Just a note for myself because I always forget the syntax of setting up an SSH tunnel:

If you want to use a custom keypair, you first need to ensure they have the proper permissions:

export PRIVATE_KEY=conf/ssh/id_rsa
chmod g-r $PRIVATE_KEY
chmod o-r $PRIVATE_KEY

Setting up the tunnel can then be done as follows:

export LOCAL=127.0.0.1:3306
export REMOTE=127.0.0.1:3306
export DESTINATION=user@remote-server.com
export PRIVATE_KEY=conf/ssh/id_rsa
ssh -L $LOCAL:$REMOTE $DESTINATION -N -i $PRIVATE_KEY