Accessing a Private hosted application via Public/Bastion instance [AWS]

Let's say you have an application which you have deployed in your Private subnet in AWS and you want to access that application via your Bastion instance / Browser.

1. Assuming that you already have deployed the application on one of your Private Subnet EC2 instance.
2. If deployed correctly, that application should be accessible via http://PRIVATE_IP:PORT/ but since your private instance doesn't have internet access and you cannot directly connect to it. We will use an alternative to it.

So to achieve this we will set-up an SSH tunnel and then use it to connect to our application via any Browser.

$ ssh -N -R LOCAL_PORT:REMOTE_APP_HOST:REMOTE_APP_PORT USER@LOCAL_HOST -i KEY.PEM

Man entry for -R flag:

-R [bind_address:]port:host:hostport -R [bind_address:]port:local_socket -R remote_socket:host:hostport -R remote_socket:local_socket Specifies that connections to the given TCP port or Unix socket on the remote (server) host are to be forwarded to the given host and port, or Unix socket, on the local side. This works by allocating a socket to listen to either a TCP port or to a Unix socket on the remote side. Whenever a connection is made to this port or Unix socket, the connection is forwarded over the secure channel, and a connection is made to either host port hostport, or local_socket, from the local machine. Port forwardings can also be specified in the configuration file. Privileged ports can be forwarded only when logging in as root on the remote machine. IPv6 addresses can be specified by enclosing the address in square brackets. By default, TCP listening sockets on the server will be bound to the loopback interface only. This may be overridden by specifying a bind_address. An empty bind_address, or the address ‘*’, indicates that the remote socket should listen on all interfaces. Specifying a remote bind_address will only succeed if the server's GatewayPorts option is enabled (see sshd_config(5)). If the port argument is ‘0’, the listen port will be dynamically allocated on the server and reported to the client at run time. When used together with -O forward the allocated port will be printed to the standard output.

Man entry for -N flag:

-N  Do not execute a remote command. This is useful for just forwarding ports.

Man entry for -i flag:

-i identity_file Selects a file from which the identity (private key) for public key authentication is read. The default is ~/.ssh/identity for protocol version 1, and ~/.ssh/id_dsa, ~/.ssh/id_ecdsa, ~/.ssh/id_ed25519 and ~/.ssh/id_rsa for protocol version 2. Identity files may also be specified on a per-host basis in the configuration file. It is possible to have multiple -i options (and multiple identities specified in configuration files). If no certificates have been explicitly specified by the CertificateFile directive, ssh will also try to load certificate information from the filename obtained by appending -cert.pub to identity filenames.

And our application is accessible now :)