> For the complete documentation index, see [llms.txt](https://docs.tonic.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.tonic.ai/fabricate/workspaces/workspace-network-tunnels.md).

# Configuring available SSH tunnels for a workspace

{% hint style="info" %}
The SSH tunneling option is currently in private preview. To request access, contact Tonic.ai.
{% endhint %}

For the following data platforms, you can configure [server connections](/fabricate/workspaces/workspace-server-connections.md) to connect through an SSH bastion tunnel:

* Amazon Redshift
* Google BigQuery
* MySQL
* PostgreSQL
* Snowflake
* SQL Server

On the workspace settings page, the **Network tunnels** section contains the list of available tunnels.

## Required sshd\_config settings

Fabricate's SSH network tunneling uses the `direct-tcpip` SSH channel to open connections inside your private network.

To support this, your `/etc/ssh/sshd_config` must include the following options:

* `AllowTcpForwarding local`
* `PermitOpen <host>:<port>`, where:
  * `<host>` is the hostname for the database.
  * `<port>` is the port for the database.
* For SQL Server, to support connection redirects, `PermitOpen any sshd_config`.

Here is an example configuration:

{% code overflow="wrap" %}

```
Match User fabricate-tunnel-user
    # Required for tunneling
    AllowTcpForwarding local
    PermitOpen <host>:<port>

    # Not required for tunneling. For additional security,
    # you can explicitly disable these options.
    AllowStreamLocalForwarding no
    AllowAgentForwarding no
    X11Forwarding no
    PermitTunnel no
    GatewayPorts no
    PermitTTY no
    PermitUserRC no
    ForceCommand /sbin/nologin

    # Other configuration. Set these based on your network.
    PasswordAuthentication no
    AuthenticationMethods publickey
```

{% endcode %}

## Information in the tunnels list

For each tunnel, the list includes:

* The name of the tunnel.
* The type of tunnel. Fabricate currently only supports SSH bastion tunnels.
* The SSH bastion host address.
* The user to use for the connection.
* When the tunnel was most recently modified.

## Adding a tunnel

To add a tunnel, click **Add Network Tunnel**.

<figure><img src="https://4109733485-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmoU4gTR9LxlzHeWmQCUZ%2Fuploads%2FYfJqcmwOLjMPexE1k0KK%2FWorkspace_NetworkTunnelAdd.png?alt=media&amp;token=f3ec0e60-ed26-470a-a90f-191792dc6500" alt=""><figcaption><p>Add Network Tunnel panel to add a network tunnel to the workspace</p></figcaption></figure>

### Setting the tunnel name and type

On the **Add Network Tunnel** panel:

1. In the **Name** field, provide a name for the tunnel.\
   \
   After you save the tunnel, you cannot change the tunnel name.
2. From the **Type** dropdown list, select the tunnel type.\
   \
   Fabricate currently only supports SSH bastion tunnels.

### Setting the bastion host and port

For an SSH bastion tunnel:

1. In the **Bastion host** field, provide the host to use for the tunnel connection.
2. In the **Port** field, provide the port to use for the tunnel connection.

### Configuring the authentication

From the **Authentication** dropdown list, select the type of authentication to use. The options are:

* Private key
* Password

#### Providing the private key and key passphrase

For private key authentication:

<figure><img src="https://4109733485-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmoU4gTR9LxlzHeWmQCUZ%2Fuploads%2FRU6tedkkbirrl78veXLE%2FWorkspace_NetworkTunnelPrivateKey.png?alt=media&amp;token=51cc5305-318f-4257-98e5-004adeb94c29" alt=""><figcaption><p>Fields to configure a private key for network tunnel authentication</p></figcaption></figure>

1. In the **Private key** field, paste the content of an OpenSSH private key.
2. Optionally, in the **Key passphrase** field, provide the required passphrase to use with the key.

#### Providing the password

For password authentication, in the **Password** field, provide the password.

<figure><img src="https://4109733485-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmoU4gTR9LxlzHeWmQCUZ%2Fuploads%2FczrdQMto1NsbOvkDtFWr%2FWorkspace_NetworkTunnelPassword.png?alt=media&amp;token=5cd588dd-6e08-47de-9b0f-29ae991f5518" alt=""><figcaption><p>Fields to configure a password for network tunnel authentication</p></figcaption></figure>

### Requiring a pinned identity for the bastion host

To require the bastion host to verify its identity:

1. Check the Require pinned identity checkbox.
2. In the **Host key fingerprints** text area, provide one or more SHA256 encrypted keys or a public key lines. Put each item on a separate line.

<figure><img src="https://4109733485-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmoU4gTR9LxlzHeWmQCUZ%2Fuploads%2FYkFXPPJKsztwzRn1GQYg%2FWorkspace_NetworkTunnelPinnedIdentity.png?alt=media&amp;token=75609499-65da-4709-acd9-dae09b9c2e56" alt=""><figcaption><p>Providing host key fingerprints to verify the bastion identity</p></figcaption></figure>

### Providing notes about the tunnel

In the **Notes** field, provide any additional notes about the tunnel and how to use it.

### Testing and saving the tunnel

1. To test the configuration, click **Test tunnel**.
2. To save the tunnel, click **Save**.

## Editing a tunnel configuration

To edit the configuration of an existing tunnel:

1. In the **Network tunnels** list, click the edit icon for the tunnel.
2. On the tunnel details, edit the configuration.\
   \
   You cannot change the tunnel name.
3. To test the updated configuration, click **Test tunnel**.
4. To save the configuration changes, click **Save**.

The configuration changes do not apply to requests that are currently using the tunnel. Future requests use the new configuration.

## Deleting a tunnel

You cannot delete a tunnel that is used in a server connection.

To delete a tunnel:

1. In the **Network tunnels** list, click the delete icon for the tunnel.
2. On the confirmation panel, click **Delete**.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.tonic.ai/fabricate/workspaces/workspace-network-tunnels.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.