Connect to unroutable Cloud Foundry services via SSH tunnel

We run some of our customers’ applications in Cloud Foundry and ran into an issue with a service plan recently. One of the developer requirements was remote access to the service (Redis) but in this case the service could only be bound to an app and did not support routes.

As a workaround the developers can set up a tunnel to map the service to a local port on their computer.

After logging into the Cloud Foundry cluster with:

cf login -u "${USERNAME}" -a https://api.pcf.mycorp.tld --sso

Create an SSH tunnel with CF CLI1 that forwards your local port 6379 to the hostname and port defined in the redis instance’s Service Key Credentials2 config followed by the smart-api instance name:

# cf ssh -L $LocalPort:$TargetHostnameOrIP:$TargetPort $AppName
$ cf ssh -L 6379:q-s0.redis-instance.dynamic-services.service-instance-3524d1f6-2892-445a-9ac6-0e5ab33565e2.bosh:6379 myapp-api-2.5.5-144

In a Redis GUI Client of your choice create a new connection with the following settings:

  • Host: localhost
  • Port: 6379
  • Auth: <password fields from redis "Service Key Credentials">


  1. Install with brew install cloudfoundry/tap/cf-cli 

  2. Can be found under: space > Services > click on Service Name > Service Key Credentials