SSM tunnels

A tunnel forwards a port on your Mac to a port on an EC2 instance, or through the instance to another host it can reach, such as an RDS database or a broker in a private subnet. It uses AWS Systems Manager port forwarding, so the instance needs no open ports or SSH keys.

Freeleapp runs each tunnel in the background, with no terminal window, and keeps a list of them so you can start them again with one click. It needs the same AWS CLI and Session Manager plugin as SSM sessions.

Create a tunnel

Right-click an AWS session and choose View SSM Sessions.
Select the region, then click Forward Port on the instance that forwards the traffic.

Fill in the tunnel:

Field	What to enter
Name	How the tunnel appears in the list. Left empty, it becomes `host:port`.
Remote Host	Empty to reach a port on the instance itself, or a host the instance can reach, e.g. `mydb.abc123.us-west-2.rds.amazonaws.com`.
Remote Port	The port on that host, e.g. `5432`. The buttons below it fill in common ones: PostgreSQL, MySQL, Redis, RabbitMQ and its management UI, SSH and RDP.
Local Port	The port on your Mac, e.g. `15432`. Empty follows Settings › SSM › Default Local Port: the remote port, or a free port when the remote one is taken on your Mac. Use a Free Port picks one nobody uses.
Also start it whenever this session starts	Starts the tunnel every time its session starts.

Click Start Tunnel. Once it shows Active, connect your tool to localhost:<local port>:
Terminal window
```
psql -h localhost -p 15432 -U app
```

Copy Command copies the equivalent aws ssm start-session command with the session’s named profile, to run it from a terminal instead. Open in Terminal runs it in a terminal window without saving a tunnel.

Tunnels view

Tunnels in the sidebar lists every tunnel with its target, local address and status; the badge next to it counts the running ones. The search box filters tunnels by name, session, profile, target or port. From there you can:

Start or Stop a tunnel.
Click the local address to copy localhost:<port>.
Open … to Copy Command, Pin Tunnel, Edit Tunnel or Delete Tunnel. A running tunnel restarts when its host or ports change.

Pinned tunnels are listed first, and on their own under Pinned Tunnels.

How tunnels behave

Credentials: each start uses fresh temporary credentials from the tunnel’s session, passed to the AWS CLI only through its environment. The session does not need to be active.
Dropped connections: a tunnel that drops is started again with new credentials, up to three times in a row, and shows Reconnecting meanwhile. After that it shows Failed with the last error.
Busy ports: if the local port is already in use, the tunnel fails right away and says so. Edit it to use another port.
Quitting: tunnels stop when Freeleapp quits. If Freeleapp crashes or is forced to quit, it stops the tunnels left running the next time it starts.
Deleting a session also deletes its tunnels.