Skip to main content
Last updated on

Connect serverless compute to on-premises resources using an SSH reverse tunnel

An SSH reverse tunnel connects serverless compute to on-premises resources without opening inbound ports on your on-premises firewall. An on-premises host opens an outbound SSH connection to proxy VMs in your AWS environment, which gives serverless compute a secure, encrypted path to your on-premises resources.

This is a self-managed solution. You provision, monitor, and maintain the proxy VMs and the on-premises tunnel host.

What problem it solves​

An SSH reverse tunnel establishes a dedicated, private connection from serverless compute to on-premises resources without requiring you to open an inbound port on your on-premises firewall. The on-premises host initiates the connection outbound, and traffic from serverless compute flows back over the established tunnel.

When to use an SSH reverse tunnel​

Use an SSH reverse tunnel when your on-premises resources are reachable from the cloud over an existing network path, such as AWS Direct Connect, a site-to-site VPN, or SD-WAN, but your corporate firewall blocks inbound traffic from the cloud.

How it works​

  1. On-premises tunnel hosts run autossh to establish outbound SSH connections to proxy VMs in AWS.
  2. The proxy VMs run socat to accept the tunnels and expose resource ports on their network interfaces.
  3. Databricks connects to the proxy VMs from a private endpoint in your network connectivity configuration (NCC), through a Network Load Balancer that is exposed through a virtual private cloud (VPC) endpoint service.
  4. Serverless traffic flows through the tunnel to the on-premises resources.

Serverless compute connecting through an NCC private endpoint, a VPC endpoint service, and a Network Load Balancer to proxy VMs running socat. On-premises tunnel hosts running autossh open outbound SSH connections to the proxy VMs.

For detailed setup steps, see Connect to on-premises resources using an SSH reverse tunnel.

Considerations​

Review the following before you use an SSH reverse tunnel:

  • This is not a managed solution. You must provision, monitor, and maintain infrastructure both in the cloud and on-premises, which adds cost and operational overhead.
  • Add at least two proxy VMs to the load balancer backend pool so that a tunnel failure on a single VM doesn't block connectivity.
  • Each proxy VM requires a distinct port mapping for each on-premises resource.

Additional resources​

On this page