Tunneling for the SQL Developer Tool
Published Sept. 17, 2026, 3:42 p.m. by cloudblog
I can ping 139.x.x.x which is jump server and I need to telnet 10.x.x.x.x with 1521
through tunneling
To tunnel traffic to your internal database (10.x.x.x on port 1521) through your
jump server (139.x.x.x), you can use an SSH local port forwarding command from your local machine.
Step 1: Create the SSH Tunnel
Open your local terminal (Command Prompt, PowerShell, or bash) and run the
following command:
ssh -L 1521:10.x.x.x:1521 user@139.x.x.x
Replace user@139.x.x.x with your actual jump server username and IP address,
and 10.x.x.x with the exact target database IP.
(Optional: If your jump server uses a non-standard SSH port or an SSH key,
add them like this: ssh -i /path/to/key.pem -p 2222 -L 1521:10.x.x.x:1521 user@139.x.x.x)
Step 2: Keep the Session Open
Keep this terminal window open. As long as the SSH session is active, a tunnel
is open that maps port 1521 on your local machine (127.0.0.1) through the jump server to your target destination.
Privileged Access Management (PAM) Help
Step 3: Verify the Connection
You can now test the tunnel from a second local terminal window.
Test using Telnet:
telnet localhost 1521
How to verify: If the screen goes blank or outputs an SSH/Oracle banner, the tunnel is successfully forwarding traffic. If it says "Connection refused", check that your first SSH command is still running and the target IP/port are correct.
Test using Netcat (alternative):
nc -zv localhost 1521
How to verify: A succeeded! or Connected message confirms the port is
listening.
Once verified, you can point your local Oracle client (like SQL Developer,
Python cx_Oracle, etc.) to connect to Host: localhost, Port: 1521.
Privileged Access Management (PAM) Help
Permission denied (publickey,gssapi-keyex,gssapi-with-mic).
To fix the Permission denied (publickey,gssapi-keyex,gssapi-with-mic) error,
your jump server is rejecting your connection because it requires an SSH private
key that hasn't been provided, or the key has incorrect file permissions.
1
Locate your SSH private key
Prerequisite
Find the .pem or id_rsa file provided by your system administrator for accessing
the jump server.
2
Fix key permissions (Mac/Linux only)
Security requirement
If you are on Linux or macOS, SSH will refuse to use a private key if
its permissions are too open. Run this command in your terminal:
Bash
chmod 600 /path/to/your-key.pem
Verification: Run ls -l /path/to/your-key.pem and ensure the permissions
show -rw-------.
3
Connect using the -i flag
Execution
Rerun your SSH tunnel command pointing directly to your private key file:
Bash
ssh -i /path/to/your-key.pem -L 1521:10.x.x.x:1521 user@139.x.x.x
Verification: The terminal should successfully authenticate, connect to the
jump server, and open the interactive session or keep the port forward active without dropping back to your local prompt with a permission error.
Windows Users
If you are using Windows PowerShell or Command Prompt and get permission errors,
make sure you aren't using chmod. Instead, right-click your key file -> Properties -> Security -> Advanced, and ensure only your current user account has Full Control, removing inheritance and other users if necessary.
By default, SSH might prioritize public keys over passwords.
Force SSH to prompt for your password by disabling public key authentication
in the command:
Bash
ssh -o PubkeyAuthentication=no -L 1521:10.x.x.x:1521 user@139.x.x.x
Verification: You should immediately see a password prompt. Type your
jump server password (characters will not show on screen) and hit Enter.
A successful login means the tunnel is active.
Password Authentication Disabled
If the command still fails or says permission denied immediately after
entering the password, it means the jump server's configuration (sshd_config)
has password authentication entirely disabled by the administrator. In that case,
you must obtain the correct SSH key file to gain access.
still not asking for the password and same error
To bypass the forced public key lookup and make SSH ask for your password,
you need to explicitly tell it to ignore all identity files and restrict the
authentication methods.
