I have a Mariadb database running in a container, running in a server machine (let’s call its IP address “DB”)

In another server (let’s call its IP address “APP”), an application is running within another container. This application needs to access the database, but I would like to do this via a SSH tunnel, instead of the 3306 port.

I am not familiar with tunnelling, so, from a shell in the container running on the APP machine, I tried:

ssh -f user@DB -L 1234:127.0.0.1:3306 -N -p 5678 -4

(5678 is the SSH port of the DB machine, I can successfully ssh to this machine on this port. And the tunnel is apparently successfully established)

Then I try:

mariadb -h localhost -P 1234 -u dbuser -p

But I get this error:

ERROR 2013 (HY000): Lost connection to server at 'handshake: reading initial communication packet', system error: 11

However, connecting directly to the database works fine:

mariadb -h DB -u dbuser -p

Can you please help me fixing this?

And is tunnelling as I try to do, a proper approach to secure the access to the database?

Many thanks!