOnForwardFailure yes" -o ServerAliveInterval=10 -o ServerAliveCountMax=1 -v

Example (MySQL on localhost:3306, tunnel port 58115):

ssh -NR 58115:localhost:3306 sshtunnel@virginia-tunnel.flydata.app -i ~/.ssh/integrateio_reverse -p 50683 -o "ExitOnForwardFailure yes" -o ServerAliveInterval=10 -o ServerAliveCountMax=1 -v

You should see remote forward success. Press Ctrl+C to stop the test. 3d. Run autossh for a persistent connection:

AUTOSSH_GATETIME=0 autossh -M 0 -f -N -R <allocated_port>:<your-db-host>:<your-db-port> sshtunnel@<jumphost> -i <path-to-private-key> -p 50683 -o "ExitOnForwardFailure yes" -o ServerAliveInterval=10 -o ServerAliveCountMax=1

Example:

AUTOSSH_GATETIME=0 autossh -M 0 -f -N -R 58115:localhost:3306 sshtunnel@virginia-tunnel.flydata.app -i ~/.ssh/integrateio_reverse -p 50683 -o "ExitOnForwardFailure yes" -o ServerAliveInterval=10 -o ServerAliveCountMax=1

AUTOSSH_GATETIME=0 prevents autossh from exiting if the first connection attempt takes longer than 30 seconds. 3e. Add to crontab for automatic reconnect on reboot: Run crontab -e and add:

@reboot AUTOSSH_GATETIME=0 autossh -M 0 -f -N -R <allocated_port>:<your-db-host>:<your-db-port> sshtunnel@<jumphost> -i <path-to-private-key> -p 50683 -o "ExitOnForwardFailure yes" -o ServerAliveInterval=10 -o ServerAliveCountMax=1

Step 4: Test the tunnel connection

Once your autossh is running, click Test Tunnel Connection in the Integrate.io UI. A successful test shows three green checks:

Tunnel configuration. Tunnel configured correctly
Integrate.io Tunnel is Open. Tunnel on Integrate.io side is open
Connect to User Tunnel. Successfully established connection with the user’s tunnel

Testing the tunnel connection with three green checks

Alternative: Run as a systemd service

For production environments, a systemd service is more robust than crontab: Create /etc/systemd/system/integrateio-reverse-tunnel.service:

[Unit]
Description=Integrate.io Reverse SSH Tunnel
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=<your_user>
ExecStart=/usr/bin/autossh -M 0 -N -R <allocated_port>:<your-db-host>:<your-db-port> sshtunnel@<jumphost> -i /home/<your_user>/.ssh/integrateio_reverse -p 50683 -o "ExitOnForwardFailure yes" -o ServerAliveInterval=10 -o ServerAliveCountMax=1
Environment="AUTOSSH_GATETIME=0"
Restart=always
RestartSec=5

[Install]
WantedBy=multi-user.target

Enable and start:

sudo systemctl daemon-reload
sudo systemctl enable integrateio-reverse-tunnel
sudo systemctl start integrateio-reverse-tunnel
sudo systemctl status integrateio-reverse-tunnel

Getting Started

Pipelines

Sources

Destinations

Monitoring

Security

Transforms

Data Observability

Reverse SSH tunnel for ELT & CDC

How it works

Tunnel host requirements

Prerequisites: generate an SSH key

Setting up a reverse SSH tunnel

Step 1: Create a new reverse SSH tunnel

Step 2: Copy the tunnel endpoint

Step 3: Establish the tunnel

Step 4: Test the tunnel connection

Alternative: Run as a systemd service

IP Allowlist

PrivateLink for MySQL

PrivateLink for PostgreSQL

SSH Tunnel

​How it works

​Tunnel host requirements

​Prerequisites: generate an SSH key

​Setting up a reverse SSH tunnel

​Step 1: Create a new reverse SSH tunnel

​Step 2: Copy the tunnel endpoint

​Step 3: Establish the tunnel

​Step 4: Test the tunnel connection

​Alternative: Run as a systemd service

​Related

IP Allowlist

PrivateLink for MySQL

PrivateLink for PostgreSQL

SSH Tunnel

How it works

Tunnel host requirements

Prerequisites: generate an SSH key

Setting up a reverse SSH tunnel

Step 1: Create a new reverse SSH tunnel

Step 2: Copy the tunnel endpoint

Step 3: Establish the tunnel

Step 4: Test the tunnel connection

Alternative: Run as a systemd service

Related