1
Run with strict auth flags
Execution
Run this command, which stops SSH from trying default keys and explicitly
requests keyboard-interactive/password authentication:
Bash
ssh -o IdentitiesOnly=yes -o PreferredAuthentications=password -L 1521:10.x.x.x:1521
user@139.x.x.x
Verification: You should immediately see a password prompt. Enter your
password to establish the tunnel.
Server-Side Restriction
If the command still immediately throws Permission denied (publickey,...)
without prompting, password login is completely disabled on the jump server's backend configuration. You will need to contact your system administrator to request an SSH key pair or have them enable password authentication for your account.
It still didn't ask for a password. How do I generate an SSH key to give to my admin?
1
Generate the SSH Key Pair
Command Line
Open your terminal and run the following command to generate a secure Ed25519 key pair (replace with your email or username as a label):
Bash
ssh-keygen -t ed25519 -C "your_email@example.com"
Verification: Press Enter to accept the default file location (~/.ssh/id_ed25519) and optionally set a passphrase. When finished, you will see confirmation and random art generation.
2
Locate Your Public Key
File Access
Your public key is the file ending in .pub. You can display its contents in your terminal by running:
Bash
cat ~/.ssh/id_ed25519.pub
Verification: The output will start with ssh-ed25519 followed by a long string of characters and your label.
3
Send to Administrator
Next Step
Copy the entire output string from the previous step and send it to your system
administrator. They will add it to the ~/.ssh/authorized_keys file on the jump server for your user account.
Important
Never share your private key file (id_ed25519 without the .pub extension).
Only share the public key (id_ed25519.pub).
I have the passphrase and username and jump server ip i can connect from putty
and I have .ppk file can I connect through ppk file
Yes, absolutely! Since you already have a working .ppk file and use PuTTY,
you don't need to generate a new key. You can use Plink (PuTTY Link),
which is a command-line tool that comes pre-installed with PuTTY and natively
accepts .ppk files.
1
Create the Tunnel Using Plink
Command Line
Open your command prompt or PowerShell where PuTTY is installed, and run the
following command:
Bash
plink -i "C:\path\to\your_key.ppk" -L 1521:10.x.x.x:1521 user@139.x.x.x
(Make sure to update the path to your .ppk file, the target database IP,
and your jump server username/IP).
Verification: Plink will ask for your passphrase (if your .ppk has one)
and then establish the tunnel. Keep this window open just like you would with PuTTY.
2
Convert .ppk to OpenSSH format (Optional)
Alternative
If you prefer using the standard ssh command instead of Plink, you can
convert your .ppk file:
Open the PuTTYgen application on your Windows machine.
Click Load and select your .ppk file.
In the top menu, go to Conversions -> Export OpenSSH key.
Save it (e.g., as id_rsa).
Then use the standard SSH command:
Bash
ssh -i /path/to/id_rsa -L 1521:10.x.x.x:1521 user@139.x.x.x
Verification: The standard SSH command will prompt for your passphrase and
connect successfully.
.ppk saying invalid format
The standard OpenSSH command (ssh) throws an "invalid format" error because
it cannot read PuTTY's native .ppk format. However, since your .ppk works in PuTTY, you can easily fix this by converting it using PuTTYgen.
GitHub
1
Export to OpenSSH Format using PuTTYgen
Conversion Tool
Open the PuTTYgen application on your Windows machine.
Click Load and select your your_key.ppk file. Enter your passphrase if prompted.
In the top menu bar, click on Conversions -> Export OpenSSH key (use the newer
OpenSSH format option if available).
Save the file without a .ppk extension (for example, name it id_jump or jump_key).
2
Run the Tunnel with the Converted Key
Execution
Now use the newly exported OpenSSH private key file with your standard SSH
command in your terminal:
Bash
ssh -i /path/to/jump_key -L 1521:10.x.x.x:1521 user@139.x.x.x
Verification: It will ask for your key's passphrase, log you into the jump server,
and successfully open the port forwarding tunnel.
Similar posts
There are no similar posts yet.0 comments
There are no comments.