All Products
Search
Document Center

E-MapReduce:Access the web UIs of open source components over an SSH tunnel

Last Updated:Mar 26, 2026

An SSH tunnel lets you securely access the web UIs of open source components on your EMR cluster without exposing the cluster's internal network. Two methods are available: local port forwarding and dynamic port forwarding with a SOCKS proxy.

For all available methods to access open source component web UIs, see Access the web UIs of open source components.

Choose a method

Method Best for Limitation
Local port forwarding Accessing a single component at a time Cannot access job details pages
Dynamic port forwarding Accessing multiple components simultaneously with one tunnel Requires browser proxy configuration

Prerequisites

Before you begin, ensure that you have:

Local port forwarding

Local port forwarding maps a port on your on-premises machine to a port on the master node, so you can access a single component's web UI via localhost.

Important

This method does not support navigation to job details pages.

Step 1: Create an SSH tunnel

Open a terminal on your on-premises machine and run one of the following commands. This example forwards local port 8156 to port 8088 on the master node to access the YARN ResourceManager web UI. To access a different component, replace 8088 with the appropriate port number. For a list of component ports, see Common ports of open source components.

Connect using a private key file

ssh -i <private-key-file-path> -N -L <local-port>:<master-node-name>:<component-port> root@<master-node-public-ip>

Connect using a username and password

ssh -N -L <local-port>:<master-node-name>:<component-port> root@<master-node-public-ip>
Parameter Description Example
-i Path to the private key file used for authentication. See Manage SSH key pairs. ~/.ssh/emr-key.pem
-N Creates the tunnel without running a remote command. The terminal produces no output after the tunnel is established — this is expected.
-L Enables local port forwarding. Forwards traffic from <local-port> to <master-node-name>:<component-port> via the master node.
<private-key-file-path> Path to the private key file. ~/.ssh/emr-key.pem
<local-port> Any unoccupied port on your machine. 8156
<master-node-name> Name of the master node, visible on the Nodes tab of the cluster. See Obtain the public IP address and the name of a node. master-1-1
<component-port> Port of the target open source component. 8088 (YARN)
<master-node-public-ip> Public IP address of the master node, visible on the Nodes tab. See Obtain the public IP address and the name of a node. 203.0.113.10
Important

Keep the terminal running after the tunnel is established. The -N flag means SSH only maintains the tunnel and does not run a remote command, so no output is produced. This is normal behavior.

Step 2: Access the web UI

In a browser address bar, enter http://localhost:<local-port> and press Enter.

For example, to access the YARN ResourceManager, enter http://localhost:8156.

To access multiple component web UIs at the same time, open additional terminals and repeat Step 1 with a different local port for each component.

Dynamic port forwarding

Dynamic port forwarding starts a SOCKS proxy on a local port that routes all traffic through the master node. One tunnel gives you access to any component's web UI — just change the component hostname and port in your browser.

Step 1: Create an SSH tunnel

Open a terminal on your on-premises machine and run one of the following commands. This example starts a SOCKS proxy on local port 8157.

Connect using a private key file

ssh -i <private-key-file-path> -N -D <local-port> root@<master-node-public-ip>

Connect using a username and password

ssh -N -D <local-port> root@<master-node-public-ip>
Parameter Description Example
-i Path to the private key file used for authentication. See Manage SSH key pairs. ~/.ssh/emr-key.pem
-N Creates the tunnel without running a remote command. The terminal produces no output after the tunnel is established — this is expected.
-D Enables dynamic port forwarding. Starts a SOCKS proxy that listens on <local-port> and routes traffic to any port on the master node.
<local-port> Any unoccupied port on your machine. 8157
<master-node-public-ip> Public IP address of the master node, visible on the Nodes tab. See Obtain the public IP address and the name of a node. 203.0.113.10
Important

Keep the terminal running after the tunnel is established. The -N flag means SSH only maintains the tunnel and does not run a remote command, so no output is produced. This is normal behavior.

Step 2: Configure a browser proxy

After the tunnel is running, configure Google Chrome to route traffic through the SOCKS proxy. Use either the CLI or the SwitchyOmega extension.

Option A: CLI

  1. Open a terminal and go to the Google Chrome installation directory for your operating system.

    Operating system Default installation directory
    macOS X /Applications/Google\ Chrome.app/Contents/macOS
    Linux /usr/bin/google-chrome
    Windows (64-bit) C:\Program Files\Google\Chrome\Application\
    Windows (32-bit) C:\Program Files (x86)\Google\Chrome\Application\
  2. Launch Google Chrome with the SOCKS proxy settings. Replace 8157 with the local port you configured in Step 1.

    macOS X
    ./Google\ Chrome --proxy-server="socks5://localhost:8157" --host-resolver-rules="MAP * 0.0.0.0 , EXCLUDE localhost" --user-data-dir=/tmp/
    Linux
    chrome --proxy-server="socks5://localhost:8157" --host-resolver-rules="MAP * 0.0.0.0 , EXCLUDE localhost" --user-data-dir=/tmp/
    Windows
    chrome --proxy-server="socks5://localhost:8157" --host-resolver-rules="MAP * 0.0.0.0 , EXCLUDE localhost" --user-data-dir=c:\\tmppath\\

Option B: SwitchyOmega extension

The SwitchyOmega extension lets you switch between direct and proxy browsing within the same browser window.

  1. Add the SwitchyOmega extension to Google Chrome.

  2. In the left-side navigation pane, click New profile. In the New Profile dialog box, enter a name in the Profile name field (for example, SSH tunnel), select PAC Profile, and then click Create.

  3. In the PAC Script editor, paste the following script. Replace all occurrences of 8157 with the local port you configured in Step 1.

    function regExpMatch(url, pattern) {
      try {
        return new RegExp(pattern).test(url);
      } catch (ex) {
        return false;
      }
    }
    
    function FindProxyForURL(url, host) {
      if (shExpMatch(url, "*localhost*")) return "SOCKS5 localhost:8157";
      if (shExpMatch(url, "*emr-header*")) return "SOCKS5 localhost:8157";
      if (shExpMatch(url, "*emr-worker*")) return "SOCKS5 localhost:8157";
      if (shExpMatch(url, "*master*")) return "SOCKS5 localhost:8157";
      if (shExpMatch(url, "*core*")) return "SOCKS5 localhost:8157";
      return 'DIRECT';
    }
  4. In the left-side navigation pane, click Apply changes.

  5. In the upper-right corner of the browser, select the SSH tunnel profile you created.

Step 3: Access the web UI

In the browser address bar, enter http://<master-node-name>:<component-port> and press Enter.

For example, to access the YARN ResourceManager, enter http://master-1-1:8088.

Parameter Description Example
<master-node-name> Name of the master node, visible on the Nodes tab. See Obtain the public IP address and the name of a node. master-1-1
<component-port> Port of the target open source component. See Common ports of open source components. 8088 (YARN)
To access multiple component web UIs at the same time, change the port number in the address bar. No additional tunnels are needed.

What's next