Re: PVA via sshuttel tunnel

[Ralph Lange via Tech-talk <tech-talk at aps.anl.gov>]

On Fri, 10 Apr 2026 at 08:58, Jörn Dreyer via Tech-talk <tech-talk at aps.anl.gov> wrote:

I choose sshuttle to connect phoebus and my IOC because I have multiple IOC's I want to access and I am not allowed to run a gateway on our login node.

You don't have to run the gateway on the login node.

The whole power (and danger) of SSH tunneling is that you can forward the tunnel to a different machine on the other side.

The normal setup for CA or PVA through SSH tunneling is to have a gateway running e.g. on port 15064 of some "gw" machine (must be reachable from the login node - which is often called "jump host") and then set up a tunnel as, e.g.

ssh -L 12345:gw.example.com:15064 login.example.com

This creates a tunnel from localhost:12345 to gw:15064. Setting your EPICS_PVA_NAME_SERVERS variable or preference to localhost:12345 will reach your gateway.

Cheers,
~Ralph