# Using Lens to connect to private cluster via a Bastion host **URL:** \ **Category:** Lens Support & Troubleshooting\ **Tags:** lens-desktop, kubernetes, cluster\ **Created:** [January 27, 2025, 7:22am UTC](https://forums.k8slens.dev/t/using-lens-to-connect-to-private-cluster-via-a-bastion-host/5476 "2025-01-27T07:22:43Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![yakshavingcatherder](https://forums.k8slens.dev/letter_avatar_proxy/v4/letter/y/90db22/32.png) [@yakshavingcatherder](https://forums.k8slens.dev/u/yakshavingcatherder)\ **Post date:** [January 27, 2025, 7:22am UTC](https://forums.k8slens.dev/t/using-lens-to-connect-to-private-cluster-via-a-bastion-host/5476/1 "2025-01-27T07:22:43Z")
So the set up is: [[localhost]] -----\> [[Private Bastion (reqs VPN)]] -----\> [[Private Cluster]] Notes: - confirmed ability to SSH into the Bastion from my local. - confirmed ability to run k9s from the Bastion to communicate with the cluster. Preferred Outcome: Ability to open Lens on my workstation and, provided VPN is enabled and SSH tunnel is active, communicate with a private cluster; effectively this would just remove any mental capacity regarding the Bastion host acting as an intermediary. Steps Taken: - Confirmed ability to SSH into Bastion with a private key (they were using password only before) - Opened an SSH tunnel from my workstation via `ssh -i ~/.ssh/jumpbox -l jumpadmin -L 50479:127.0.0.1:6443 172,257.257.257` - tried both `127.0.0.1` and `localhost` - tried both `50479:` and `6443:` as local ports for tunnel - Also attempted to edit the kubeconfig file that was scp’d down from the Bastion with changes from [this GH issue thread](https://github.com/lensapp/lens/issues/388#issuecomment-764441887). Essentially attempting to remove the `certificate-authority-data` and replace it with the `insecure-skip-verify` flag Error From Lens across all attempts: > | INFO | Starting connection … | > | --- | --- | > | INFO | Authentication proxy started | > | INFO | Refreshing connection status … | > | ERROR | E0123 08:30:10.351730 13940 proxy\_server.go:147] Error while proxying request: proxyconnect tcp: dial tcp 127.0.0.1:6443: connectex: No connection could be made because the target machine actively refused it. | > | ERROR | Failed to GET [https://127.0.0.1:50479/b0d05e3f4755d0c283565ed705b7c94b/version:](https://127.0.0.1:50479/b0d05e3f4755d0c283565ed705b7c94b/version:) Internal Server Error (500) | I’m sure I’m missing something simple here but the new UI seems unwieldy for anything but cookie-cutter setups ---
**Author:** ![cvdlinden](https://forums.k8slens.dev/letter_avatar_proxy/v4/letter/c/e8c25b/32.png) [@cvdlinden](https://forums.k8slens.dev/u/cvdlinden)\ **Post date:** [January 27, 2025, 11:08am UTC](https://forums.k8slens.dev/t/using-lens-to-connect-to-private-cluster-via-a-bastion-host/5476/2 "2025-01-27T11:08:53Z")
Hello @yakshavingcatherder , Thank you for reaching out! I have contacted our development team regarding your issue .