Monghoul
Esc

    Connect through an SSH tunnel

    Reach a cluster that only listens on a private network, without a VPN, using the tunnel built into the connection.

    Checked against v1.11.0 Updated
    The connection dialog on its Security tab, with the SSH tunnel enabled and its host, port, user and key file filled in
    Connections · The tunnel form, on the Security tab

    If your MongoDB only accepts connections from inside a network, and you can SSH to a machine in that network, you do not need a VPN. Monghoul opens the tunnel itself as part of the connection.

    Set it up

    1. Open the connection dialog and switch to individual-fields mode. A URI cannot carry tunnel settings.
    2. Fill in the MongoDB host and port as the jump host sees them. This is the part people get wrong: if Mongo runs on the jump host itself, that is localhost:27017, not the public name.
    3. Turn on SSH tunnelling and give it the jump host, the port, and your user.
    4. Authenticate with either a password or a private key file. The fields the chosen method needs are checked before it dials.
    5. Test the connection before saving.

    When it will not open

    A tunnel that cannot be established reports the reason, and the connection does not open. It does not fail halfway and leave you wondering which half worked. A cancelled attempt tears down a tunnel that had already come up.

    The tunnel closes with the connection

    Tunnels close when their owning connection, or a connection test, ends. That is intended: the tunnel is part of the connection rather than a separate thing you manage.

    About stored secrets

    Secrets are encrypted on the device that saved them. A connection profile copied to another machine carries a secret that machine cannot decrypt, and Monghoul treats it as empty rather than failing in a confusing way. Re-enter it on the new machine.

    TLS on top

    TLS and the tunnel are independent, and you can use both. Give the connection the CA certificate file rather than allowing invalid certificates, which turns off the check that makes TLS useful.

    Next