Mysql – Connecting to an AWS RDS behind a NAT with an SSH tunnel

Found the answer. I need to specify the port number when making the connection, per this article: http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_ConnectToInstance.html

The problem:

standard AMI instance not working correctly as a NAT instance

If you try to use a standard AMI instance as a NAT instance it'll have the same symptoms as described in the question above:

• SSH connection to the NAT = OK
• SSH connection to private subnet instance = OK
• ping to/from private subnet instance = OK
• private subnet instance outbound calls = FAIL (even with valid route tables/security groups)

The hard solution:

To get a standard AMI instance working as a NAT instance you need to customise it:

• modify the iptables as shown here
• ensure IPv4 forwarding is enabled and ICMP redirects are disabled as noted here

The easy solution:

use a Community amzn-ami-vpc-nat instance already configured for use as a NAT instance

For most people (who are using the NAT instance for admin connection purposes) a customised NAT instance is simply unnecessary.

AWS provides standard instances configured for NAT use (ie modified as described above) as community AMI instances.

• click Launch Instance in the EC2 control panel
• in Step 1: Choose an Amazon Machine Image (AMI) click the Community AMIs selector on the left
• type amzn-ami-vpc-nat 2017 or more simply nat 2017 (note below) in the search input box
• launch your NAT and ensure your route tables + security groups are correct - see here

Note:
The reason you include the year in the Community AMI instance search is that AWS keeps all the old NAT AMI versions (21 at the time of writing, going back to 2013) - which mostly include a year in the version number
...it's best / easiest to simply choose the latest version.