> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lightdash.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect through an SSH tunnel

> Reach a Postgres or Redshift database in a private VPC by tunnelling through a bastion host.

Use an SSH tunnel when your database is in a private VPC and cannot be reached directly from Lightdash. Lightdash opens an SSH connection to a bastion (jump) host that you run in a public subnet of your VPC, and forwards database traffic through it.

The path is **Lightdash Cloud → your bastion host → private database**.

SSH tunnelling is available for the **Postgres** and **Redshift** warehouse types, under the **Use SSH tunnel** option on the connection form.

## Setup

**1. Run a bastion/jump host.** Provision a small server (for example an EC2 instance) in a public subnet of the VPC that contains your database. The bastion needs:

* A public IP or hostname reachable from the internet.
* A user account for Lightdash to log in as (for example `ec2-user` or `ubuntu`).
* Network access to the database on its port (Postgres is typically `5432`, Redshift `5439`) — usually a VPC security group rule that lets the bastion's security group reach the database's security group on that port.

**2. Configure the SSH tunnel in Lightdash.** In your project's connection settings, enable **Use SSH tunnel** and fill in:

* **SSH Remote Host**: the bastion's public hostname or IP.
* **SSH Remote Port**: the bastion's SSH port, usually `22`.
* **SSH Username**: the Linux user Lightdash logs in as.

Lightdash generates a public SSH key for the connection. Copy it.

**3. Authorize the key on the bastion.** Append the public key to `~/.ssh/authorized_keys` for the SSH user you configured above. Authentication is SSH public-key auth — no separate certificate is needed.

**4. Point the database at its private hostname.** Keep the **Host** field on the connection set to the private database endpoint (the one that resolves inside the VPC). Lightdash resolves and connects to it from the bastion, not from the public internet.

**5. Allow Lightdash to reach the bastion.** Add Lightdash's [static IP addresses](/get-started/setup-lightdash/connect-project#adding-lightdashs-static-ip-addresses-to-your-allow-list) to the bastion's security group on the SSH port you configured.

## Encryption between the bastion and the database

The SSH tunnel already encrypts traffic between Lightdash and the bastion. You can additionally enable SSL on the database connection to encrypt the bastion-to-database hop; SSH tunnels work with or without it.