title: Amazon RDS connection over SSH tunnel (no PEM key file due to provisioning with Laravel Forge)
body: <p>I have provisioned an EC2 instance via forge. When doing this, you do not get the opportunity to download the PEM key. Instead, I have added my local key to the forge SSH configuration. </p>
  
  <p>I can now SSH into the EC2 instance with <code>ssh forge@IPADDRESS</code> - all good.</p>
  
  <p>I have a RDS instance setup within the same VPC. I have tested this from the EC2 instance and and can:</p>
  
  <ul>
  <li>Connect to MySQL via my EC2 instance in terminal. Using:</li>
  </ul>
  
  <pre><code>mysql -h RDSINSTANCE.ENDPOINT.eu-west-2.rds.amazonaws.com -u USERNAME -p
  </code></pre>
  
  <ul>
  <li>Checked that the 3306 port is open via telnet.</li>
  </ul>
  
  <pre><code>telnet RDSINSTANCE.ENDPOINT.eu-west-2.rds.amazonaws.com 3306
  </code></pre>
  
  <p>The above all seems to suggest that the RDS instance has a connection to the EC2 instance.</p>
  
  <p>I now need to open an SSL tunnel from my laptop, to connect sequelpro. Due to not having the PEM file, I have opened an SSH tunnel using the command:</p>
  
  <pre><code>ssh -L 3307:FORGE-PRIVATE-IP:3306 forge@FORGE-PUBLIC-IP
  </code></pre>
  
  <p>This appears to work ok. However, when trying to connect to SQL via sequel pro with settings:</p>
  
  <p>HOST: 127.0.0.1
  PORT:3307
  USER: USERNAME
  PASSWORD: PASSWORD</p>
  
  <p>I get the following error from seqelpro:</p>
  
  <pre><code>Lost connection to MySQL server at 'reading initial communication packet', system error: 0
  
  </code></pre>
  
  <p>and in verbose mode in terminal:</p>
  
  <pre><code>debug1: Connection to port 3307 forwarding to 172.30.0.110 port 3306 requested.
  debug1: channel 2: new [direct-tcpip]
  channel 2: open failed: connect failed: Connection refused
  debug1: channel 2: free: direct-tcpip: listening port 3307 for 172.30.0.110 port 3306, connect from 127.0.0.1 port 56172 to 127.0.0.1 port 3307, nchannels 3
  </code></pre>
  
  <p>AWS support seem to think this is because the tunnel is not setup correctly, but I am unsure of any other ways.</p>