---
warning: DO NOT CHANGE THIS MANUALLY, THIS IS GENERATED BY https://github.com/duckdb/community-extensions repository, check README there
title: erpl_tunnel
excerpt: |
  DuckDB Community Extensions
  Reach any TCP service from DuckDB through an SSH bastion, Tailscale or NetBird — and publish local ports back onto those networks.

extension:
  name: erpl_tunnel
  description: Reach any TCP service from DuckDB through an SSH bastion, Tailscale or NetBird — and publish local ports back onto those networks.
  version: 2026.10.20
  language: C++
  build: cmake
  license: BSL 1.1
  excluded_platforms: "windows_amd64_rtools;windows_amd64_mingw;wasm_mvp;wasm_eh;wasm_threads;"
  requires_toolchains: "go"
  # vcpkg.json pins builtin-baseline 84bab45d to hold openssl at 3.5.0: the newer
  # 3.6.0 requires Linux kernel headers the arm64 build container does not carry.
  # Without this the non-v1.5.5 builds would use the older default pin, which
  # predates that baseline.
  vcpkg_commit: 84bab45d415d22042bd0b9081aea57f362da3f35
  maintainers:
    - jrosskopf

repo:
  github: DataZooDE/erpl-tunnel
  ref: 470fa6499b689c50fc323f589fcf73c6a86518ef
  # ref builds against DuckDB 2.0, variegata against v1.5.6; one commit
  # serves both (and v1.4.5 via the ref fallback).
  variegata: 470fa6499b689c50fc323f589fcf73c6a86518ef

extension_star_count: 5
extension_star_count_pretty: 5
extension_download_count: 829
extension_download_count_pretty: 829
image: '/images/community_extensions/social_preview/preview_community_extension_erpl_tunnel.png'
layout: community_extension_doc
---
### Compatibility Matrix

This table covers all DuckDB releases that have not reached [end-of-life](https://duckdb.org/release_calendar), including LTS releases, and shows the 2 most recent patch releases of each. Older patch releases are not listed, but the extension may be available for them as well.

<div class="extension_compatibility_table"></div>

| Platform | 1.4.4 | 1.4.5 | 1.5.5 | 1.5.6 | 2.0.0 |
| :--- | :---: | :---: | :---: | :---: | :---: |
| Linux AMD64 | ❌ | ❌ | ✅ | ✅ | ✅ |
| Linux ARM64 | ❌ | ❌ | ✅ | ✅ | ✅ |
| macOS AMD64 | ❌ | ❌ | ✅ | ✅ | ✅ |
| macOS ARM64 | ❌ | ❌ | ✅ | ✅ | ✅ |
| Windows AMD64 | ❌ | ❌ | ✅ | ✅ | ✅ |
| Windows ARM64 | ❌ | ❌ | ❌ | ❌ | ❌ |
| WebAssembly | ❌ | ❌ | ❌ | ❌ | ❌ |

### Installing and Loading
```sql
INSTALL {{ page.extension.name }} FROM community;
LOAD {{ page.extension.name }};
```

{% if page.docs.hello_world %}
### Example
```sql
{{ page.docs.hello_world }}```
{% endif %}

{% if page.docs.extended_description %}
### About {{ page.extension.name }}
{{ page.docs.extended_description }}
{% endif %}
### Added Functions

<div class="extension_functions_table"></div>

|    function_name     | function_type |                                                                                                                   description                                                                                                                    | comment |                                                     examples                                                     |
|----------------------|---------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------|------------------------------------------------------------------------------------------------------------------|
| tunnel_close         | pragma        | Close one tunnel by id; idempotent, and reports whether the tunnel was still open.                                                                                                                                                               | NULL    | [PRAGMA tunnel_close(1);]                                                                                        |
| tunnel_close_all     | pragma        | Close every open tunnel; idempotent.                                                                                                                                                                                                             | NULL    | [PRAGMA tunnel_close_all;]                                                                                       |
| tunnel_create        | pragma        | Deprecated alias of tunnel_import, kept so existing scripts keep working; use tunnel_import instead.                                                                                                                                             | NULL    | [PRAGMA tunnel_create(secret = 'bastion', remote_host = 'db.internal', remote_port = 5432, local_port = 15432);] |
| tunnel_export        | pragma        | Publish a local port onto the network; returns (tunnel_id, remote_port, message). Named parameters: secret, local_port, local_host, remote_port, remote_host, timeout. Over a mesh backend there is no host to name, so remote_host is rejected. | NULL    | [PRAGMA tunnel_export(secret = 'ts', local_port = 9494);]                                                        |
| tunnel_import        | pragma        | Bring a remote service to a local port; returns (tunnel_id, message). Named parameters: secret, remote_host, remote_port, local_port, timeout, bind_all. Binds 127.0.0.1 unless bind_all is true.                                                | NULL    | [PRAGMA tunnel_import(secret = 'bastion', remote_host = 'db.internal', remote_port = 5432, local_port = 15432);] |
| tunnel_mesh_activate | pragma        | Advanced -- force-load a mesh backend ('tailscale' or 'netbird') now. Normally automatic on first tunnel_import/tunnel_peers; use only to surface auth errors early or to pin the one mesh for this process.                                     | NULL    | [PRAGMA tunnel_mesh_activate('tailscale');]                                                                      |
| tunnel_peers         | table         | Enumerate mesh peers for a tunnel secret (peer-local, no API token).                                                                                                                                                                             | NULL    | [SELECT * FROM tunnel_peers(secret = 'ts')]                                                                      |
| tunnel_self          | table         | Show this node's own mesh identity (name/ip/tags) for a tunnel secret.                                                                                                                                                                           | NULL    | [SELECT * FROM tunnel_self(secret = 'ts')]                                                                       |
| tunnels              | table         | List all active tunnels (SSH and mesh) with their backend, connection details, and status.                                                                                                                                                       | NULL    | [SELECT * FROM tunnels()]                                                                                        |

### Overloaded Functions

<div class="extension_functions_table"></div>

This extension does not add any function overloads.

### Added Types

<div class="extension_types_table"></div>

This extension does not add any types.

### Added Settings

<div class="extension_settings_table"></div>

|          name          |                                                         description                                                         | input_type | scope  | aliases |                   typed_value                   |
|------------------------|-----------------------------------------------------------------------------------------------------------------------------|------------|--------|---------|-------------------------------------------------|
| datazoo_banner         | Show the DataZoo feedback banner when an extension is loaded in an interactive terminal (at most once a day per extension). | BOOLEAN    | GLOBAL | []      | true                                            |
| erpl_telemetry_enabled | Enable ERPL telemetry, see https://erpl.io/telemetry for details.                                                           | BOOLEAN    | GLOBAL | []      | true                                            |
| erpl_telemetry_key     | Telemetry key, see https://erpl.io/telemetry for details.                                                                   | VARCHAR    | GLOBAL | []      | phc_t3wwRLtpyEmLHYaZCSszG0MqVr74J6wnCrj9D41zk2t |
| temp_directory         | Set the directory to which temporary files are written.                                                                     | VARCHAR    | GLOBAL | []      | post.db.tmp                                     |